[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

(Fwd) Bill C-6, the Personal Information Protection and Electr



FYI for those who are interested in privacy issues and electronic
records. Sorry for any duplication!

------- Forwarded message follows -------


Government of Canada Delivers on Promise to Protect Consumer Privacy

OTTAWA, April 13, 2000 -- John Manley, Minister of Industry, today welcomed the passage into law of Bill C-6, the Personal Information Protection and Electronic Documents Act, which has received Royal Assent.  It is expected that the privacy provisions of the Act will come into force on January
1, 2001.

"By enacting this legislation, the government has put in place a critical element of Canada's Electronic Commerce Strategy and meets the government's commitments announced by the Prime Minister in October 1998," said Minister Manley.  "The new law provides the privacy protection that is the
foundation of electronic commerce, moving Canada to the forefront of the global digital economy."

The Personal Information Protection and Electronic Documents Act will protect the personal information of individuals when it enters the commercial sphere in Canada.  It will help to build trust in electronic commerce with its assurance of protection for personal information in digital form.  It
creates a level playing field for business with clear, predictable rules for all.  The Act's privacy provisions are based on CSA International's Model Code for the Protection of Personal Information, developed and recognized by both business and consumers as a standard  for privacy protection.
The new law will work to encourage on-line connectedness of Canadians -- to each other, to business and to the federal government.  Consumers and business will be able to conduct their on-line transactions with the confidence that privacy protection measures are in place and that they will be
overseen by the Privacy Commissioner.

"Canadians have repeatedly asked for privacy protection and businesses increasingly realize that it is a competitive advantage in the new information economy," said Minister Manley. "This Act is an example of the Government of Canada's commitment to protect the privacy of Canadian consumers."

The new law also provides a way to adapt existing federal statutes and regulations to be compatible with an electronic environment.  The Act provides for the use of electronic forms and electronic payments as alternatives to existing paper-based methods of dealing with government. By providing
for the electronic option of doing business with federal government, this new law takes Canada from r
eliance on paper and encourages the use and recognition of electronic documents and signatures.
Additional information on the Personal Information Protection and Electronic Documents Act is avail
able on Industry Canada's e-commerce web site http://e-com.ic.gc.ca.

For more information, please contact:

Jennifer Sloan
Press Secretary
Office of the Minister of Industry
(613) 995-9001

--------------

BACKGROUNDER
PRIVACY PROVISIONS HIGHLIGHTS

PURPOSE

The purpose of the Personal Information Protection and Electronic Documents Act is to establish rul
es to govern the collection, use and disclosure of personal information in a manner that balances t
he right of privacy of all individuals with the need of organizations to collect, use or disclose p
ersonal information for a reasonable purpose.  This is necessary in an era in which technology incr
easingly facilitates the circulation and exchange of information.

APPLICATION

The Act will apply to all organizations that collect, use or disclose personal information in the c
ourse of commercial activities.  It will apply in two phases:

For the first three years after coming into force, it will apply only to organizations in the feder
ally-regulated private sector, including employee information in those organizations, and to intern
ational and inter-provincial trade in personal information where the information itself is the subj
ect of the trade.
After these three years, the provisions will apply more broadly to all organizations that collect,
use, or disclose personal information in the course of commercial activities and to all interprovin
cial and international flows of personal information.  Where and whenever a province adopts legisla
tion that is substantially similar, the organizations, classes of organizations or activities cover
ed will be exempted from the application of the federal law for intra-provincial transactions.

There is one exception to this timetable.  The Act will start applying to organizations collecting,
 using or disclosing personal health information one year after coming into force, so as to give th
e health sector more time to prepare to comply with the new legislation.
The privacy provisions do not apply to individuals collecting, using or disclosing personal informa
tion for domestic or personal purposes nor does it apply to collection, use, or disclosure for jour
nalistic, artistic or literary purposes.

PRIVACY PRINCIPLES

The privacy provisions are based on CSA International's Model Code for the Protection of Personal I
nformation, recognized as a national standard in 1996.  The Standard addresses the ways in which or
ganizations collect, use and disclose personal information.  It also addresses the rights of indivi
duals to have access to their personal information and to have it corrected if necessary.

The code's 10 principles are:

1.  Accountability:  An organization is responsible for personal information under its control and
shall designate an individual or individuals who are accountable for the organization's compliance
with the following principles.

2.  Identifying Purposes:  The purposes for which personal information is collected shall be identi
fied by the organization at or before the time the information is collected.

3.  Consent:  The knowledge and consent of the individual are required for the collection, use or d
isclosure of personal information, except where inappropriate.

4.  Limiting Collection:  The collection of personal information shall be limited to that which is
necessary for the purposes identified by the organization.  Information shall be collected by fair
and lawful means.

5.  Limiting Use, Disclosure, and Retention:  Personal information shall not be used or disclosed f
or purposes other than those for which it was collected, except with the consent of the individual
or as required by law.  Personal information shall be retained only as long as necessary for the fu
lfilment of those purposes.

6.  Accuracy:  Personal information shall be as accurate, complete, and up-to-date as is necessary
for the purposes for which it is to be used.

7.  Safeguards:  Personal information shall be protected by security safeguards appropriate to the
sensitivity of the information.

8.  Openness:  An organization shall make readily available to individuals specific information abo
ut its policies and practices relating to the management of personal information.

9.  Individual Access:  Upon request, an individual shall be informed of the existence, use and dis
closure of his or her personal information and shall be given access to that information.  An indiv
idual shall be able to challenge the accuracy and completeness of the information and have it amend
ed as appropriate.

10.  Challenging Compliance:  An individual shall be able to address a challenge concerning complia
nce with the above principles to the designated individual or individuals accountable for the organ
ization's compliance.

Exceptions
Some groups, such as law enforcement agencies, have a lawful or investigative need to collect, use
and disclose personal information without having to obtain the consent of the concerned individuals
.  For these reasons, certain exceptions to the consent requirement are included, for example:

if the action clearly benefits the individual or if obtaining permission could compromise the infor
mation's accuracy;
where such data can contribute to a legal investigation or aid in an emergency where people's lives
 and safety could be at stake; and if disclosure aids matters of legal investigation or facilitates
 the conservation of historically important records.

PRIVACY COMMISSIONER'S ROLE

Complaints
Individuals will have the right to complain about any aspect of an organization's compliance with t
he provisions relating to the protection of personal information to the federal Privacy Commissione
r.  The Commissioner will have general powers to receive and investigate complaints, and to attempt
 dispute resolution.

Remedies
Unresolved disputes relating to certain matters can be taken before the Federal Court.  In addition
 to its normal powers, the Court may order an organization to correct its practices and award damag
es to the complainant.

Public Information
The Privacy Commissioner will have a mandate to develop and conduct information programs to foster
public understanding of the privacy provisions of the Act.

Annual Report
The Privacy Commissioner will report annually on the application of the provisions on personal info
rmation and on the investigation of complaints.

PERIODIC REVIEW

The privacy provisions of the Act will be reviewed every five years after the coming into force of
the legislation by a Committee of the House of Commons, or of both Houses of Parliament.

--------------

THE PERSONAL INFORMATION AND ELECTRONIC DOCUMENTS ACT:
A PRIMER ON ITS PRIVACY PROVISIONS

Part 1 of the Act provides privacy protection for personal information that is collected, used or d
isclosed in the private sector.  Canada already has federal and provincial legislation to protect p
ersonal information which is collected and used by governments, with the exception of PEI. Quebec i
s the only province to date that has enacted privacy legislation which applies to the private secto
r.
How does it protect personal information?
Personal information is defined as "information about an identifiable individual," and includes thi
ngs such as race, ethnic origin, colour, age, marital status, religion, education, medical, crimina
l, employment or financial history, address and telephone number, numerical identifiers such as the
 Social Insurance Number, fingerprints, blood type, tissue or biological sample, and views or perso
nal opinions.  Protection of this information is achieved by requiring organizations to comply with
 the obligations in CSA International's Model Privacy Code.  The Code is brought into the law, and
indeed becomes the law, by being incorporated as Schedule 1 to the Act.
Where and when will it apply?
The Act will eventually apply to every organization that collects, uses or discloses personal infor
mation in the course of commercial activity.  Commercial activity is any activity that is of a comm
ercial character and would include sales and purchases as well as activities such as barters and ex
changes.  An organization includes a company, an association, a partnership, a person or a trade un
ion.  It does not apply when an organization uses personal information solely for journalistic, art
istic or literary purposes and it does not apply to personal information used solely for personal o
r domestic purposes, such as Christmas card lists.
To encourage harmonization of provincial and federal privacy protection laws, the Act adopts a phas
ed-in approach.  On coming into force, the Act will first apply to the federally-regulated private
sector, including telecommunications, broadcasting, banking and interprovincial transportation, in
respect of both customer and employee information.  It will also apply to organizations that trade
in personal information across provincial or national borders, such as credit reporting agencies an
d some insurance companies.  For one year after coming into force, the Act will not apply to organi
zations that collect, use or disclose personal health information, which will give the health secto
r more time to get their systems and procedures ready.  Three years after it comes into force, the
law will apply more broadly -- to all personal information collected, used or disclosed in the cour
se of all commercial activity.  If, however, a province passes a law that is substantially similar
to the federal Act, the organizat

ions or activities covered by the provincial law will be exempted from the federal law  for collect
ion, use or disclosure within the province.  The federal Act will continue to apply to all interpro
vincial and international collections, uses or disclosures of personal information. Quebec has had
a substantially similar law since 1994.

What obligations will an organization have to meet?
Basically, an organization will have to meet the obligations of Schedule 1. Schedule 1 contains 10
principles that are explained and elaborated in sub-clauses, sometimes by way of example. Since it
applies to all industry sectors and to companies of all sizes across the country, the principles ar
e general. The Schedule also gives organizations the flexibility to adapt the principles to their p
articular operations.
The 10 principles, in a nutshell, relate to accountability, identifying purposes, consent, limiting
 collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual acc
ess, and challenging compliance.
Are there any exceptions?
There are a few exceptions to the general requirement to obtain an individual's consent.  These exc
eptions cover such situations where the collection clearly benefits the individual, or obtaining co
nsent would compromise the information's accuracy, where the data is required for a legal investiga
tion or aid in an emergency where lives and safety are at stake, or if a disclosure would facilitat
e the conservation of historically important records.
What is the most important thing for individuals and organizations to know?
A key principle in Schedule 1 is the requirement for organizations to obtain an individual's consen
t when they collect, use or disclose the individual's personal information.  The general rule is th
at no one else will be able to make use of a person's personal information without that person's pe
rmission.  An individual will have a right of access to their personal information that is held by
an organization and to have it corrected, if need be.  Personal information can only be used for th
e purposes for which it was collected and if an organization is going to use it for another purpose
, consent must be obtained again.  Individuals should also be given the assurance that their inform
ation will be protected by specific safeguards, like locked cabinets, computer passwords or encrypt
ion.
What can an individual do if his or her personal information is misused?
The first thing to do is to try to settle the matter directly with the organization.  All organizat
ions are required to designate an official to deal with privacy issues and this is the person to co
ntact. If not satisfied, the individual can complain to the federal Privacy Commissioner.
What will the Privacy Commissioner do?
The Privacy Commissioner will investigate the complaint, using various powers given by the Act.  Th
e Commissioner is an ombudsman who will attempt to resolve the dispute through mediation and persua
sion.  Once the investigation is completed, the Commissioner will issue a report to the parties wit
h the findings and recommendations.  The Commissioner can also initiate a complaint or conduct an a
udit (with reasonable notice) of the information management practices of an organization and can pu
blish the results, where that would be in the public interest.  The Commissioner has a broad mandat
e to promote the purposes of the Act by conducting public education programs, undertaking research
and encouraging organizations to develop privacy policies and practices.

What if the individual is still not happy?
Within 45 days of receiving the Commissioner's report, a complainant can ask for a hearing in Feder
al Court.  The Court has the power to order an organization to correct its practices if they do not
 comply with the law and to publish notices of any action it has or will take to correct its practi
ces.  The Court can also award damages to the complainant, including damages for humiliation.
Won't it be costly to go to Federal Court?
The Act provides that an application to the Federal Court will be heard and determined without dela
y.  The proceeding will be "in a summary way", that is, streamlined and easy. The Commissioner can
also take the issue to Court on the complainant's behalf.
Are there offences under the Act?
Anyone who obstructs the Commissioner in an investigation or who destroys records before all recour
se is exhausted or who dismisses or disciplines a whistle blower is guilty of an offence and is lia
ble to a maximum fine of $100,000.
Conclusions The Act provides protection for personal information in a manner that is balanced and f
air to both organizations and individuals.  It establishes the Privacy Commissioner as an ombudsman
, with the goal of obtaining a resolution of privacy disputes in a non-confrontational manner. Thro
ugh the use of audit, conciliation, education and publication powers, the Commissioner will be able
 to encourage organizations to comply with the obligations in Schedule 1.  For organizations, the p
rinciples in Schedule 1 allow for flexibility in meeting the law.  Organizations will generally not
 be subject to fines under the law and they will be given the opportunity to directly solve problem
s with their clients.
--------------

BACKGROUNDER
ADJUSTING THE LEGAL FRAMEWORK FOR ELECTRONIC COMMERCE

Existing federal statutes and regulations often specify that information must be given "in writing"
, "certified" or "signed".  These types of references can be interpreted as restricting transaction
s only to paper and preclude the possibility of transmitting information electronically.

The Department of Justice reviewed over 600 federal statutes and found that 300 of these made refer
ences to obtaining or sending information in a way that appeared limited to paper.  However, as com
munication becomes increasingly paperless, the dependence on paper becomes outdated and cumbersome.


The legislation provides a way to adapt existing federal statutes and regulations so that they are
compatible with an electronic environment.  In other words, it provides a way to adjust or apply cu
rrent laws so that there is an electronic alternative to transmitting information.
SECURE ELECTRONIC SIGNATURE
The legislation gives federal departments, agencies and boards the authority to decide how requirem
ents in existing statutes and regulations can be satisfied by electronic means in place of paper.
A key component of the legislation is the concept of "secure electronic signature" which may be use
d in electronic transmissions to ensure their integrity and reliability.

GOVERNMENT GETTING READY TO GO ON-LINE
Federal departments, agencies and boards may first need to adjust their existing statutes and regul
ations before they are in a position to deliver their services on-line.  It will be up to these ind
ividual departments, agencies and boards to apply the new legislation as they put into place the ap
propriate means to conduct business electronically.

Creating an electronic alternative does not mean doing away with more traditional methods that the
federal government uses to communicate and conduct business with Canadians.  The new legislation pr
ovides a way for the federal government to accommodate an increasingly popular way of doing busines
s:  through electronic means.

ELECTRONIC EVIDENCE
Another element of the legislation concerns electronic documents that are introduced as evidence in
 court proceedings.  Although electronic documents presented as evidence is not new, electronic tec
hnology has affected how lawyers and judges interpret the rules of evidence.  There are four main a
reas that the proposed legislation covers in relation to evidence:

clarifies how the courts assess the reliability of an electronic document that is introduced as evi
dence;
assists courts in recognizing secure electronic signatures and how they are used in relation to ele
ctronic documents;
recognizes that notices and acts published electronically by the Queen's Printer have the same lega
l weight as notices and acts published on paper by the Queen's Printer; and
gives official status to the electronic version of the consolidated Statutes and Regulations of Can
ada.


------- End of forwarded message -------

A posting from the Archives & Archivists LISTSERV List!

To subscribe or unsubscribe, send e-mail to listserv@listserv.muohio.edu
      In body of message:  SUB ARCHIVES firstname lastname
                    *or*:  UNSUB ARCHIVES
To post a message, send e-mail to archives@listserv.muohio.edu

Or to do *anything* (and enjoy doing it!), use the web interface at
     http://listserv.muohio.edu/archives/archives.html

Problems?  Send e-mail to Robert F Schmidt <rschmidt@lib.muohio.edu>