Memorandum of Understanding with Alberta, British Columbia and Quebec

Memorandum of Understanding

Between
The Office of the Privacy Commissioner of Canada,
The Office of the Information and Privacy Commissioner of Alberta,
The Office of the Information and Privacy Commissioner for British Columbia and
The Commission d’accès à l’information of Quebec

WITH RESPECT TO
Co-operation and Collaboration in Private Sector Privacy Policy, Implementation of Applicable Legislation, Enforcement and Public Education

As the offices of the Privacy Commissioner of Canada, the Information and Privacy Commissioner of Alberta, the Information and Privacy Commissioner for British Columbia and the Commission d’accès à l’information of Quebec (the “Offices”) have oversight responsibilities for our respective private sector privacy laws within our jurisdictions;

As there are circumstances where the Offices have concurrent or overlapping jurisdiction;

As the Personal Information Protection and Electronic Documents Act, S.C.2000, c.5, s.23, the Personal Information Protection Act, S.A. 2003, c. P-6.5, the Personal Information Protection Act, S.B.C. 2003, c. 63 and the Act respecting the protection of personal information in the private sector, CQLR, chapter P-39.1 provide for consultation and collaboration;

As there are interests and benefits resulting from cooperation and collaboration in policy, for the implementation of applicable legislation, enforcement, public education, and compliance regarding the protection of personal information in the private sector, both within the oversight offices and to organizations, and individuals in Canada;

GIVEN the responsibilities and mandates of the named parties,

THE PARTIES AGREE TO THE FOLLOWING:

1. OBJECTIVE OF THE MEMORANDUM OF UNDERSTANDING

1.1 Objective of the Memorandum of Understanding

The objective of this Memorandum of Understanding is to set out a framework to support federal/provincial collaboration and coordination in order to:

• Leverage the resources of the Offices to maximize capacity and impact in oversight activities, while at the same time reduce the duplication of efforts and inefficiencies.
• Increase knowledge sharing and enhance relationships between the Offices in order to ensure consistent, coordinated, efficient and harmonized oversight of private sector privacy in Canada.
• Carry out joint instructions of the Privacy Commissioners.

2. APPROACH

2.1 This Memorandum of Understanding includes the following areas:

• Enforcement: The Offices will consult to identify enforcement matters that are of mutual interest and determine how to respond in a coordinated and harmonized manner (as permitted by their respective legislation).
• Policy :The Offices will consult to identify common principles and areas of mutual policy interest, and to develop and implement strategies to achieve policy goals and objectives. In particular, the Offices will focus on emerging privacy issues to ensure a proactive, coordinated and consistent policy position and response whenever possible.
• Public Education and Compliance Resources: The Offices will consult on the development of public education initiatives, and collaborate when it is mutually beneficial and of interest to do so. The Offices will, whenever possible and as resources and laws allow, collaborate when issuing compliance guidelines to enhance harmonization and consistency in private sector privacy compliance.
• Foster the sharing of general information: The Offices will share information on matters of mutual interest to collectively increase the Offices’ knowledge and understanding of private sector privacy matters.

2.2 Role of Private Sector Privacy Forum

The primary vehicles for achieving the objectives set out in this Memorandum of Understanding will be the Private Sector Privacy (PSP) Forum and the Domestic Enforcement Collaboration Forum (DECF).

PSP Forum

• Activities of the PSP Forum will include, but are not necessarily limited to:
  • Developing protocols to address the coordination of information-sharing.
  • Identifying opportunities for collaborative policy and public education. The Offices commit to advising and updating each other with regard to all such proposed and ongoing initiatives and will consult to prevent duplication or inconsistencies.
  • Identifying opportunities for collaboration and knowledge sharing with regard to internal protocols, including the development of templates, reporting formats and case management systems.
  • Consulting on issues of jurisdiction between Offices, and with respect to other dispute resolution forums.
  • Coordinating and participating in staff exchanges.
  • Jointly sponsoring, supporting and participating in conferences and training activities.

Each Office will name one or more representatives to participate in the PSP Forum. The representatives will include senior staff responsible for investigations, policy, public education and compliance.

Membership in the Forum may be delegated. Attendance at bi-monthly meetings is open to other staff involved in privacy sector privacy oversight.

At a minimum, PSP Forum members will include the following people:

• Director, PIPEDA Compliance Directorate, Office of the Privacy Commissioner of Canada;
• Executive Director of Policy, Research and Parliamentary Affairs, Office of the Privacy Commissioner of Canada;
• Assistant Commissioner, Operations and Compliance, Office of the Information and Privacy Commissioner of Alberta;
• Assistant Commissioner, Strategic Initiatives and Knowledge Management, Office of the Information and Privacy Commissioner of Alberta;
• Manager, Special Project and Investigations, Office of the Information and Privacy Commissioner of Alberta;
• Deputy Commissioner, Investigations, Case Review, and Lobbyist Registry, Office of the Information and Privacy Commissioner for British Columbia;
• Deputy Commissioner, Policy, Adjudication, and Audit, Office of the Information and Privacy Commissioner for British Columbia; and
• Director, Oversight, Senior Analyst-Investigator, Notice and Compliance, and the Senior Analyst-Investigator, Administrative and Criminal Investigations for the Commission d’accès à l’information of Quebec.

PSP Forum meetings will be held on a quarterly basis via teleconference, and, if possible, in person at least once a year in conjunction with a meeting of the Privacy Commissioners. Participants may speak in French or English.

The PSP Forum is chaired by one of the members appointed by agreement among the membership. The Chair will rotate on a bi-annual basis. The Chair is responsible for:

• Setting the agenda for regular meetings. Agendas should reflect the sharing of policy and public education initiatives of interest, research, compliance guidance materials, and significant investigations.
• Co-ordinating in-person meetings with hosting office.
• Distributing minutes.
• Co-ordinating annual reports of the PSP Forum’s activities to the Commissioners pursuant to section 2.4.

Domestic Enforcement Collaboration Forum

The DECF is the dedicated Enforcement Collaboration platform of the PSP Forum. Activities of the DECF will include, but are not necessarily limited to:

• Determination of jurisdiction, transferring complaints, and ensuring regular information sharing between member offices with respect to ongoing parallel or joint investigations.

Membership and participation in the DECF will include, at a minimum, the following:

• Director(s) and/or Executive Director from the Compliance Sector, Office of the Privacy Commissioner of Canada;
• Assistant Commissioner, Operations and Compliance, Office of the Information and Privacy Commissioner of Alberta;
• Assistant Commissioner, Strategic Initiatives and Knowledge Management, Office of the Information and Privacy Commissioner of Alberta;
• Manager, Special Project and Investigations, Office of the Information and Privacy Commissioner of Alberta;
• Deputy Commissioner, Investigations, Case Review, and Lobbyist Registry, Office of the Information and Privacy Commissioner for British Columbia;
• Deputy Commissioner, Policy, Adjudication, and Audit, Office of the Information and Privacy Commissioner for British Columbia;
• Director of Audit and Systemic Reviews, Office of the Information and Privacy Commissioner for British Columbia; and
• Director, Oversight, Senior Analyst-Investigator, Notice and Compliance, and the Senior Analyst-Investigator, Administrative and Criminal Investigations for the Commission d’accès à l’information of Quebec.

DECF meetings will be held, at minimum, on a quarterly basis.

2.3 Resource requirements

Each Office will fund its own participation in the PSP Forum, including costs associated with participating in in-person meetings. The Office responsible for chairing PSP Forum meetings will be responsible for hosting teleconference meetings. The Office hosting in-person meetings will be responsible for costs related to the meeting facilities, refreshments and other related costs.

Where there may be costs associated with collaborative policy, public education and compliance work, the Offices will, at the start of such initiatives, identify required resources and agree to a plan for resourcing such initiatives.

2.4 Reporting

Matters of interest and/or minutes of each meeting of the PSP Forum will be communicated to the respective Commissioners.

Once per year, the PSP Forum and the DECF will formally report activities to the Commissioners.

2.5 Information sharing, ownership, confidentiality and security

Information, including case specific information containing personal information, may, where necessary, be shared between the Offices for the following purposes:

• To assess jurisdiction and transfer complaints as necessary;
• To evaluate whether or not investigations or complaints relate to the same or similar matters in order to assess whether or not a parallel or joint investigation is appropriate;
• To coordinate parallel or joint investigations;
• To otherwise assist in the conduct of an ongoing or potential investigation of a complaint or, where applicable, audit; and
• To assist the Privacy Commissioners in carrying out their respective functions and duties.

Non-case specific information may also be shared between the Offices for the following purposes:

• To coordinate or participate in staff communications and training activities;
• To develop or discuss policy, internal protocols, public education material, templates or case management systems;
• For any other purpose consistent with the objectives of this memorandum of understanding.

Information shared pursuant to this memorandum will only be used for the purposes for which it was originally shared.

Each Office will treat confidential or personal information received in a confidential manner in accordance with each Office’s obligations. Confidential or personal information will be shared only in accordance with statutory conditions and requirements.

The Office receiving confidential and personal information will not, without the express written consent of the Office that shared the information, further disclose the information unless required by law.

The Office sharing the information will clearly indicate which aspects, if any, of the information being shared are confidential or contain personal information. All reports and documents, draft or otherwise, prepared by an Office remain the property of that Office and when provided to another Office are provided on the understanding that they will be not be disclosed, copied or distributed without permission.

3. ADMINISTRATION

3.1 Execution of the Memorandum

The Privacy Commissioner of Canada, the Information and Privacy Commissioner of Alberta, the Information and Privacy Commissioner for British Columbia, and the Commission d’accès à l’information of Quebec are charged with carrying out this Memorandum of Understanding.

3.2 Duration, amendment and termination

This Memorandum of Understanding supersedes all other Memoranda of Understanding signed between the Offices and will come into force the day it is signed and will remain in force until another memorandum is signed, or it is terminated in accordance with this Memorandum.

The terms and conditions of this Memorandum of Understanding may be amended by mutual agreement in writing. Any of the Offices may withdraw from this Memorandum by giving at least one month’s written notice to the other parties. The Offices may also terminate this Memorandum by mutual consent in writing. All confidentiality or non-disclosure provisions, undertakings and other restrictions in section 2.5 will remain in force after termination of the Memorandum of Understanding or a party withdraws.

3.3 Dispute resolution process

Although disputes are unlikely to occur, there is a potential for disagreement among the parties to this Memorandum of Understanding. Disputes among staff of the respective Offices should first be subject to resolution among the staff. The next level of dispute resolution is between the Commissioners and Assistant Commissioners, as appropriate, or the Chair and Vice-Chairs of the Commission d’accès à l’information.

IN WITNESS WHEREOF, THE FOLLOWING HAVE AFFIXED THEIR SIGNATURES TO THIS MEMORANDUM OF UNDERSTANDING (FOUR COPIES IN ENGLISH AND IN FRENCH, EACH VERSION BEING EQUALLY AUTHENTIC):