SPECIAL ISSUES IN CANADIAN IT OUTSOURCING BY C. IAN KYER AND JOHN BEARDWOOD

Transcription

1 SPECIAL ISSUES IN CANADIAN IT OUTSOURCING BY C. IAN KYER AND JOHN BEARDWOOD INTRODUCTION For an American service provider, doing an outsourcing in Canada is like a fan of the National League Chicago Cubs watching the American League White Sox play. The Cubs fan can tell the Sox are playing the same game but the rules are just a bit different. In this brief article we shall point some of the material ways that a Canadian outsourcing differs from a U.S. deal. Most IT outsourcing transactions have two distinct aspects. There is an initial acquisition by the service provider of all or part of the IT assets of the customer, and subsequent to such acquisition a long-term service contract where the supplier provides services that the customer formerly provided internally. Each aspect of the transaction is affected by differences in Canadian law. REGULATORY PATCHWORK Part of the problem that U.S. service providers will face is determining what laws are applicable to their transaction. Canada is a federal state. Governmental power is divided between its ten provinces and the federal government. The federal and provincial governments are each supreme within their own fields of legislative competence. Canada also has two founding cultures and two official languages. Much of Canada was originally a French colony and the province of Quebec remains predominantly Frenchspeaking. Quebec's legal system is based on the civil law, in contrast to the other provinces which have an English Common Law system. Both levels of government have enacted laws and regulations that impact on outsourcing deals. This means that there may be many answers to any legal question in Canada depending on such factors as the nature of the activity in question, where the transaction is taking place, what the parties have chosen as the law of the contract etc. For example, labour laws are provincial but if the employees in question are employed by a federally regulated institution like an airline, federal labour laws apply. OSFI GUIDELINE FOR OUTSOURCING While many laws may apply to an outsourcing transaction, perhaps our starting point ought to be the federal regulations that apply specifically to outsourcing. The Office of the Superintendent of Financial Institutions (OFSI) 1 has issued a Guideline for Outsourcing of Business Functions for federally regulated financial institutions (FRFI s) like banks and insurance companies. The Guideline requires the development of a risk-management program for outsourcing activities that: 1) establishes an outsourcing risk philosophy; 2) identifies material outsourcing risks, existing or potential; 3) establishes sound and prudent policies governing the risks which arise from outsourcing business functions; and 4) monitors and controls associated risks. Further, the Guideline requires the FRFI to ensure that OFSI has the ability to audit and that where the data is to be stored outside Canada that appropriate regulatory consents are obtained. Although prepared for FRFI s, the Guideline is regarded as generally instructive for any organization that is considering outsourcing. It is therefore useful for any service provider to be knowledgeable about the guidelines. In addition, service providers specifically seeking to provide outsourcing services to an FRFI 1 OSFI supervises and regulates all banks, and all federally incorporated or registered trust and loan companies, insurance companies, cooperative credit associations, and fraternal benefit societies and pension plans. OFSI draws its authority to regulate from the Office of the Superintendent of Financial Institutions Act.

2 - 2 - need to be aware of the specific requirements of the Guideline, as the FRFI in question will require the outsourcing service contract to reflect these requirements. DATA MANAGEMENT AND PRIVACY ISSUES A. The Canadian Privacy Patchwork One disadvantage of Canadian federalism has been the development, at times, of conflicting federal and provincial regulatory regimes. In recent times, organizations such as the Uniform Law Commission have recognized the value of legislative harmonization and have made significant progress in ensuring that new legislation is relatively uniform. Unfortunately, the new legal regime for the protection of personal information is not one of those harmonized frameworks; rather, the Canadian privacy regime is a patchwork of varying federal and privacy legislation across the country, thus increasing costs for organizations seeking to comply with the legislation. Again, which privacy legislation will apply to the customer or service provider will depend on a number of factors, including the nature of the personal information (for example, personal health information or other personal information), the jurisdictions in which the collection, use or disclosure of the personal information takes place, and the nature of the customer. In brief, the patchwork is composed of the following elements, some of which will have overlapping jurisdiction: 1. federal and provincial public sector privacy legislation; 2. the federal private sector privacy legislation, the Personal Information Protection and Electronic Documents Act ( PIPEDA ), which will apply in those provinces without their own private sector privacy legislation, as well as to cross-border exchanges of personal information and to federally regulated organizations; 3. the provincial private sector privacy legislation, which consists of privacy legislation in British Columbia (the Personal Information Protection Act (the B.C. PIPA )), Alberta (also entitled the Personal Information Protection Act) and Quebec; 4. provincial personal health information legislation, in various provinces (for example, the new Personal Health Information Protection Act in Ontario); and 5. some older provincial statutes which make breach of privacy an actionable tort. In contrast with notice-based models with which U.S. practitioners will be more familiar, the private sector legislation requires that the consent of an individual be obtained prior to any collection, use or disclosure of their personal information. The common theme of almost all the privacy legislation is that organizations which outsource a particular function to a service provider continue to remain responsible for that information. As a result, outsourcing service providers to organizations in Canada should expect that such organizations will use contractual means to ensure that such service providers do not use the personal information for any purposes unrelated to the provision of the outsourcing services; adopt appropriate means of security to protect such information; be prepared to have their privacy practices audited by the organization; and in the circumstance where there is a privacy incident caused by the service provider, indemnify the organization.

3 - 3 - While privacy legislation is not new for U.S. practitioners, the different privacy laws in each province and federally complicate the Canadian context. Further, foreign practitioners should be aware that the privacy laws apply to personal information of non-residents and to non-canadian organizations collecting personal information in Canada. It is incumbent on non-canadian counsel to be aware of how Canadian privacy legislation is likely to affect the business of their clients, whether customers or service providers. B. The Patriot Act and Restrictions on Outsourcing to U.S. linked Service Providers: New British Columbia Laws are Only the Beginning 1. New Restrictions on British Columbia Public Sector Entities Outsourcing to U.S.-Linked Service Providers From little acorns grow big trees In February 2004, in response to the proposed outsourcing by the British Columbia Ministry of Health Services of the provincial public health insurance program to a subsidiary of a U.S. company, the British Columbia Government & Services Employees Union (the BCGEU ) commenced legal proceedings to enjoin the Ministry from retaining this U.S. linked service provider. Specifically, the BCGEU sought a declaration that the proposed contracting out of services was ultra vires, alleging that U.S. authorities could use the USA Patriot Act (the Patriot Act ) to require the service provider to disclose the personal information being held and used by the service provider in connection with providing the outsourced services, in circumstances that would constitute a violation of British Columbia s public sector privacy legislation, the Freedom of Information and Protection of Privacy Act ( FOIPPA ). In brief, the provisions that were the source of concern in British Columbia were those provisions which had the effect of reducing the threshold tests for U.S. authorities to obtain secret orders and issue national security letters compelling entities to both disclose information, including personal information, and keep the fact of such disclosure secret. In response to the BCGEU proceedings, the British Columbia Office of the Information and Privacy Commissioner, which administers and enforces both FOIPPA and the B.C. PIPA, initiated a high profile public consultation as to the ramifications of the Patriot Act on the privacy of personal information of British Columbia residents in the custody or control of public sector organizations. The consultation culminated in the release of a report by the Information and Privacy Commissioner (the Report ) 2 which (a) concluded that any personal information of British Columbia residents held by U.S. linked companies was vulnerable to disclosure under U.S. laws - and in particular the Patriot Act - in that such information held in the U.S. was subject to disclosure, and there was a reasonable possibility that an order could be issued requiring a US located corporation to produce personal information held in Canada by its Canadian subsidiary; and (b) contained a number of recommendations to address this concern. These recommendations ranged from being very aggressive (for example, that FOIPPA be amended to prohibit personal information in the custody or control of a public body from being temporarily or permanently sent outside Canada for management, storage, or safekeeping or from otherwise being accessed from outside Canada, pending the implementation of nation-to-nation agreement on the issue) to being common sense recommendations (for example, that public bodies implement compliance audits, the cost of which would be paid by the service provider were it to be found in material non-compliance) (see OSFI Guidelines above for similar requirements). 2 Privacy and the USA Patriot Act: Implications for British Columbia Public Sector Outsourcing (October 2004); see public/usa patriot act/patriot act.htm

4 - 4 - However, just days before the release of the Report, British Columbia enacted Bill 73, which amended FOIPPA to address the concerns raised during the consultation. For U.S. linked service providers seeking to provide services to British Columbia public sector entities, the most significant amendments were as follows: Service Providers now directly governed by FOIPPA: Service providers to public sector entities are now directly governed by FOIPPA, which effectively makes the public sector entity and the service provider jointly responsible for FOIPPA compliance. In addition, employees and associates of the service providers, as well as of the public sector entities, may now be held personally liable for contraventions of FOIPPA. Finally, the Commissioner may now issue binding orders directly against service providers. Storage only in Canada: In a compromise position to that taken by the Commissioner in the Report, public sector entities are now required to ensure that personal information in its custody or control is stored, and accessed, only in Canada, unless (a) the individual the information is about has identified the information and has consented, in the prescribed manner, to it being stored in or accessed from another jurisdiction, or (b) if it is stored in or accessed by another jurisdiction for the purpose of disclosure allowed under FOIPPA; Reporting of all Foreign Demands for Disclosure: Public bodies and their service providers are now required to report to the Minister responsible for FOIPPA all actual or suspected foreign demands for disclosure (defined as a foreign subpoena, warrant, order, demand or request from a foreign authority, for disclosure not otherwise authorized by FOIPPA); and Prohibition of Disclosure in response to Foreign Demands for Disclosure: Public bodies and their service providers are now required to refuse to comply with foreign demands for disclosure. The net effect of these provisions is to present U.S. linked service providers with two challenges. First, it may be very difficult and expensive to structure outsourcing arrangements to ensure that all personal information to which FOIPPA applies is stored in, and accessed only from, Canada. Second, and more significantly, service providers which are subject to a U.S. secret order or its equivalent will now find themselves in the somewhat untenable position of having to choose between complying with Canadian law (i.e. don t disclose, notify the Minister) and U.S. law (i.e. disclose, don t notify anyone). Finally, the overlapping jurisdiction caused by the interaction of the amended FOIPPA with existing private sector privacy laws (in British Columbia, primarily the B.C. PIPA but in some circumstances also PIPEDA) will result in private sector service providers having to comply with two, and possibly three pieces of privacy legislation, to the extent such providers are providing services to both public and private sector entities. 2. Pending Restrictions on Federal Public Sector Entities Outsourcing to Foreign Service Providers It appears that these British Columbia restrictions on the public sector outsourcing of personal information-related functions to foreign service providers may be the thin edge of the wedge. In the same month the Report was released and Bill 73 was enacted 3, the federal Treasury Board of Canada Secretariat ( TBS ) requested that the Access to Information and Privacy Co-ordinators for various federal institutions conduct a comprehensive audit of the outsourcing activities of such institutions to the extent that they involved the handling of personal information of Canadians and other sensitive data, in order to identify, assess and, if appropriate, mitigate any possible risks related to the Patriot Act. 4 Concurrently with this initiative, TBS is leading a working group that is finalizing contracting clauses 3 October Treasury Board of Canada Secretariat Information Notice, No (January 24, 2005).

5 - 5 - regarding the Patriot Act, to be used in future RFP s and contracts. In their January 2005 Information Notice on same, TBS estimated that the new clauses would be made available in February As of time of writing, such clauses had not been issue. 3. Future Restrictions on Private Sector Entities Outsourcing to Foreign Service Providers? There are indications that these restrictions on public sector outsourcing to foreign service providers may in the future be applied to private sector entities seeking to outsource. Not surprisingly perhaps, in his Report the British Columbia Commissioner also recommends that the provincial and federal governments "consider and address" the implications of the USA Patriot Act for the security of personal information in respect of private sector activities. The Privacy Commissioner of Canada, who administers and enforces PIPEDA, has stated on the website for her office that the legislative review of PIPEDA in 2006 will be a forum for developing further privacy protection measures related to transborder information-sharing by the private sector. The Privacy Commissioner gave some indication as to what one of those measures might be in her written submissions made during the British Columbia public consultation, when she stated that, "at the very least," a company in Canada that outsources information processing to organizations based abroad should notify its customers that the information may be available to the foreign government or its agencies under a lawful order made in that country. It is also worthy of note that the federal commissioner has encouraged individuals to file complaints with her office where they are concerned about their personal information being held in databases outside Canada. HUMAN RESOURCES ISSUES A. Employment and Labour An outsourcing will often involve the acquisition of the customer s IT assets. This is similar to the purchase and sale of a division of a company, and often generates significant legal issues with respect to the resulting employee transfers and terminations. Canadian employment law significantly varies from that of the U.S., in that in Canada an employment relationship may only legally be terminated without employee compensation if there is cause, which requires incompetence, insubordination, conflict of interest, conduct incompatible with faithful discharge of duties and other judicially recognized offences that warrant discharge. For termination without cause, employers in all jurisdictions are required to provide advance notice of termination or layoff, or to offer pay in lieu of notice. The applicable employment standards legislation mandates the minimum notice period that provides a sliding scale of notice depending on the seniority of the employee, and typically peaks at eight weeks notice. These termination notice periods are simply the statutory minimum periods of notice required. In addition to the minimums set by statute, the common law reasonable notice has been developed by Canadian courts. They determine how much notice an employee is entitled to receive by applying a variety of factors to determine what is reasonable notice of termination in the circumstances. Although the courts have recently ceased to use a rule of thumb approach in determining the reasonable period of notice to which an employee is entitled, judicial awards are in the range of one month per year of service to a typical maximum of 24 months, with a few exceptions. The courts will increase the notice period owed to employees where their employment has been terminated in bad faith. Even if all of the employees are maintained, there are labour law concerns. If the individuals are employed by the U.S. service provider but are residents in Canada, the U.S. service provider will have to register to carry on business in Canada with the Canada Revenue Agency ( CRA ) and, among other

6 - 6 - things, obtain a payroll account number. In either case, the employer will be responsible for complying with all applicable Canadian labour laws, including compliance with the Employment Standards Act (Ontario), the Occupational Health and Safety Act (Ontario), the Ontario Human Rights Code (Ontario) and the Workplace Safety and Insurance Act (Ontario) if the employees are working in Ontario or comparable legislation in such other provinces and territories as the employees are working. B. Pensions As Justice Deschamps wrote in Monsanto Canada Inc., et al. v. Superintendent of Financial Services (Ont.): "Pension law is a field which is gaining in importance as more and more people retire and look to their pensions to sustain them during their "golden years". The complex exercise of actuarial accounting that determines how pensions should be funded is rivalled only by the complexity of the law determining the pension rights and obligations of employees and employers, which often meets at the intersection of contracts, trust law, and statute law. Many larger employers provide company pension plans, which may be partially funded by employee contributions. Private pension plans are not mandatory, but they must be funded according to provincial and federal regulations if they are offered. These regulations treat pensions as deferred compensation, and are designed to ensure that adequate funds will be available to pay the pension obligations in the future. They also provide for the mandatory vesting of employer contributions after certain minimum periods of employment, normally two years. In addition, pension benefits have been extended to include part-time workers in addition to full-time workers. The U.S. service provider will likely have to determine how best to deal with the pension rights of the Canadian customer s employees affected by the outsourcing. This can be and often is a complex and potentially expensive aspect of the transaction. C. Immigration There may be a requirement for any U.S. employee of the U.S. service provider to obtain a work permit in order to work in Canada. The determination of whether a foreign person requires a work permit or whether he or she can enter into Canada as a business visitor is very fact specific. The actual determination turns less on the amount of time the person is expected to be in Canada and more on the person s function while here. If the person is simply attending meetings while in Canada he or she may be classified as a business visitor. If the person is actually carrying out a business function, a work permit may be required. D. Moral rights Often an IT outsourcing involves the transfer of intellectual property, such as computer software. It is important to recognize that separate and apart from any interest in the copyright of such a work, under Canadian law each individual author of the computer programme or the database (even if an employee) has the right to claim authorship and to prevent any distortion or mutilation of the work or its association with products that would prejudice his or her reputation. These moral rights may be expressly waived in whole or in part by the author. Such a waiver is distinct from the assignment of copyright in the work and an assignment of copyright in the work does not itself constitute a waiver of any moral rights. Any business that is acquiring software or databases in Canada should consider requiring all programmers to waive the moral rights in the software they developed.

7 - 7 - OTHER ISSUES A. Tax Canada has a comprehensive tax treaty with the U.S. that follows the OECD Model Convention for the Avoidance of Double Taxation. This treaty reduces the rates of withholding taxes applicable to various types of income, and contain other provisions that impact on the tax treatment of non-residents Canadian-source income. Generally a U.S. corporation is liable to pay income tax in Canada only if it has a permanent establishment in Canada. It is important, however, to recognize that the outsourcing operations of the U.S. service provider may constitute such a permanent establishment. B. Quebec While a comprehensive examination of the Quebec legislation is beyond the scope of this article, service providers seeking to provide outsourcing services in Quebec should be aware that Quebec is a civil code jurisdiction, and as a result the variations in the law in Quebec often go beyond the normal variations of law between the provinces. This is particularly the case with respect to language laws, tax, and labour laws. CONCLUSION We noted that most IT outsourcing transactions have two distinct aspects: the initial acquisition by the service provider of certain assets of the customer, and subsequent to such acquisition a long-term service contract. We have briefly highlighted a few Canadian issues such as the impact of the OSFI Guidelines and privacy legislation on the service contract; how employment and labour issues and pension issues will affect the acquisition; and how immigration, moral rights, tax and Quebec issues will more generally affect the transaction. Needless to say this brief review does not do justice to the complexities of Canadian law. In conclusion, and to draw upon our earlier analogy, U.S. service providers should recognize that if they want to engage in outsourcing in Canada, they will need to become familiar with the specific rules of the game.