The Ontario Securities Commission (OSC) recently entered into an Administrative Arrangement to allow it to continue to receive personal data from European regulatory authorities for supervisory and enforcement purposes.

Under European Union (EU) regulations, personal data can only be shared with regulators outside the EU where adequate safeguards have been implemented. As a signatory to the Administrative Arrangement, the OSC has agreed on such safeguards in light of new EU regulations adopted to protect personal data.

Under the Administrative Arrangement, the OSC must, among other things, (i) implement appropriate measures to protect any personal data transferred to it from unlawful access or unauthorized disclosure; (ii) retain the personal data for no longer than necessary; and (iii) conduct periodic reviews of the policies and procedures adopted to implement the Administrative Arrangement to assess their effectiveness.

The Administrative Arrangement was delivered to the Minister of Finance for approval on May 10, 2019.