Employee Data Privacy

Are there any restrictions on transferring personal data and how can these be overcome?

Cross-border data transfers affect all organizations that engage online IT services, cloud-based services, remote access services and global HR databases. Understanding the applications of lawful data transfer mechanisms is essential to validate recipients located in other nations.

Under the Personal Information Protection Act (PIPA), employers are not required to obtain the consent of employees when outsourcing the processing of personal information. Similarly, consent is not required if the processing of personal information is outsourced to a foreign entity, but employers must include information on the specific tasks to be outsourced and the name(s) of the outsourced processor(s) in their privacy policy, so that such information is readily available to employees. Additionally, the outsourced processor must comply with specific obligations set out in the PIPA.

For employers that transfer personal information to a foreign entity for the benefit and use of such entity, obtaining consent is the only approved method to transfer personal data overseas, even in cases where consent would not otherwise be required. When obtaining employee consent, inform employees of:

• who will receive the personal information;
• the reason the third party will receive the information and how it will be used;
• the details of the information that will be shared with the third-party;
• the period the data will be retained and used; and,
• the fact that the individual can deny consent, as well as the potential disadvantages that will result if the individual rejects consent.