Better protection for the personal information of Canadians will soon be a reality. The federal government appears committed to pass Bill C-54, which will extend protection to personal information that is collected, used or disclosed by the private sector.
Canada is implementing this legislation in order to make Canada a world leader in electronic commerce. Closely related to the stated intention to make Canada more competitive for e-commerce is the potential effect of the so-called European Union (EU) directive on data protection. This directive, with some exceptions, prohibits the transfer of personal information to another country unless there is an adequate level of data protection in the receiving country. Canada could have found itself without an adequate data protection scheme that would satisfy the requirements of the directive. Accordingly, Canadian businesses could have found themselves unable to receive and process data from their European subsidiaries, or unable to compete for contracts to provide data processing services to European companies.
Bill C-54 appears to provide the level of data protection that is necessary to satisfy the EU directive. As a result, Canada may gain a trade advantage over countries that do not have legislated data protection schemes.
The notion of privacy is not new. It was first described in an 1890 Harvard Law Review article as “the right to be let alone.” More recently, Alan Westin described privacy as “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.” The latter definition embodies the concept of “fair information practices” which form the basis of many of the legislated and voluntary privacy codes such as the federal Privacy Act, or the various provincial freedom of information and protection of privacy acts.
Since that time, the definition has been narrowed to include only information about identifiable individuals who are not representing the views of an organization, business or other group. Therefore, organizations may have legitimate confidentiality requirements, but these should not be confused with privacy rights of individuals.
To date, Quebec has been unique in North America in extending privacy legislation to the private sector. In the absence of private sector privacy legislation in other jurisdictions, Quebec-based companies would develop a significant advantage in competing for EU contracts for information technology services. However, the competitive advantage goes well beyond that. For example, domestic consumers that are concerned about their privacy might be inclined to select an Internet access provider (IAP) that is based in Quebec so they have stronger protection for their personal information.
Other data protection schemes have existed in Canada over the past 15 years. Most apply to the public sector. In 1996, the Canadian Standards Association and the Standards Council of Canada approved a Model Code for the Protection of Personal Information (CAN/CSA-Q830-96). This voluntary standard was developed from a broad consensus from diverse stakeholders. The principles in this standard form the basis for Bill C-54.
Bill C-54 can be viewed at the Department of Justice Web site (www.parl.gc.ca/36/1/parlbus/chambus/house/bills/government/C-54/C-54_1/C-54_cover-E.html). A Canadian Information Processing Society 1997 position paper on Privacy and Information Technology (www.cips.ca/papers/privacy/default.htm) discusses the privacy principles from an IT perspective.
It has long frustrated Canadians that they have legislated privacy protection for their personal information when it is in the custody of government organizations, but there are few corresponding privacy rights when the same information is held by the private sector. It’s been long overdue, but Bill C-54 resolves that inconsistency.
Boufford, I.S.P., is president of e-Privacy Management Systems, a consulting firm specializing in privacy and information technology in Lakefield, Ont. In June, he will join the National Board of the Canadian Information Processing Society. He is at boufford@cips.ca