white_paper_on_data_protection_in_india_171127_final_v2

individual to take action to enforce the law or that binding scheme. 351 Additionally, an entity
is allowed to disclose personal information to an overseas recipient if she consents to such
disclosure, or if such disclosure is pursuant to an order of a court. Disclosure to overseas
recipients is also allowed if the entity reasonably believes that the disclosure of the
information is reasonably necessary for the enforcement related activities conducted by an
enforcement body. 352
Canada
In Canada, PIPEDA does not prohibit the outsourcing of personal information to another
jurisdiction, whether by the private sector or a federal institution. 353 Canada follows an
organisation-to-organisation approach while dealing with the cross-border transfer of
information. Under the PIPEDA, organisations are held accountable for the protection of
personal information transfers under each individual outsourcing arrangement or contract. 354
The Privacy Commissioner investigates complaints and investigates the personal information
handling practices of organisations. 355 Principle 1 Schedule 1 of PIPEDA addresses the
balance between the protection of personal information of individuals and the business
necessity of transferring personal information for various reasons, including the availability
of service providers, efficiency and economy. 356 It places responsibility on an organization
for protecting personal information under its control. Schedule 1 also provides that personal
information may be transferred to third parties for processing, and requires organisations to
use contractual or other means to ―provide a comparable level of protection while the
information is being processed by the third party.‖
Under the Canadian Model, no additional consent needs to be sought 357 for the cross-border
transfer of personal information collected as long as the following conditions are met: (i) the
information is being used for the purpose it was originally collected and to which the subject
already consented; (ii) the entity transferring the information ensures that a comparable level
of protection of the personal information is provided by the receiving entity; and (iii) the
351 OAIC, Chapter 6: APP 6 — Use or disclosure of personal information (February 2014), available at:
https://www.oaic.gov.au/agencies-and-organisations/app-guidelines/chapter-6-app-6-use-or-disclosure-ofpersonal-information,
(last accessed 30 October 2017).
352 APP 8, Privacy Act.
353 Office of the Privacy Commissioner of Canada, ‗Personal Information Transferred Across Borders‘ (1
November 2016), available at: https://www.priv.gc.ca/en/privacy-topics/personal-information-transferredacross-borders/,
(last accessed 30 October 2017).
354 Office of the Privacy Commissioner of Canada, ‗Personal Information Transferred Across Borders‘ (1
November 2016), available at: https://www.priv.gc.ca/en/privacy-topics/personal-information-transferredacross-borders/,
(last accessed 30 October 2017).
355 Office of the Privacy Commissioner of Canada, ‗Personal Information Transferred Across Borders‘ (1
November 2016), available at: https://www.priv.gc.ca/en/privacy-topics/personal-information-transferredacross-borders/,
(last accessed 30 October 2017).
356 Office of the Privacy Commissioner of Canada, ‗Personal Information Transferred Across Borders‘ (1
November 2016), available at: https://www.priv.gc.ca/en/privacy-topics/personal-information-transferredacross-borders/,
(last accessed 30 October 2017).
357
Norton Rose Fulbright, ‗Global Data Privacy Directory‘ (July 2014), 97, available at:
http://www.nortonrosefulbright.com/files/global-data-privacy-directory-52687.pdf, (last accessed 30 October
2017).
67