Data Privacy and the Administrative Arrangement


On this page:

1. Personal Data Privacy Notice
2. Notice of Administrative Arrangement for the Transfer of Personal Data with EEA Authorities


Personal Data Privacy Notice

This notice explains why the Ontario Securities Commission (OSC) collects and processes personal data, why it transfers personal data, the rights available under Ontario legislation to an individual whose personal data are transferred (Data Subject), and who the Data Subject should contact if they have questions or concerns about the handling of their personal data.

The OSC has entered into an administrative arrangement for the transfer of personal data between the European Economic Area Authorities in Appendix A and the non-European Economic Area Authorities in Appendix B (Administrative Arrangement). The Administrative Arrangement provides safeguards to personal data (information by which a natural person may be identified, such as a name, address or an identification number) that are transferred between the parties that have signed it.

This notice is provided pursuant to section III. 3 of the Administrative Arrangement.

The European data protection supervisor, the European Data Protection Board (EDPB), has issued its opinion that the Administrative Arrangement ensures appropriate safeguards when personal data are transferred on the basis of the Administrative Arrangement to public bodies (such as the OSC) in non-European Economic Area countries (https://edpb.europa.eu/sites/edpb/files/files/file1/2019-02-12-opinion_2019-4_art.60_esma_en.pdf).

  1. Collection and Processing of Personal Data by the OSC

The OSC collects and processes personal data to administer and enforce compliance with the provisions of the Securities Act and the Commodity Futures Act. The purposes of the legislation are to protect investors from unfair, improper or fraudulent practices, to foster fair and efficient capital markets and confidence in capital markets and to contribute to the stability of the financial system and reduce systemic risk.

Personal data are collected from regulators in other jurisdictions using information sharing arrangements such as the IOSCO Multilateral Memorandum of Understanding Concerning Consultation and Cooperation and the Exchange of Information (IOSCO MMoU) (https://www.iosco.org/library/pubdocs/pdf/IOSCOPD386.pdf).

  1. Transfer of Personal Data by the OSC

The OSC may transfer personal data to other securities, derivatives, and financial regulators, law enforcement bodies, self-regulatory bodies, or other entities set out in section 153 of the Securities Act and section 85 of the Commodity Futures Act. Personal data may be transferred where a matter is better handled by another body, where the transfer will assist another body in fulfilling its mandate, or where the sharing of personal data are required under an information sharing arrangement, such as the IOSCO MMoU.   

By transferring personal data under reciprocal arrangements like the IOSCO MMoU, the OSC can in turn obtain such information from other regulators. This assists in our enforcement and supervisory activities, and helps protect Ontario investors and the Ontario capital market.

  1. Rights of a Data Subject

The OSC will manage personal data in accordance with the provisions of the Freedom of Information and Protection of Privacy Act (the FOIPPA). This means that personal data can only be collected, used, and disclosed as permitted by the FOIPPA and must be managed in a secure manner.

The FOIPPA provides a Data Subject with the right to request access to his or her personal data, although there are certain exemptions from the right of access that may apply. A data subject may also request that his or her personal data be corrected if the individual believes that it contains an error or omission. A refusal of access or a refusal to correct information may be appealed to the Information and Privacy Commissioner of Ontario (see below).

  1. Questions or Complaints 

If you have any questions or concerns about the collection, use, processing, protection, disclosure, or transfer of your personal data by the OSC, you may contact:

David Babin
Legal Counsel
General Counsel’s Office
(416) 593-8172

If you are not satisfied with the response you receive, or if you wish to make a complaint with respect to any of these matters, you may contact the Information and Privacy Commissioner of Ontario at:
2 Bloor Street East
Suite 1400
Toronto, Ontario
M4W 1A8
Tel: 416-326-3333
TTY: 416-3257539