Final Report

The full public report “Seeing Through the Cloud,” including detailed research reports as appendices, is available below alongside Commentary received and Outsourcing Contracts and PIAs reviewed.

Table of Contents

  1. Heidi Bohaker and John M. Dirks, “Privacy Impact Assessments and Microsoft & Google Vendor Contracts: Examining Canadian University eCommunications Outsourcing Decisions” 
  2. Lisa Austin and Daniel Carens‐Nedelsky, “Why Jurisdiction Still Matters” 
  3. Andrew Clement and Jonathan Obar, “Canadian Internet ʹBoomerangʹ Traffic and
    Mass NSA Surveillance: Responding to Privacy and Network Sovereignty Challenges”

  4. Stephanie Perrin, “Transboundary Challenges to Privacy Protection” 
  5. Stephanie Perrin, with Heidi Bohaker & Andrew Clement, “A Framework for Canadian Organizations Assessing Privacy Implications for Extra‐National Outsourcing of eCommunications Services” 
  6. For Further Reading: “An Annotated Bibliography”  (Susan Colbourn, with contributions from Daniel Carens‐Nedelsky and the project team)
Back Matter




Outsourcing Contracts and PIAs

© Copyright 2015. This work is licensed to the public through a Creative Commons Attribution Non-Commercial 2.5 Canada license (CC BY-NC 2.5 CA). For more information visit

6 thoughts to “Final Report”

  1. I was wondering if I can obtain a copy of this report (Assessing the Privacy Implications of Extra-National Outsourcing to the Cloud). If not available, how about the Summary of Findings and the Policy Recommendations?
    Thank you

    1. Hi Tia,

      Sorry for the delay in responding. We are planning a formal launch in mid-September with the final report and updated website content.

      In the interim if you would like more details please feel free to get in touch with the Heidi Bohaker (heidi _dot_ bohaker _at_ utoronto _dot_ ca).


  2. Hi,

    I wanted to ask today before we ran out of time about the impact of using a Canadian data centre. Coincidentally, when I arrived back at my desk, I saw an announcement from September 10th that “Oracle built a new data centre in Canada to address data residency and data sovereignty concerns.” See the following link for details:

    So my question is, how, if at all, does having a Canadian data centre change the situation if it is still owned by a non-Canadian company or parent company? The uninformed observer could believe or be lead to believe by those intending to take advantage of such a service that this approach fully addresses any risks and issues that would otherwise arise from not having the data centre in Canada.

Comments are closed.