In a controversial
report released August 7, 2008 on complaints filed in 2007 about the outsourcing of Canadian email operations to a US company, the Office of the Privacy Commissioner of Canada ("OPC") found that while organizations must provide sufficient notice of foreign outsourcing and obtain customer consent to such "uses" of their personal information, the risk of a US-based service provider being ordered to disclose personal information to US authorities under the
USA PATRIOT Act is comparable to the risk of Canadian-based service providers being ordered to do the same. As with all OPC findings, these are non-binding.