SUBMISSION TO THE SPECIAL COMMITTEE TO REVIEW TRANSBORDER DATA FLOWS AND THEIR REGULATION THE FREEDOM OF INFORMATION AND PROTECTION OF PRIVACY ACT

Transcription

1 SUBMISSION TO THE SPECIAL COMMITTEE TO REVIEW THE FREEDOM OF INFORMATION AND PROTECTION OF PRIVACY ACT TRANSBORDER DATA FLOWS AND THEIR REGULATION Authored by Kris Klein from the Law Office of Kris Klein, a professional corporation

2 - 2 - A critical question for regulators, lawmakers, policymakers, and scholars is how to maintain information privacy law at a high level that responds in a meaningful fashion to the challenges and opportunities of global networked data flows. 1 British Columbia s Freedom to Information and Protection of Privacy Act (BC FIPPA) is one of only two laws in Canada that prohibit the flow of personal information across Canadian borders. Every other law (excluding the public sector law in Nova Scotia) permits transborder flows of personal information outside Canada for processing purposes if certain conditions are met. This is true of both the public sector and private sector legislation governing the management of personal information. 2 While BC FIPPA s law has the well-intentioned goal of protecting the personal information of citizens held by public bodies, the law s prohibition on transborder flows has been described as being seriously flawed and has having contributed to misfocusing the growing debate over privacy issues in multinational information flows. 3 The prohibition was created based on a perception of risk that the personal information of British Columbians would be accessed by foreign officials if the information was allowed to be stored or accessed from outside the country. As elaborated below, that risk has proven to be misguided. Moreover that particular risk analysis inappropriately ignored the risks of NOT permitting transborder data flows. Risks such as those created by higher costs, loss of innovation, lower productivity, lack of adoption, and limited scalability are much more detrimental than the risk of foreign authorities accessing personal information. We submit that the prohibition should be amended for the following reasons. First Reason: British Columbia public sector agencies are missing out on innovation and efficiencies afforded by modern outsourcing arrangements because the prohibition is not consistent with the modern economy. It is beyond doubt that we are in the information age. Data, including personal information, is not a static item that is stored on a piece of paper. Rather, the value derived from data depends on its fluid nature. It must be accessed and used readily by those authorized to do so. To build dams and artificial constraints that limit data s fluidity necessarily reduces the value of that data. The value of data for public bodies is as important as in the private sector. So, the prohibition and restriction on data flow currently used in British Columbia devalues the personal information under the control of public bodies. Thus, decision making is more difficult and less effective. Moreover, the services being delivered by those public bodies are delivered less efficiently and at a greater cost. 1 Paul M. Schwartz, Managing Global Data Privacy, Privacy-Projects-Paul-Schwartz-Global-Data-Flows pdf. 2 See, Kris Klein, Applying Canadian Privacy Law to Transborder Flows of Personal Information from Canada to the United States: A Clarification, posted by Industry Canada at August Fred Cate, Legal Restrictions on Transborder Data Flows to Prevent Government Access to Personal Data: Lessons from British Columbia, published by The Center for Information Policy and Leadership, August 2005

3 - 3 - Today s modern economy including the provision of services by public bodies places a high premium on the efficient management of information. Cloud computing helps organizations of all sizes and in all sectors achieve that goal. Enterprise cloud computing allows organizations to develop and run software applications over the Internet. Customers pay a monthly subscription fee and access their applications with a Web browser. Because customers do not have to invest in information technology, infrastructure or buy software licenses, they benefit from low up-front costs and a rapid return on investment. Because enterprise cloud computing is based on a multi-tenant architecture, customers benefit from rapid deployment, easy customization, flexible use, and Internet scale solutions. And because enterprise cloud computing offers a multi-layered approach to the protection of customer data that includes compliance with international security standards like ISO 27001, customers also benefit from robust security. This reality is reflected in almost all privacy legislation and privacy frameworks around the world. While some jurisdictions, such as Europe, have used more restrictions then others when it comes to allowing the flow of information, few laws have been as restrictive as the prohibition imposed by the law in British Columbia. Second Reason: British Columbia public sector organizations unnecessarily spend significant sums of money to keep data inside of Canada. There are enormous opportunity costs for requiring public bodies to build and maintain data centers within Canada. Moreover, when entering into outsourcing arrangements, the prohibition raises difficulties and complexities that add unnecessary costs to the deals themselves. If an outsourcing arrangement is ultimately reached, it will have required additional time, money and resources. Or, in some instances, the prohibition leads to the outright inability to enter into a legitimate outsourcing arrangement thus rendering the time and investment in exploring the arrangement meaningless. In such negotiations, the British Columbia public sector agency bears much of these costs. For example, in one instance, the parties had to incur several thousands of dollars in obtaining legal opinions for fear that the prohibition was in effect for the particular transaction at issue. We are aware of many public bodies that are interested in using outsourcing solutions that involve transborder data flow. Their interest is predominantly driven by the costs to be saved and efficiencies to be gained. Because such arrangements involve transferring personal information outside of Canada, however, these public bodies are forced to forego the best solutions available. One of several examples is a contract with the Ministry of Children and Family Development for an Integrated Case Management Project. In that instance, the Ministry issued a Notice of Intent to renew a contract at a cost of nearly $24 million. Had the prohibition on transborder data flows not been in place, a solution could have been procured for less than half the cost. That s approximately $12 million dollars from British Columbia s taxpayers that was wasted. Lastly, it is noteworthy that this prohibition has a trickle-down effect on the private sector that is caused by the confusion and fear created by the prohibition for public bodies. Because many private sector organizations serve the public sector, they are concerned that the prohibition may apply to them as well. While impossible to quantify exactly, it is safe to say that this prohibition is causing the British Columbia taxpayers to waste significant financial resources.

4 - 4 - Third Reason: The protection the prohibition affords is illusory. First, the fear of having the personal information of Canadians accessed by foreign officials is unfounded because foreign officials have always been able to gain access to the personal information of Canadians. Considering that the impetus for the prohibition was fear the American authorities would abuse the powers granted to them in the Patriot Act, it is worth noting that this power has been used a total of 87 times through to the end of That s an average of only 12 instances per year. It is unknown whether any of those instances involved accessing the information of Canadians, let along anyone from the province of British Columbia. Relevant to this consideration is the fact that the United States has a Mutual Legal Assistance Treaty ( MLAT ) with Canada. The powers granted to American authorities under the Patriot Act are much more likely to be used to access personal information of individuals from countries for which there is no such treaty. This is because the Americans have negotiated a treaty with Canada and they have not rescinded their obligations under that treaty with the passing of the Patriot Act. The second component is that many data centers outside of Canada offer better security than those that have to be built simply to house public sector data within British Columbia. Building data centers that offer the equivalent amount of protection from hackers and other types of data breaches as those located outside of Canada involve tremendous costs. Even then, the security level may not be same. Fourth Reason Although BC FIPPA applies only to data held by public bodies in British Columbia, the confusion created by the prohibition has caused a negative impact across the Canadian economy. Many organizations and public bodies in Canada are under the mistaken impression that the prohibition is widely applicable across the country. In other words, there is a mistaken belief that no one is permitted to move data outside of Canada. As a result, many large and small enterprises and public bodies in Canada are reluctant to take advantage of the innovation, cost-efficiency, security and productivity that enterprise cloud computing enables. This mistaken interpretation of the BC FIPPA has already had a negative impact on the competitiveness of numerous Canadian organizations that are not located in British Columbia. If allowed to persist, it could further undermine the competitiveness of Canadian industry as we move into the 21 st century. What does Salesforce.com do and what is Cloud computing Salesforce.com provides an Internet-based business application (also known as software-as-a-service or enterprise cloud computing ) that allows public bodies to input, store, and access data about the people they serve. Salesforce.com s services provide comprehensive customer relationship management ( CRM ) functionality that include sales force automation, customer support and help desk, and marketing automation features in addition to an on-demand technology platform that enables the public bodies to build and use entirely new on-demand applications without having to invest in new software, hardware, or related infrastructure.

5 - 5 - Salesforce.com delivers its services over the Internet through commercially-available Web connections and browser software. Customers log into salesforce.com s services from salesforce.com s Web site using a unique username and password. Salesforce.com s services allow for additional authentication methods that may be activated by public bodies. Salesforce.com serves public bodies through secure hardware and software, using what is known in the industry as multi-tenant application architecture. A multitenant application is one that can be accessed and used by many authorized users simultaneously, with logical separation of data in hardware and software. The logical separation of data allows each salesforce.com customer to view only its instance of salesforce.com s services and associated data. Salesforce.com s multi-tenant architecture is similar to that used to provide online banking and brokerage services to consumers (which can also be accessed and used securely by thousands of users simultaneously through the logical not physical separation of data). Over 70,000 enterprises globally including public bodies in Canada, and customers in highly regulated industries such as financial services, healthcare, insurance, media, and communications trust salesforce.com to host the personal information under their control in its secure data centers. Conclusion It is time for British Columbia to adopt a more flexible model for the protection of personal information held by public bodies -- a model that takes into account a more accurate analysis of the risk associated with permitting transborder data flow AND the risk associated with NOT permitting it. Such an analysis will take into account the effect on cost, innovation, productivity, adaptability, and scalability. Once realized, this model will allow the personal information under its care and control to be more secure and more valuable thus resulting in more efficient service delivery and better (and more timely) decision making. Other jurisdictions are adopting the model used in the rest of Canada. That model rests on the principle of accountability and transparency. It requires public bodies and organizations to be clear about where information is stored and it demands that public bodies and organizations remain accountable for the information regardless of what jurisdiction it finds itself in. This is done by using appropriate contractual clauses with outsourcers and by being reasonable in terms of ensuring the necessary control can be exerted over the personal information under its care. Salesforce.com will make representatives available to the Committee should there be any desire to meet with us while the legislative review process unfolds.