What about contracted service providers?
It is not uncommon for agencies to outsource functions to external service providers. For example, many agencies outsource recruitment of staff to private sector recruitment firms.
If these arrangements involve an exchange of personal information, the IP Act requires the agency to take all reasonable steps to bind the private sector entity to the privacy principles. As a result, the contracted service provider assumes privacy obligations as if they were a government agency.