Definition

1   In this regulation, "Act" means the Freedom of Information and Protection of Privacy Act.

Additional privacy impact assessment requirements

2   (1) The head of a public body must make an assessment in accordance with subsection (2) with respect to each of the public body's programs, projects and systems in which personal information that is sensitive is disclosed to be stored outside of Canada.

(2) An assessment under subsection (1) must be made in a privacy impact assessment conducted under section 69 of the Act.

Exceptions

3   Section 2 does not apply

(a) to a program, project or system in existence at the time this regulation is brought into force, or

(b) respecting disclosures made under section 33 (2) (f) of the Act.