Although they hardly need an introduction, Salesforce is a cloud-based customer relationship management (CRM) service that allows businesses to efficiently connect with their customers, find prospects, close deals, automate marketing, develop apps, and analyze their data to draw out valuable insights. In this article we explore whether Canadian businesses subject to Quebec’s private sector privacy law (Law25) whose most important provisions are coming into force September 22, 2023, can safely transfer their customers’ data to Salesforce.
Salesforce places significant emphasis on trust. Given the vast amount of data the company is processing and the sensitivity of such data, this is certainly the right strategy as customers’ awareness around their privacy rights increases and the compliance pressure on businesses follows suit. Salesforce’s global reach and complexity of service offerings make it no easy task to ensure compliance. Yet, they have done a great job organizing their public-facing compliance documents in a transparent manner. Customers should nevertheless expect to do some digging when trying to surface the information they need to ensure their obligations to their customers are met when contracting with Salesforce and entrusting them with customer data.
Salesforce Does Not Mention Law25 Compliance
There may, however, be a caveat to all that praise for Salesforce’s privacy posture when it comes to compliance with laws that are lesser known compared to the GDPR and the CCPA. In particular, Quebec’s Law25 finds no mention in any of Salesforce’s extensive public documentation or agreements. While we are assured in the Data Processing Addendum FAQs that their DPA applies globally, and not only where the laws in the regions it specifically mentions applies (the European Union, the European Economic Area and their member states, Switzerland, the United Kingdom and the United States), when it comes to compliance with Canadian privacy laws, the company only points to their compliance with PIPEDA on their “Regional Privacy Laws” website.
While the PIPEDA FAQ, last updated in 2019, is captioned “Compliance with Canadian Privacy Laws,” the document nowhere acknowledges that there are other privacy laws applicable in Canada, such as the considerably stricter Law25 in the province Quebec. To be fair, the main provisions of Law25 just came into force September 22, 2023, but businesses now need to know where to focus their compliance efforts.
That said, we can confirm that Salesforce is very aware of Law25 and its requirements and can thus speculate that further documentation is available to Canadian customers upon request.
Does It Matter?
There are certain provisions in Law25 that are even stricter than the GDPR, for example when it comes to cookies. The Quebec regulator issued guidance stating that they interpret Law25 to require express consent before a cookie is placed on a customer’s device, while PIPEDA and the GDPR may let implied consent suffice. But that is not really an issue for Salesforce as they would not place cookies on the device of a customer whose data they store. However, some of the apps Salesforce integrates with, such as Slack, place cookies on the devices of the employees of a business using Slack for their internal communications. There’s a good chance that the information gathered on employees via cookies would be considered personal information, as Law25 only explicitly carves out “personal information concerning the performance of duties within an enterprise by the person concerned, such as the person’s name, title and duties, as well as the address, email address and telephone number of the person’s place of work.” There is of course the more salient issue of what customer information may be disclosed in employees’ chats that would thus be transferred to Slack, but we will leave this Pandora’s box unopened for now.
What about cross-border data transfers? This must be considered when using Salesforce in Canada. If a Canadian company transfers the data of Quebec residents to Salesforce, this might be a cross-border data transfer requiring an assessment of the receiving jurisdiction. Post-Schrems II, this could pose an insurmountable issue if the data is transferred to the US. Commenting on the EU’s rules around safe cross-border data transfers, the Office of the Privacy Commissioner of Canada, in 2020, opined that:
Using its considerable collective economic clout, the EU has designed a system which relies heavily upon restricting data flows to organizations in jurisdictions where a comparable level of data protection is not available. This comparable level of protection may be achieved by different means. The simplest for organizations is a finding of adequacy. Where there is no adequacy, other options are available, requiring different levels of effort, and considerable involvement of the Commission or national supervisory authorities. As Schrems II makes clear, however, even these measures may be derailed if national security or law enforcement powers in the destination country allow for excessive access to personal data with inadequate recourse for EU data subjects. While such a regime may offer a high level of protection for the personal data of EU residents, it relies upon a level of economic clout that Canada does not have.
This could be read to mean that with Law25 requiring similar adequacy assurances as the GDPR in light of proposed cross-border data transfers, Canadian business may equally be unable to safely transfer data to processors in the US, with the caveat that Canada’s lower level of “economic clout” may not give these businesses sufficient bargaining power to do anything about it.
But Salesforce to the rescue. Turns out, when deployed on a public cloud infrastructure, your core Salesforce (i.e., Sales Cloud and Service Cloud) instance will be hosted on AWS’s servers and there is an AWS Region in Canada with the data centre located in Montreal (AWS Canada Central). If you’re not sure where your data is located, you can find this information conveniently in the Salesforce URL. The same holds true for Marketing Cloud Einstein, but not for all Marketing Cloud services. For instance, Marketing Cloud Engagement is hosted using both Salesforce and Google infrastructure in the United States (if purchased before Nov. 28, 2019) or in France, Germany, or Belgium.
But How About Salesforce’s Sub Processors?
Some features of the core products use external APIs. These features are not necessarily made available by default as part of the core products across the customer base as customers usually require an additional level of review and approval beyond the core platform. These external services may not be delivered through the same local data centers. Depending on the Salesforce services the Canadian business wants to use, the data will be transferred by Salesforce to its sub processors. In this 53 page document listing the sub processors you can see, surprise, that not all of them are located in Quebec. For example, using the new Einstein GPT functionality, the data will be located in either the US, Germany, or India, and only one of them is a safe option from a data protection legislation perspective.
This is of course not a concern unique to Law25, yet the location of sub processors shows an overwhelmingly larger presence in the EU than in Canada. And we get it, Salesforce, Canada is not that big of a player to make it a priority.
How Private AI Can Help
When it comes to the care for the protection of personal data, on the other hand, Canadian companies are world class players. Private AI, for example, provides personal information redaction software unparalleled in accuracy. The easiest way to comply with strict cross-border transfer privacy requirements is to simply not transmit the personal information. Trained to detect and redact over 50 entity types of personal information, health information, and payment card information in 50 languages, using the latest advancements in Machine Learning, the time-consuming work of redacting data with high accuracy becomes three lines of code. To see the tech in action, try our web demo, or request an API key to try it yourself on your own data.
Conclusion
In the intricate web of global privacy laws, Salesforce’s commitment to transparency and trust is commendable, yet the absence of explicit compliance with Quebec’s Law25 raises eyebrows. While the company’s alignment with PIPEDA and other well-known regulations is clear, the nuanced requirements of Law25, particularly concerning cross-border data transfers, remain unaddressed, at least in Salesforce’s public documentation. Salesforce’s utilization of AWS’s Canadian data center offers some comfort, but the location of data servers used by sub-processors for additional functionality adds complexity to the compliance puzzle. The answer to the compliance question, it seems, is thus wrapped in layers of legal subtlety and technological intricacy, leaving Canadian businesses to tread carefully and consult with their Salesforce representatives and legal counsel to ensure that their data handling practices align with the stringent demands of Quebec’s privacy landscape.
