Privacy Commissioners’ Report of Findings on Aggregate IQ : Challenges with Position on Service Providers’ Obligations

On November 24, 2019, the federal Office of the Privacy Commissioner of Canada (OPC) and the Office of the Privacy Commissioner of British Columbia (BC OIPC) released their report of findings (the Report) arising from their joint investigation of Aggregate IQ Data Services Ltd (AIQ). Before the investigation, AIQ processed personal information as a service provider to several organizations involved with political campaigns located in foreign jurisdictions, among them SCL Elections Ltd., the parent company of Cambridge Analytica.

According to the Report, in its capacity as a service provider to organizations located in foreign jurisdictions, AIQ failed to ensure it had meaningful consent from the individuals whose personal information it collected, used, or disclosed, in contravention of Canadian privacy laws. The Report also concluded that AIQ failed to adequately protect personal information it held, and this failure was also a contravention of Canadian privacy laws.

The reasoning behind the findings raises two questions:

• How do Canadian privacy laws apply to a service provider when it is processing data on behalf of a client in a foreign jurisdiction?
• Must such a service provider police the consent and data collection practices of its client?

You can read our recent bulletin in which we consider each of these questions.

This content has been updated on January 9, 2020 at 13 h 20 min.