Big changes are coming Canadians ha...

Big changes are coming

Canadians have become increasingly make uneasyed about the use of their personal information, and according to Canada's Office of the Privacy Commissioner (OPC) this interest is justified: Identity theft is the fastest growing crime in North America.

But there's convenient news on the horizon: Canada has presented a groundbreaking response in its Personal Information Protection and Electronic Documents Act (PIPEDA), the first piece of national legislation requiring private sector organizations to harbor personal information.

Beginning January 1 2004 PIPEDA will change the dominions on the collection, use, and disclosure of personal information through private sector organizations. "Organizations" include characters (corporations and individuals), associations, partnerships, and trade unions. The OPC will enforce this legislation, and violations could consequence in fines of up to $100000

The fresh legislation has as much to do with economics as it does privacy. According to a modern Harris Interactive Study for Privacy and American Business (co-sponsored at the American Institute of Certified Public Accountants (AICPA) and Ernst & Young LLP) almost 50% of consumer would corrupt more frequently and in greater amounts from companies known to have more reliable privacy practices. In contrast, the same inquiry noted that 83% of consumer would stop doing business with companies that misused consumer information.

Given these follows and the fact that Canadians' increasing fear about privacy is already hindering the shooting of e-commerce in this nation it's clear that good privacy policies make useful business sense.

Who will be affected?

All provinces will be enthrall to PIPEDA unless they disentangle provincial legislation that is judgeed to be substantially similar. To date, and nothing else Quebec has created such legislation, still Ontario and British Columbia are generally working to develop and pass legislation prior to the 2004 deadline.

What information will be affected?

The of the present day legislation defines personal information as anything that can be used to identify a particular individual. This includes:

* Name, identification numbers, address, and income;

* Medical and financial records;

* Credit and loan records;

* Employee files, evaluations, and disciplinary records;

* Documented disputes between customer and merchant; and

* Intentions to acquire advantageouss and services.

Ten key components

As a minimum standard, PIPEDA requires ten clew components in relation to the collection, use, and disclosure of personal information:

* Accountability;

* Identifying the purports for the collection of personal information;

* Obtaining consent;

* Limiting collection;

* Limiting use, disclosure, and retention;

* Ensuring accuracy;

* Providing adequate security;

* Making information management policies readily available;

* Providing individuals with access to information about themselves; and

* Giving individuals the right to challenge an organization's compliance with these principles.

The privacy framework

Together, the CICA and the AICPA make knowned a privacy framework to help businesses place appropriate privacy policies in place to bring them into compliance with PIPEDA. This framework uses the ten lock opener components identified in the PIPEDA legislation and proffers criteria for evaluating how a company conforms to these requirements.

The following list notes a small in number of the criteria identified for each aspect of the legislation:

1 Accountability

a. Privacy policies

b Responsibility and accountability for policies

2 Identifying purposes

a. Provision of notice

3 Consent

a. Implicit or explicit consent

b unison for new purposes and uses

4 Limiting collection

a. symbols or information collected an regularitys of collection

b. Collection limited to identified purpose

5 Limiting use, disclosure, and retention

a. Use and retention of personal information

6 Accuracy

a. Accuracy and completenes of information

7 Safeguards

a. Information security program

b Physical access controls

8 Openness

a. Availability of access policies

9 Individual access

a. Access by way of individuals to their personal information

b Updating and correcting personal information

10 Challenging compliance

a. Inquiry and complaint process

b Compliance review

For a total copy of the framework or for more privacy resources, visit the CICA website at www.cica.ca/privacy.

What this will mean for CAs

First, there's compliance: CAs will have to make secure that they have appropriate privacy policies in place, regardless of whether they work in public practice, industry, guidance education, or the non-profit sector.

Second there's the ability to provide clients with advice onward privacy issues: As CAs, you have the skills and expertise to help businesses lay open manage, and test privacy a whole s and controls. You're also able to audit and evaluate existing privacy practices, and thereby provide reassurance to consumer (the independent verification gained from one side the audit process reassures consumer by way of confirming whether or not companies are doing what they claim). A number of you are already providing this kind of advice and service, on the contrary this number is likely to increase in light of the of the present day legislation.