International Storage

If data will be stored other than in Saskatchewan it does not eliminate the need for the board of education to comply with privacy and access requirements.

It will be important to obtain details from the contractor regarding the laws that will apply to the data. Storage at facilities in Canada will not generally pose much difficulty – the laws across Canada are similar enough to allow a fair degree of confidence that the storage and security requirements can be met.

If data will be stored in the USA it will become subject to the laws that apply in that jurisdiction. That does not necessarily mean that such storage in unacceptable. The contract with the service provider should spell out the requirements relating to privacy and access. It should also spell out responsibility for breaches of data protection.

While there are strong laws in the USA that allow certain law enforcement agencies access to data under certain circumstances it will not generally expose the data to any greater degree of risk than what would be expected in Canada.

If the data will be stored in a European country the data protection laws are generally of a strong nature. Other countries will have a great variance in the protection provided.

Legal advice should be sought if there is any question about the laws applicable to the storage of the data. The contract of the provider of services should also be reviewed by legal counsel to ensure that data will be handled appropriately.

The Ontario Information and Privacy Commissioner released a white paper that outlines a data protection scheme for data that enters the cloud. The paper Modeling Cloud Computing Architecture Without Compromising Privacy: A Privacy by Design Approach is available at www.ipc.on.ca.