[BCMA] museums that are public bodies must store personal data on servers within Canada

[Moderated BCMA subscriber listserv.]

Hi everyone,

As a municipally-funded museum, governed by an appointed Commission, our museum is considered a "public body". We've just been advised that the Freedom of Information and Protection of Privacy Act requires that a public body must ensure that personal information is in its custody or under its control is stored only in Canada and accessed only in Canada, unless the individual the information is about has identified the information and consents to it being stored in or accessed from another jurisdiction. An individual's personal email address would be considered as personal information and would need to be stored within Canada.

By using an e-mail marketing service provider (Constant Contact) that stores e-mail addresses on a server in the United States, we have run afoul of these privacy regulations. This means that we must now find a service provider whose servers are physically based in Canada. Do any of you have recommendations?

Information on the relevant regulations ("Cloud Computing Guidelines for Public Bodies") can be found on the website of the Office of the Information & Privacy Commissioner: http://www.oipc.bc.ca


Nancy Kirkpatrick, Director
North Vancouver Museum & Archives
3203 Institute Road, North Vancouver, BC
Tel: 604-990-3700 (ext. 8001)
e-mail: kirkpatrickn at dnv.org<mailto:kirkpatrickn at dnv.org>
web: www.nvma.ca<http://www.nvma.ca>

new museum blog: www.my-museum.ca<http://www.my-museum.ca>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.vvv.com/pipermail/bcma/attachments/20130801/489be79c/attachment-0001.htm