Under Personal Information Protection and Electronic Documents Act (PIPEDA), there is nothing that prevents organizations from outsourcing the processing of data inside or outside of Canada—however, organizations must take all reasonable steps to protect that information from unauthorized uses and disclosures when it is in the hands of third party processors. This is where accountability, the first principle in PIPEDA, comes in; and there are obligations to meet regarding training staff that are highly relevant.
You may be wondering, what exactly is “safeguarding” personal information? Thankfully, the Office of the Privacy Commissioner of Canada has clarified how safeguarding can reduce the risk of privacy breaches.
A recent online article reported that two seventeen-year-old employees were fired from a Kansas City pizza joint for talking about their pay rates. Both were new employees with the same experience, and the female employee discovered she was earning $0.25/hour less than her male co-worker. When she contacted her employer for an explanation, she was fired for discussing wages with a co-worker, as was the male co-worker. The employer advised that discussing pay was against employer policy, even though both employees stated that such policy was never disclosed to them.