Outsourcing and transborder data flows: The challenge of protecting personal information under the shadow of the USA Patriot Act

Governments are increasingly outsourcing service provision to private contractors in an effort to realize cost efficiencies. The passage of the USA Patriot Act, however, has caused concern that government outsourcing of data management to US-based companies could result in the violation of fundamental civil liberties. What follows is a case study of a Canadian provincial government's plan to out-source the administration of a public health insurance and drug plan to a Canadian subsidiary of an American company. Within the context of the larger international concern about the reach of the USA Patriot Act, the article discusses the Canadian response to the fear that outsourcing will compromise the security of personal health information. It concludes that while different privacy protection experts worldwide have drawn different conclusions as to the implications of the USA Patriot Act, the ability of governments to protect the large amounts of data that are entrusted to them is becoming increasingly difficult. Points for practitioners: Globalization and electronic communication not only challenge the sovereignty of the nation-state, but complicate the environment that both companies and governments 'do business' in. This is particularly true given the swift passage of the USA Patriot Act 45 days after the September 11 attacks on New York's twin towers. This study of public sector data management outsourcing demonstrates that accountability, transparency and control over governments and their agents must not be compromised in the face of high profile demands to enhance national security or due to more mundane pressure to increase administrative efficiency.