According to the federal Privacy Commissioner, what protection is missing from the Privacy Act regarding outsourcing of government work that contains personal information?
A.
A statement preventing the vendor to whom the information is outsourced to subcontract its processing.
B.
A statement granting the Privacy Commissioner the right to issue orders following an investigation into a possible data breach.
C.
A statement requiring the government agency to complete a Privacy Impact Assessment (PIA) prior to outsourcing to a third party.
D.
A statement indicating that the government institution from which the information is outsourced remains accountable for its security.
The Privacy Act governs how federal government institutions handle personal information. The Privacy Commissioner of Canada has highlighted limitations within the Act regarding outsourcing, specifically:
Lack of Explicit Accountability: While the Privacy Act implies the government institution remains responsible for the personal information, the Commissioner argues that the law needs a clearer, more explicit statement to ensure full accountability when it's outsourced.
Outsourcing & Privacy Risks: Outsourcing government functions to third parties can add complexity and risk to the protection of personal information.
References:
You can find discussions of the Privacy Commissioner's position on outsourcing in reports and resources on the Office of the Privacy Commissioner of Canada (OPC) website: https://priv.gc.ca/en/
Why Other Options Are Less Relevant
A. Preventing subcontracting: While controlling further subcontracting might be important, it's not the primary concern identified by the Commissioner.
B. Commissioner's order power: While the Commissioner advocates for greater powers, this is not the specific gap in the Privacy Act related to outsourcing.
C. Privacy Impact Assessments (PIAs): PIAs are crucial, but the Commissioner's argument highlights that even with PIAs, the Act lacks clear accountability language when the information leaves the government institution.
Key Points
The Privacy Commissioner plays an advocacy role, identifying areas where privacy legislation could be strengthened.
Accountability is crucial in all privacy contexts, especially when third parties handle sensitive data.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit