A recent decision by the Office of the Privacy Commissioner of Canada (OPC) reminds multi-national companies that carry on business in Canada that compliance with foreign data protection legislation may not be sufficient in protecting them from the scope of Canadian privacy legislation.   

In its Report of Findings #2011-002, the OPC considered two complaints lodged under the Personal Information Protection and Electronic Documents Act (PIPEDA) with respect to KLM Royal Dutch Airlines, a Netherlands-based company, and its failure to adhere to Canadian standards of openness, transparency, and access to information.  In particular, the complainant alleged that KLM had denied him access to his personal information and to that of his family members, and that KLM had failed to provide the complainant with information about its policies and practices relating to the management of his personal information, contrary to its obligations under PIPEDA.