OPC Releases Guidance to Help Businesses Assess Third-Party Service Providers

Working with third-party service providers is the norm for most organizations in today’s digital environment. But knowing whether a third-party can be a trusted partner when it comes to personal information (PI) and/​or personal health information (PHI) can be a challenge.

The Office of the Privacy Commissioner of Canada (OPC) recently released its Guidance on assessing third-party service providers, to help organizations working with third-party service providers to implement a product, service, or technology involving the collection, use, or disclosure of PI. While the guidance focuses on organizations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), many of the topics covered may also be relevant to other organizations where they remain accountable and responsible for PI or PHI under their custody or control, regardless of who is in possession of the information.

The guidance details a number of best practices for consideration when assessing a third-party service provider:

• Know what personal information is involved
• Map data flows
• Confirm how data will be used
• Understand functionality and performance
• Confirm roles and responsibilities
• Assess out-of-country collection and transfers
• Identify the source of training data
• Verify security practices and administrative controls
• Assess the risk of vendor lock-in and lock-out
• Confirm data retention and end of contract procedures
• Identify Monitoring mechanisms

Assessing the privacy and security practices of a third-party service provider is a key due diligence exercise that should be undertaken by all organizations before entering into an agreement with a third-party service provider or using a provider’s services. Undertaking such an assessment helps organizations:

• Make informed decisions when selecting a provider during the procurement process.
• Identify potential risks and take steps to mitigate and prevent them before they occur.
• Determine whether using a third-party service provider or service may result in non-compliance with applicable privacy legislation.
• Ensure accountability and responsibility for PI/PHI is clearly defined for all parties.
• Inform terms or required amendments to contractual agreements.
• Ensure compliance with internal organizational policies and privacy best practices.
• Promote trust with the public, customers, shareholders, employees, etc.

It is important to document any assessment completed and what steps, if any, were taken to address any privacy or security concerns identified. Having this information available may be essential to demonstrating your organization’s due diligence to regulatory authorities should any issues occur with a third-party service provider your organization has engaged.

Undertaking these assessments can be difficult either due to resource constraints or a lack of the required knowledge and experience within your organization. At Mara we have developed deep expertise in evaluating and assessing third-party services and service providers both privacy and security. These assessments can vary in scope, scale, and depth depending on an individual client’s needs and the stage of engagement with the service provider. This may include for example, a contract review or suggested contractual clauses, a simple assessment of the service or provider, a high-level or contextual Privacy Impact Assessment (PIA) or Threat Risk Assessment (TRA), and/​or a full scale PIA or TRA.

While PIPEDA does not require the completion of PIAs, Bill C‑36, which if enacted, would repeal Part 1 of PIPEDA and replace it with the Protecting Privacy and Consumer Data Act, does contain requirements for PIAs under prescribed circumstances. PIAs are already required under other privacy legislation across the country, and the inclusion of PIA requirements when updating and modernizing privacy legislation appears to be the trend. In addition, PIAs are widely considered a privacy best practice undertaken by many organization whether or not they are required under legislation.

If your organization needs help with assessing third-part services and service providers, we would love to hear from you.