Part of the Globe and Mail Web Centre
globetechnology.com
Home | Search | Tech Investor | Tech Talk | Tech Alert | Events |


  Report on Business
  TV Programs


  R.O.B. Magazine

  Woman's Web

  Daily Tech News

  Daily Investing News

  News Watch

  Tech at Work

  Upstarts


  Product Reviews

  PDA Playoffs  

  Gift Guide Central

  Tech Jobs

  Tech Alert

  Encyclopedia


  Tech Events


  Tech Books


  Contact Us

  Free Headlines

  Globe Subscription

  Reprints

  Make us home

  Advertise: Newspaper

  Advertise: Web Sites

  Press Room

  Privacy policy
 
E-Business (Updated on Thursdays)



CYBERLAW

Privacy law no substitute for vigilance

Site seeing

MICHAEL GEIST

Thursday, December 9, 1999

The federal government's electronic commerce and privacy legislation hit a snag in the Senate this week, but it's still likely to be enacted very soon.

The controversial area of personal health information prompted a Senate committee to recommend amendments to the bill, possibly derailing the passage of the measure by year-end.

Whether in December or January, Bill C-6's passage will, with ample justification, be heralded as an important step for E-commerce development in this country.

But Canadians would be well advised to not let their guard down just yet.

The bill would unquestionably enhance privacy protections enjoyed by individuals. However, several loopholes could provide organizations with considerable room to manoeuvre.

The heart of the legislation is a model code on privacy developed by the Canadian Standards Association. The subject of intense negotiation between business, consumer groups and government, the code represents a compromise between the need to protect individual privacy and the desire of organizations to collect personal data.

This compromise remains intact in Bill C-6. The bill's purpose clause explicitly refers to the balance between the competing interests of individuals and business.

The code, which is attached in its entirety to Bill C-6, lists 10 privacy protections that will provide Canadians with greater control over their private data. Three in particular stand out:

First, Bill C-6 requires organizations to identify the purposes for which they plan to use personal information and to limit the use of that information to the purposes identified. This ensures that the information customers provide strictly to identify themselves is not used for alternative reasons.

Second, except in a number of limited circumstances, organizations must obtain consent to collect, use, or disclose data. This crucial requirement puts the onus on organizations to keep individuals fully informed with regard to how their private data will be used, and to obtain their approval for such uses.

Third, individuals are granted rights to ensure that they have access to their personal data, which companies are required to keep accurate and up-to-date. Organizations are required to provide the public with information on their data-protection policies and grant individuals access to their personal information.
In addition to the privacy protections, the bill creates an enforcement framework based on the active involvement of the federal privacy commissioner. Complaints can be filed with the commissioner, who can conduct thorough investigations or carry out privacy audits to ensure that organizations are in full compliance with the law.

While there is much to commend in Bill C-6, certain aspects leave cause for concern.

The standard for consent is particularly troubling. Under the code, consent can be obtained in a number of ways including the use of negative option checkboxes, which require users to request that their personal information not be given to other organizations. Individuals who do not check the box are assumed to have consented to the transfer of information. A better approach would be to ask users to opt in for the use of their personal data.

For Internet users, the most problematic aspect of the bill is the long delay in its application. It is almost certain that the government will provide organizations with an opportunity to better prepare for the law by delaying its effective date until late next year.

Even when it comes into effect, the law will initially only apply to federally regulated organizations such as airlines, broadcasters, and banks. The vast majority of organizations must comply with the law three years after it comes into force.

Given the pace of Internet development, a three- to four-year wait is unconscionably long.

The enactment of Bill C-6 will signal the most dramatic change in the privacy landscape in Canada since the enactment of the federal Privacy Act in the early 1980s. What it won't do is change the need for Canadians to stay alert to the risks of personal information usage anytime soon.
Michael Geist is a law professor at the University of Ottawa School of Law specializing in Internet and electronic-commerce law. He can be reached at mgeist@uottawa.ca and on the Web at http://www.lawbytes.com.

http://www.parl.gc.ca/36/2/parlbus/chambus/house/bills/summaries/c6-e.htm


 


The R.O.B. NETdex tracks the progress of 16 Internet related companies from the past 30 business days.

View the complete
R.O.B. NETdex
from the past year.



© 2002 Bell Globemedia Interactive Inc. All Rights Reserved.
Help & Contact Us | Back to the top of this page

Home | Search | Tech Investor | Tech Talk | Tech Alert | Events