Brussels, 14/01/2002 (Agence Europe) - The European commission has just recognised that the Canada Personal Information Protection and Electronic Documents Act provides adequate protection for certain personal data transferred from the EU to Canada. This decision illustrates the commitment made by Canada in 1999 and the EU to work together in building confidence in cross-border electronic commerce and to ensure the free flow of personal data on the basis of high data protection standards.
The decision was taken on the basis that the Canadian law is in keeping with the Directive ensuring that personal data can only be transferred to a third country that provides "an adequate level of protection". Similar decisions have been taken on a data protection system in Switzerland and Hungary concerning the "safe harbor" arrangement in the United States.
The Canadian Act entered into force on 1 January 2001. It applies to personal information about clients and employees that federally regulated organisations (such as airlines, railways, shipping, inter-provincial trucking, banking, televisions, radio, telephone and telegraph) collect, use and disclose in the course of a commercial activity. The law also applies to all organisations that disclose personal information for consideration outside a province or outside Canada. From January 2002, the Act will apply to health information held by organisations mentioned above. As from 1 January 2004, the Act will cover every organisation that collects, uses or communicates personal information in the course of a personal activity, whether or not the organisation is federally regulated. The Canadian Act and the Commission Decision do not cover personal data held by public bodies, either at federal and provincial level, or personal data held by private organisations and used for non-commercial purposes, such as data handled by charities or collected in the context of an employment relationship. For these transfers to recipients in Canada, operators in the EU will have to put in place additional safeguards, such as the standard contractual clauses adopted by the Commission in June 2001, before exporting the data. For further information: http: //europa.eu.int/comm/privacy.