| Power Lunch and ... |
a Power Lunch*
and a feature story
- on you - in Backbone
and an iPhone or a BlackBerry
To enter...
Fill out a readership survey
(confidential)
*with Dave Chalk, technology expert and our editor, Peter Wolchak |
|
|
| PIPEDA’s Free Ride is Coming to an End |
November 11, 2004 |
By Jim Middlemiss
It’s been a year since the federal government extended the Personal Information Protection and Electronic Documents Act (PIPEDA) to include provincially regulated businesses. Since then, those companies have had it easy.
That’s because, lawyers say, the office of the federal privacy commissioner has remained largely on the sidelines, putting its house in order since privacy czar George Radwanksi resigned last year under a cloud of questions regarding his spending and management style.
“It’s been a pretty quiet year for PIPEDA, despite the fact that it’s been expanded,” said Mark Hayes, a partner in the business law group at Ogilvy Renault in Toronto. “The federal commissioner’s office is still working out its role and how it is going to proceed.”
The past commissioner, Hayes said, “saw himself as a bit of a crusader,” compared to the current commissioner, Jennifer Stoddart, who has been approaching the task as more of an ombudsman.
However, lawyers warn that 2005 is shaping up to be the year in which Canadian businesses can expect to hear more from Canada’s privacy commissioner.
“I think you’re going to see a lot more companies impacted by the legislation,” Hayes said. “The commissioner’s office is still in a bit of a state of flux…and really only starting to get up to speed this fall.”
PIPEDA is a sweeping law that imposes obligations upon businesses to protect the personal information they gather, and it restricts how that information
may be used.
Companies of all sizes must put policies and procedures in place to protect such information, and establish a complaint system so consumers and
employees can challenge how a business handles its information.
The privacy commissioner has broad, police-like powers to investigate complaints, including the right to subpoena, enter dwellings and extract records.
The federal commissioner cannot, however, fine offenders, but she reports publicly on complaints and can pursue matters in court, leading to damage awards.
When the law first came out in 2001, it applied only to federally regulated companies, such as telecommunication firms and banks.
Last year it was extended to include provincially regulated companies unless a province had passed similar legislation that took precedence and was overseen by a provincial privacy commissioner. So far only Quebec, B.C. and Alberta have such legislation, but the latter two provinces are still
waiting on rulings from the federal cabinet as to whether their laws make the grade. Those decisions are expected at any time.
PATCH WORK COVERING NOBODY
Surprisingly, Ontario has yet to put forward such legislation, despite pleas from that province’s privacy commissioner Ann Cavoukian, who wants the “introduction of made-in-Ontario privacy legislation that will cover the private sector.” Without Canada’s business capital in the game and the other provinces on board, it’s questionable whether the federal commissioner has the resources to cope with complaints.
Tamara Hunter, a privacy lawyer at Davis & Company in Vancouver, said B.C. and Alberta are “in a bit of a limbo” and businesses in those provinces must now comply with both federal and provincial laws.
It’s a “little bit irritating,” she said, because although the B.C. and federal law are similar, there are some subtle differences.
For example, she said the B.C. legislation has exceptions to the general consent requirement that is needed to disclose information, so it’s easier for businesses to sell their operations. The federal legislation is silent on that point.
It’s that lack of privacy guidance in the federal legislation that has raised concerns.
“Where I continue to see some frustration among businesses is because the legislation is not prescriptive in the way you need to comply,” said Michael Fekete, a partner in the technology business group at Osler Hoskin & Harcourt LLP in Toronto.
While there’s no “one-size-fits-all solution” for dealing with personal information, he said, firms need to look for the “high-water mark and best practices.”
That’s presenting a challenge.
LEGAL GREY AREAS
Recent decisions by Stoddart’s office highlight issues firms face when it comes to PIPEDA. For example, a bank was taken to task for leaving a message on a woman’s answering machine that she missed a credit card payment. The woman said she didn’t give bank officials permission to leave a message containing personal information on the machine, which could be heard by her husband.
A number of recent cases deal with video and electronic surveillance in the workplace, including one where an employee who said he suffers physical limitations was videotaped by a private investigator engaging in activities that contradicted his claims. He was fired. The assistant commissioner who ruled on the case said videotaping is frowned upon and should only be used as a last resort, and only with management’s blessing.
Theo Ling, a partner at Baker & McKenzie LLP in Toronto, said that PIPEDA complaints are “one of the big issues we’re going to see a lot more of in theemployment and HR side.”
As more provinces pass their own PIPEDA-type laws, “the monitoring of employees is going to be a big issue,” he said. That includes activities such as accessing workplace e-mails and instant messages.
Another area where businesses are vulnerable, Hunter said, is security and the protection of personal information. “I think some businesses are going to end up being bitten because they are sloppy about that.”
Anti-terrorism initiatives are also coming under the privacy microscope and transborder companies could draw a privacy commissioner’s glare because of
things like the USA Patriot Act, legislation designed to combat terrorism.
“Fighting terrorism is an emerging issue and is topical. We don’t know exactly what is required,” Fekete said, and that has a big impact on data transfers.
Data knows no boundaries and a company can easily ship information across provincial or international borders to a subsidiary or supplier in the blink
of an eye. If the company receiving that information is required to disclose it to a third party by law, then is the firm shipping it required to tell the person whose data is being moved that it could possibly be disclosed to foreign authorities?
At time of writing, that is an issue B.C. privacy commissioner David Loukidelis was examining and one that federal commissioner Stoddart said requires greater dialogue between governments, the private sector and the public.
The decision could impact everything from f inancial transactions to outsourcing and using offshore companies like call centres or information management.
Hayes said: “We don’t have enough guidance on those issues right now. There needs to be a very broad debate and discussion.
There’s a lot of uncertainty.”
In the meantime, though, companies need to focus on the little things. Hayes said stumbling blocks corporations face include failing to respond in time to an access request and obtaining the proper consent to collect data in the first place.
When it comes to compliance, Hayes said, “businesses are at a lot of different stages.” The large ones he works with are “quite far up the learning curve.” But for small and medium enterprises it’s a different story. “Many have not dealt with the issue yet.”
Baker & McKenzie’s Ling said part of the compliance challenge is due to the fact that companies of all sizes have dealt with privacy in a piecemeal fashion and not in an integrated manner. When PIPEDA f irst came out, companies scrambled to draft a privacy policy and get it out to the public, and then added procedures with no real integration across the organization. “Now that we have had more findings and know what the real issues are, I think that companies see privacy compliance is much more involved.”
Web piracy
CAAST http://www.caast.org
International Planning & Research http://www.iprnet.com
NexInnovations http://www.nexinnovations.com
Softchoice http://www.softchoice.com
|
|
|
| Top 300 Issue |
 
|
| Gadget of the Week (Canadian) |
|
Boost your cell
ARC Wireless Freedom Blade
Mobile data and voice are great, as long as the signal is strong. And while mobile networks are pretty good these days, road warriors quickly discover that dead zones still exist.
more>>
|
| Gadget of the Week (Japanese) |
Sounds of Japan
Why record just the visual when you can capture the sounds as well.
more>> |
| Backblog RSS feed |
Click to subscribe  |
|
sponsored by 
