We've made some decisions with respect to the use of a supplier's services in a third country. The Privacy Act doesn't prohibit that. In Canada, data can be transferred outside the country. The regime basically says you have to give protection equivalent to that in the other country.
When we look at such cases, we check that consent is given for the same purposes as those for which it's used in the other country. We also check whether the terms of use are transparent, which is to say, that users who give their consent are fully informed of the purposes for which their information may be used. In some cases, we found that acceptable.