Nova Scotia followed in the footsteps of British Columbia with the Personal Information International Disclosure Protection Act (PIIDPA). The act provides for the regulation of all public bodies including but not limited to education, transportation, health care, and justice. Much like British Columbia, PIIDPA requires public bodies to ensure the personal information is only stored in Canada and only accessed in Canada.
The Act also applies to a service provider, cloud storage provider, or the associate of a service provider, including employees, subcontractors, officers, affiliates, and directors. There are some exceptions; when consent is given for individual data, when the act allows disclosure, or when the head of a public body provides authorization. It is the responsibility of the head to provide annual reports of the decisions to the Minister and provide notification of any breaches in security or foreign requests.
When you are selecting a cloud provider at the provincial private and public sector level in Nova Scotia, it is essential that you conduct a thorough evaluation of the provider and their policies. Questions to ask include:
- Is the business’ ownership inside of Canada?
- Where are the business and data centers physically located?
- For businesses located in a province and governed under that province’s laws, is the data center also located within that province?
- Are all contractual provisions aligned with the privacy laws of your province including third party access limitations and requirement to provide notification of a suspected or actual security breach?
- What policies does the cloud company have in place for privacy, security, and access management?
- What are the protocols for infrastructure security including encryption of information when it is stored and transferred?
- What policies does the cloud company have in place regarding subpoenas and warrants that are issued to them from jurisdictions outside of the province or outside of Canada?
For More information on Nova Scotia’s privacy laws, visit: