Trade deal’s data provisions could put sensitive personal info at risk: critics

OTTAWA – The Trans-Pacific Partnership deal places sensitive Canadian data such as health records at risk through provisions that open the door wider to cross-border data flows and offshore record storage, analysts fear.

The text of the deal between Canada and 11 other nations, made public Thursday, says countries must allow the business-related transfer of information — including personal data — across borders by electronic means.

The clause could limit the ability of participating nations to halt the flow of information to countries with inadequate privacy protections, says University of Ottawa law professor Michael Geist.

The deal also effectively bars governments from insisting on the use of local computer servers to store and access personal data — meaning the information could be hosted abroad and possibly become more accessible to foreign police and security services.

In both cases, exceptions may be made for “a legitimate public policy objective.”

But such an exception cannot be a disguised trade restriction or be more onerous than necessary to achieve the policy objective.

The wording of the deal “creates quite a lot of uncertainty” about what a government could do to shield its information, Geist said Thursday.

“There is, I think, real, legitimate concern that a country establishing these kinds of protections could find itself facing litigation from a company if they wanted to argue that this was costing them and that, in fact, the privacy protections that had been established were greater than necessary.”

British Columbia and Nova Scotia have laws to keep sensitive information from being exposed abroad.

B.C. law requires public bodies to “ensure that personal information in its custody or under its control is stored only in Canada and accessed only in Canada” — a provision enacted in 2004 in response to public concern about a U.S. company handling the province’s pharmacare data.

The B.C. Freedom of Information and Privacy Association is concerned the Trans-Pacific deal would override the law.

The exception for legitimate policy objectives offers some comfort, but would place the burden on Canadians to make a “convincing enough argument” that they were not skirting the deal, said Vincent Gogolek, the association’s executive director.

A ruling against Canada that led to sensitive data being hosted on the computer servers of a American company would leave it more vulnerable to ending up in the hands of authorities due to security legislation such as the U.S. Patriot Act, he said Thursday.

Trade Minister Chrystia Freeland said Thursday the new Liberal government is committed to reviewing the Trans-Pacific agreement, giving Canadians time to comment and holding a full parliamentary debate.

The previous Conservative government hailed the deal as a means of ensuring Canadian access to a market of nearly 800 million people.

Follow @JimBronskill on Twitter