Section 33.1 - Disclosure Outside of Canada

Overview

Section 33.1 establishes that a public body may disclose personal information outside Canada. In addition to the rules governing disclosure in Section 33, any disclosures outside of Canada must follow the specific regulations on disclosing sensitive personal information to be stored outside of Canada.  

Section Reference

Section 33.1 of the Freedom of Information and Protection of Privacy Act

33.1  A public body may disclose personal information outside of Canada only if the disclosure is in accordance with the regulations, if any, made by the minister responsible for this Act.

Summary

Section 33.1  establishes that a public body may disclose personal information outside Canada if the disclosure is in accordance with the regulations. This section applies where the personal information is in the custody or control of the public body or a service provider of the public body. 

The Personal Information Disclosure for Storage Outside of Canada Regulation requires public bodies to conduct an assessment of any program, project or system in which sensitive personal information is disclosed to be stored outside of Canada. The Regulation outlines the following two specific exceptions to the assessment requirement:

• any program, project or system in existence at the time that Personal Information Disclosure for Storage Outside Canada Regulation  was enacted ; or
• under section 33(2)(f) of the Act, if the information is made available to the public under an enactment that authorizes or requires the information to be made public.

This assessment happens within the privacy impact assessment (PIA), and follows the directions issued by the minister responsible for the Act.

More information on how and when to conduct a PIA, and to clarify the legislative requirement for PIAs, see the Directions for Completing a PIA.

For specific guidance respecting the supplementary assessment required for sensitive personal information disclosed to be stored outside of Canada, see the Guidance on Disclosures Outside of Canada.  

More information on using cloud services in government is available here.

Procedure

• To understand the requirements for storing sensitive  personal information outside Canada, review the Guidance on Disclosures Outside of Canada.
• Procedures for completing PIAs can be found in the Directions on Completing a PIA and the Guidance for PIAs.

Interpretation

Interpretations are intended to help guide understanding of how a section is applied. Content can include examples of how a section could be applied, as well as other clarifying information.

Interpretation notes will be updated over time for new or amended sections.

Sectional Index of Commissioner's Orders

The Office of the Information and Privacy Commissioner maintains a Sectional Index of Commissioner’s orders organized by the Act’s section numbers.