Real and substantial connections : Enforcing Canadian privacy laws against American social networking companies

Any organisation that captures personal data in Canada for processing is deemed tohave a ‘real and substantial connection’ to Canada and thus fall within thejurisdiction of the Personal Information Protection and Electronic Documents Act(PIPEDA) and of the Office of the Privacy Commissioner of Canada (OPC). Whathas been the experience of enforcing Canadian privacy protection law on US-basedsocial networking services? We analyse some of the high-profile enforcement actionsby the Privacy Commissioner. We also test compliance through an analysis of theprivacy policies of the top 23 SNSs operating in Canada and through the use of accessto personal information requests. Our analysis suggests that non-compliance iswidespread, and is explained by the countervailing conceptions of jurisdictioninherent in corporate policy and technical system design.