The clock is winding down for U.S. companies that exchange data with other businesses and subsidiaries in Canada to comply with a law providing broad privacy protections for Canadian citizens.
Beginning Jan. 1, 2004, all companies that collect, use or disclose personal information about Canadian citizens during the course of commercial activities will have to comply with Canada’s Personal Information Protection and Electronic Documents Act.
“Since Canada is our largest trading partner, a lot of companies will be affected by this,” said Mark Rasch, former head of the U.S. Department of Justice’s computer crimes unit and senior vice president at Solutionary Inc., a security consultancy in Omaha.
The act is already in effect for banks, airlines, transportation companies and telecommunications firms. It requires businesses to offer Canadian citizens certain guarantees regarding the collection and use of personal data.
It will be a violation to collect data in Canada and then transfer it out of the country, unless the transfer carries with it the same level of protection that’s required in Canada, Rasch said.
The law requires U.S companies to revise online consumer-consent screens and policies, call center procedures, and processes for recording and maintaining consent records, said Robert Parker, a partner at Deloitte & Touche LLP in Toronto. It also requires companies to protect the physical integrity of the data with adequate security and privacy measures, Parker said.
Canadian companies sharing data with U.S businesses must also “ensure the U.S. recipient commits, by contract or otherwise, to the same standards imposed by (the privacy act),” said Michael Miasek, an attorney in the Toronto office of Baker & McKenzie, a Chicago-based law firm that’s helping U.S. companies comply with the act.
Since the rules retroactively apply to data collected prior to January 2004, companies will need to determine when and how they collected any data they may have on Canadian citizens and how it’s being used, privacy experts said.
