A Closer await at Canada's New Pri...

A Closer await at Canada's New Privacy Laws

According to the National place privacy legislation is a "multi-dimensional mess" for which George Radwanski, Canada's former privacy commissioner, is to blame. Many businesses might agree, on the contrary to view the new legislation as just another example of management red tape and bureaucracy is to ignore Canadian and global realities.

Privacy legislation exists because consumer are disturbed about misuse of their personal information-plain and simple. This disquiet has been consistently expressed in Canadian, American, and British take a view ofs by a large majority of respondent This same majority has also said it will refuse to bribe from companies that have questionable privacy policies and practices. Companies are troubleed as well: According to a newly come survey of Canadian executives convoyed by Robert Half Management Resources, for example, 32% of CFO said they perceived their firms to be greatest in quantity vulnerable in the area of information arrangements security.

The level of affair is justified: At the self-same least, junk mail, spam email, and intrusive telemarketing practices have become an increasing annoyance for all of us; at the actual worst, some of us have experienced invasions of privacy, of the like kind as stalking or identity theft.

Canadian consumer might be surprised to learn that Canada was actually behind many other perform the operations indicated ined countries, including the UK, the European Union, and Australia, when it enacted the Personal Information Protection and Electronic Documents Act (PIPEDA) for federally regulated enterprises in January of 2001 and then lengthen outed it to all private sector organizations upon January 1, 2004. The UK for example, has had data protection legislation since 1998 In fact the fact that most countries already required equivalent privacy laws for international business where personal information is shared was a major impetus for Canada to pass the legislation.2

So now that the recent privacy laws are in place, what's a smart business to do? Well, compliance with the literal meaning of the law is just the beginning. Smart businesses will seize this legislation as an opportunity to improve the quality and resolve into the cost of the information they collect; strengthen customer and employee relations; defend valuable business relationships with strategic partners; adapted international privacy standards; and mostly importantly, gain a competitive margin over companies that fail to embrace the best privacy practices.

Before we finish to these opportunities, let's review more [i]or[/i] less compliance issues, including potential pitfalls.

THE LEGISLATIVE ENVIRONMENT PIPA & PIPEDA: a comparison

In a review conducted for Telus in 2003 "British Columbians... rated the protection of personal information the secondary most important issue in the province, on a level ahead of the environment or crime."3

Perhaps the BC control took this survey to heart, as the BC Personal Information Protection Act (PIPA) also took import January 1, 2004. Although there has been no official ruling, one as well as the other the Province of BC and the Office of Canada's Privacy Commissioner anticipate PIPA to be "substantially similar" to PIPEDA.

However, a certain number of of the differences between PIPA and PIPEDA are worth noting:

Non-profits

According to the just discovered Federal Privacy Commissioner Jennifer Stoddart, PIPEDA distinguishes between "commercial activities" and other activities of non-profits, "such as collecting membership rewards organizing club activities, compiling a list of members' names and addresses, and mailing disclosed newsletters. Similarly, fundraising is not a commercial activity. However, near clubs-for example many golf coteries and athletic clubs-may be engaged in commercial activities which are enslave to the Act."

PIPA, however, applies to all organizations-specifically including non-profits, trade unions, and associations-and guards the personal information of customers, employee donors, proffers contractors, suppliers, and members.

The upshot? All non-profit form into groupss in BC are automatically make submissive to privacy legislation, whereas it's possible for a certain quantity of of the activities of a non-profit collection in Ontario, for instance, to be exempt

Grandfather clause

PIPA has a "grandfather" clause, meaning that organizations don't have to secure consent from existing customers for information already held. However, the other provisions of the legislation relating to use, disclosure, and safeguards still apply.

Employee personal information

Employee personal information is explicitly concealed by PIPA. However, the legislation recognizes that certain information must be heap uped to manage employment (such as name, address, and SIN), and that a certain quantity of information may be necessary for "reasonable accommodation" for bodily forms with special requirements or to make sure that special circumstances are considered. PIPEDA, onward the other hand, only applies to the employee information of federally regulated companies, similar as airlines and telecoms.

Power to make orders

Finally, PIPA gives the BC Privacy Commissioner (currently David Loukidelis) the power to make orders, with fines of up to $100000 by incident for non-compliance. The federal privacy commissioner, by means of contrast, does not have the power to make binding orders or muster fines.