PIPEDA a part of doing good business: Privacy Commissioner

In her first report since the Personal Information Protection and Electronic Documents Act was fully implemented in January of 2004, the federal privacy commissioner said the Commissioner’s Office, in conjunction with provincial counterparts, has developed fair, consistent and clear rules of enforcement of the act.“The totally unwarranted signals of alarm seemed to have died down,” said Jennifer Stoddart, the Privacy Commissioner of Canada, in an interview following the tabling of her 2004 Annual Report on PIPEDA. “Things have come into line. People realize this is simply part of good business.”
The Commissioner’s 2004-2005 Annual Report on the Privacy Act, Canada’s public sector privacy law, was also tabled earlier this month.
But Ian Turnbull, executive director at the Canadian Privacy Institute, who had not looked at the report by press time, said there’s still a fair amount of confusion in the public about the terms of accountability.
“If you’re a business in Ontario that has employees in B.C. and you’re processing payroll and benefits in Alberta, who’s responsible for (the privacy)?” said Turnbull. “The short answer is that nobody has a clue.”
Reasonable grounds
Last year the Privacy Office introduced several measures to help organizations comply with PIPEDA. These included a follow-up procedure to monitor the progress of businesses in implementing the Commissioner’s recommendations, a process for establishing “reasonable grounds” to select subjects for audits and a self-assessment tool to help organizations ensure compliance with PIPEDA.
The number of complaints in 2004 increased by more than 100 per cent from the previous year — from 302 to 723, with 29 per cent or 213 of complaints related to the financial sector. In terms of complaint type, just over a third or 286 of those pertained to use and disclosure of information with collection and access following closely behind.
Consent of the individual remains at the heart of the act, especially as newer technologies such as Radio Frequency Identification (RFID) and biometrics make their way down to the consumer level.
The Commissioner’s Office will be conducting a survey in the upcoming months on RFID to look at how the technology is used and how businesses are thinking about using it, according to the report.
“Businesses that want to use (RFID) should sit down and look at all the specific features of the technology, how it impacts the use and disclosure of personal information and how to make the customer aware of this so the customer can give meaningful consent,” said Stoddart, adding the office is also concerned about the eventual temptation to link individual items or repeated purchases of items to individual customers.
“There are a lot of profound personal information applications,” she said. “This is going to be something we are going to follow very closely within the next few years.”
In the report, which highlighted a number of key investigations under PIPEDA, one case looked at the use of biometrics in a company for the purposes of employee identification. The office concluded the complaint was not well founded, but in another example established that an employer had collected an employee’s personal information by way of video surveillance without his knowledge or consent.
While Turnbull said decisions coming out of the Commissioner’s Office were very limited in the last 12 to 14 months, he added the office has recently picked up the pace a bit. Some of the decisions, however, such as a recent one on e-mail, were fairly surprising, he said.
In response to a complaint that somebody was using somebody else’s e-mail, the office deemed e-mail to be personal information.
Turnbull, however, questions this decision given that most, if not all people these days, have their e-mail address printed on their business cards.
“In the U.S., for example, there are laws in place to try and stop spam, e-mail and fax-related spam,” he said. “This act does not do that.”