How does TCPS 2 address international data transfers?

• A. Ensure privacy protections under applicable laws; use data transfer agreements; assess cross-border risks.
• B. Ignore cross-border issues.
• C. Transfer data freely to any country.
• D. Only local storage is allowed.

Answer: (A)

When data moves across borders, TCPS 2 emphasizes protecting participants’ privacy by applying protections in the receiving jurisdiction, using formal data transfer agreements, and evaluating cross-border risks. This means you must implement privacy safeguards consistent with applicable laws in both Canada and the destination country, ensure the data will be handled only for the stated purposes, and maintain appropriate security measures. Data transfer agreements spell out responsibilities, allowed uses, access controls, breach notification, and what happens to the data after sharing. And you must assess cross-border risks—considering whether the receiving party can maintain equivalent protections, the legal environment, potential third-party access, and whether identifiability is reduced through de-identification or anonymization.

So the best answer is the one that articulates these steps as part of handling international data transfers. The other options either ignore cross-border considerations, assume unrestricted transfers, or mandate local storage only, which would not align with the safeguards TCPS 2 requires for跨-border data sharing.