There’s lots of international privacy news this week because the decision was released in the famous “Schrems II” case. Just like the first “Schrems” case, the primary issue was whether the treaty in place between the United States and EU, designed to allow for cross-border flow of personal information, was adequate under European laws.
The decision released Thursday is very similar to the one released a few years ago in the first “Schrems” case. The result: The treaty — known as EU-U.S. Privacy Shield — has been deemed an inadequate mechanism on which you can rely to move personal information from the EU to U.S.
Throughout the entire judgment, you can discern a few things about the adequacy regime that might be applicable to Canada. Of course, Canada currently has partial adequacy because of the Personal Information Protection and Electronics Document Act, but that partial adequacy was reluctantly declared almost 20 years ago now. No doubt, if and when the Europeans revisit their examination of Canada’s privacy regime, some of the same issues raised in the “Schrems II” decision will have to be tackled.
On a side note, we had Max Schrems present at the IAPP Canada Symposium, and it was great for the crowd to hear more about his perspective and activities. Things that happen elsewhere do have an impact in Canada.
Anyway, all this to say, with Quebec once again leading the way with the introduction of its own modern privacy legislation a couple of weeks ago, it just seems inevitable the federal government will follow suit and introduce a comprehensive upgrade to the privacy regime for the rest of the country.
If the EU has no qualms about shutting down the flow of data to the U.S., I don’t think they will miss a beat when concluding similarly to Canada’s regime. I just hope it doesn’t come to this and the federal government prioritizes this sooner rather than later. There are some super smart people pursuing these ideas, whether they’re at Innovation, Science, Economic Development Canada, Justice or the Office of the Privacy Commissioner. Now let’s ensure we also have real political will.