To receive
The Riley Report
free
by e-mail,
CLICK HERE
Back Issues
October 1999
SEEKING PRIVACY RIGHTS IN A DIGITAL AGE
What was a more or less orderly information marketplace, based upon oral communication, the handwritten note, and the printed word, and enhanced by radio and telephone, has evolved into a multimedia melting pot of new information businesses that find this treasure trove of archived information a valuable resource for many utilitarian as well as charitable purposes.
- Anne Wells Branscomb,
Who Owns Information: Privacy to Public Access
The rise of intrusive technologies and the Internet has resulted in a surge in awareness about the importance of privacy. On the Internet a lot of pressure is being put on companies to develop privacy policies to protect consumers who are liberally sharing their personal information in this new environment. The rush by large corporations to engage in electronic commerce (e-commerce) has meant more personal information is being gathered, shared, sold, and disseminated, than ever before.
The transition from the Paper Age to the Digital Age has brought with it new issues surrounding the usage of personal information. In the past, especially prior to the rise of the personal computer, international information networks, and the Internet, information was often difficult to retrieve, or necessitated a laborious process.
Now information from around the globe can be at one’s fingertips with the touch of a stroke on a keyboard. Any curious citizen can browse the Internet, use search engines to find out whatever kind of information he/she is seeking from either web sites or a multitude of other Internet related sources. This creates a whole new dimension to the issue of how personal information is used in today’s rapidly changing society. We are in the midst of an information free fall in terms of how our personal information is being used and bandied about.
Surveys show that a large majority of the citizens shopping online want to ensure that their personal information is protected, secure and confidential.
However, the privacy issue moves far beyond protecting personal information on the Internet. It is about ensuring that the individual’s personal information is protected through:
- the citizen having the right of access to one’s own personal information kept by an organization (whether it be a public or private sector body) and no matter in what format the personal information is kept;
- ensuring that organizations are protecting the information through a set of universally agreed upon fair information practices; and
- individuals having the right to lay complaints to an independent body if any of these principles are violated.
A Discussion Paper on privacy, from Canada’s Department of Industry, articulated the fair information practices, as follows:
- establishing the necessity and relevance of the information collected and building in finality (establishing the uses of the information in advance and eventually destroying it);
- identifying the person who has responsibility for protecting personal information within an organization;
- getting informed consent from the individual, as to the usage of the information;
- maintaining accuracy and completeness of records; and
- providing access to the information and a right of correction."
Fair information practices are the cornerstone of most efforts to protect personal information around the world. They form the basis of the Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, which were developed by the Organization for Economic Co-operation and Development (OECD) in 1980 and signed by Canada in 1984. The Guidelines were designed both to protect personal information and to ensure the free flow of information.
The European Union (EU) has a Directive on the Protection of Personal Information that applies to the public and private sectors in all its member countries. Each member country has its own laws but, under the rules of the European Union, member countries must incorporate all the principles laid out in the EU Directive. Many other jurisdictions, such as Japan, Thailand, Sweden, Israel and Hong Kong, have privacy laws (also known as data protection laws) that cover both public and private sector bodies.
In North America, the province of Quebec is the only jurisdiction that has a privacy law covering both the public and private sectors. The United States has been under continuous pressure to implement some form of omnibus privacy legislation to cover the private sector. As in Canada, the United States has a Privacy Act at the federal level that only covers government agencies. Similar public sector laws exist at the state and provincial levels. However, the Europeans are increasingly putting pressure on the Americans to develop an universal privacy law. The reason for this is that under the EU Directive, there is a clause that, essentially, says any member country can prohibit the transfer of data to another jurisdiction that does not have adequate privacy protection mechanisms in place. This is interpreted to mean that there should be legislation. The United States adamantly refuses to favour legislation and promotes the voluntary development of privacy policies by corporations.
However, Canada has taken a different tack. The Minister of Industry introduced a Bill (C-54) to protect personal information in the private sector in the fall, 1998.
This legislation is currently making its way through the parliamentary process and, at this writing, is being debated in the House of Commons for third and final reading. It will then be referred to the Senate. It is anticipated the Senate will deal with the Bill starting sometime in late November.
When the Bill is referred to the Senate it must go through the same stages as it went though in the House of Commons. The Bill, after it passes first and second reading in the Senate, will then go to the Senate Banking and Commerce Committee. It is certain that the Committee will hold hearings on the legislation, as there are many groups and individuals that want to be heard. The Bill could conceivably be passed by the Senate and proclaimed as law by late spring or early summer, 2000. If this is the case, the law could then become operational as early as December, 2000 or sometime in the first half of 2001.
However, that is the optimistic scenario, barring any possible stumbling blocks, as the Bill makes its way through all of its parliamentary stages. Many privacy advocates are worried that the Bill is not going to have a smooth ride through Parliament. There is much evidence to suggest they might be right. It has come to light that some of the health organizations, such as the Canadian Pharmaceutical Association, want to carve out any applications to health and medical files. The Government of Ontario, in its presentation to the House of Commons Industry Committee last spring, particularly objected to the principle of consent, i.e. getting the permission of the individual to use his/her personal information for another purpose or secondary usage other than that for which it was collected. Many health professionals want to see the privacy issues handled in separate legislation. This could result in a considerably lower threshold of protection than exists in the current privacy Bill coming before Parliament.
Privacy advocates see the carving out of any application to health files as a major weakening of the Bill. These same advocates have been worrying publicly that the health industry has gotten to members of the Senate Committee and might have persuaded some members of the Senate to bring in the changes that some sectors of the health industry want. The extent of any opposition to the Bill in its current form will only become known when the privacy Bill surfaces in the Senate. As to the position of the Federal government there are no indications, at this stage, that they will allow any kind of carve-out from the Bill as it stands. If the Senate were to bring in amendments to the Bill, and pass them, then the Bill would have to go back to the House of Commons for further debate and final passage. This process could delay the eventual implementation of the Bill into law, but it is doubtful that once it gets back onto the parliamentary agenda it will not eventually pass. The biggest unanswered question, as of this writing, is if the Bill will apply to some parts of the health sector when it passes into law.
As a result of these concerns, both consumer and business groups have come together to call on the Government to maintain its commitment to the original legislation (Bill C-54, which will have a new designation when reintroduced). Advocates believe it is essential that the Bill get passed in this parliamentary year, or face the danger of it not passing at all. In an October 7th press release, John Gustavason, President and CEO of the Canadian Direct Marketing Association, said that, "this is a very important bill that will establish a common set of Canadian rules for all commercial transactions involving personal information by the private sector in all media, not just in e-commerce. We believe that this legislation is central to the continued growth of information-based marketing in Canada." He said that the Bill would help to instill confidence and trust in marketers.
The Public Interest Advocacy Centre (PIAC) is a national, non-profit organization representing various consumer and public interest groups with a combined membership of over 2 million Canadians. They have been strong proponents of privacy legislation for years. The organization was one of the key players in the development of the Canadian Standards Association’s Model Code on the Protection of Personal Information. The latter became the basis of the current Federal privacy for the private sector legislation. Pippa Lawson, Counsel for PIAC, has been one of the strongest advocates for the legislation. She led a campaign to get the Bill back into Parliament last spring and has now taken the lead to ensure passage of the Bill through the House of Commons and the Senate within the next year.
PIAC put out a joint press release with the Canadian Marketing Association. In it she insisted that Canadians "need to know that they have rights to control the collection, use, and disclosure of their personal information by those engaged in commercial activities. It’s time to bring our laws into line with technological and market developments; governments should not allow individual privacy to become a casualty of the information age."
This Bill, once passed into law, will have a huge impact on organizations large and small. During the widespread debate and lobbying for the Bill, much of the emphasis has been on the large corporations and those organizations doing business on the Internet. In fact, this has been called the e-Commerce Bill and has this in its title. One of the Bill’s purposes is to create a climate of security and confidence for citizens who go online to engage in e-commerce. Murray Long, a well known Canadian privacy consultant in Canada with his own company in Ottawa, laid out some of the impacts the Bill will have on small business:
"This bill will affect small businesses equally as much as large regulated industries such as banking and telecommunications. Small business operators, especially those engaged in e-commerce, will need to adopt privacy policies equivalent to those of large companies if they expect to gain the confidence of customers. There also will be a snowballing effect as large companies expect their business partners and suppliers to adhere to similar privacy protection policies. The recent decisions by Microsoft and IBM to insist on privacy policies for companies they do business with is evidence of this trend."
This Bill will result in a large cultural change in Canadian society. When the Bill eventually passes into law it will only apply to the federally regulated industries. This includes the banking, telecommunications, transportation and parts of the insurance industry. However, after three years, if the provinces do not pass equivalent legislation, it will also apply to all organizations in those provinces without their own law.
There will also be changes within the oversight bodies, the Federal and Provincial privacy commissioners, who are responsible for handling complaints and appeals from the public under Canadian privacy laws. Quebec has had a privacy law for the private sector since 1993. It has worked fairly well in that province, and proves that the implementation of such laws does not mean that business is going to be impeded or somehow slowed down.
However, the real change will come for the individual citizens who will be the beneficiary of these laws. Under the current, proposed law coming back to Parliament this fall, the Federal Privacy Commissioner is going to have a mandate to educate Canadians about their new privacy rights. This is perhaps one of the most crucial provisions in the whole legislation. For this Bill is about the rights of the individual in relation to the protection of their individual privacy. A right is only as valuable as it is exercised. Thus it will be important to ensure that Canadians are informed of their new privacy rights under this new Act.
On a final note, Canadian Senator Sheila Finestone is currently drafting a private member’s Bill to affirm privacy as a human rights instrument. It is not known when this Bill will be ready or come before the Senate, though it is anticipated to be tabled in the Senate sometime in late spring or early summer. Valerie Steeves, adjunct professor at Carleton University and a well known Canadian human rights and privacy advocate, said that this is a crucial right for all Canadians: "this Bill is an important step because it provides the umbrella legislation which places C-54 and the Privacy Act in a human rights context." This is another indication that privacy continues to play an important part in the Canadian political agenda.
On a wider, international scale it is becoming essential that privacy be enacted as a human right. Current privacy laws are only a finger in the dike trying to hold back the billions of pieces of information now floating around cyberspace. A broad right is needed that is not only enshrined in law but will create a culture around privacy as a human right.
The Europeans recognize that privacy as a human right is implicit in their law but there is no explicit language stating this. Some form of international convention on privacy as a basic human right is needed. Technology has meant a wide-scale loss of privacy in comparison to what we enjoyed just twenty years ago. It is not just our personal information that is being abused. We are subject to almost daily scrutiny of our lives. In most countries now video surveillance cameras are accepted as a way of life to combat crime. Computers can now talk to other computers and, if properly programmed, can exchange information between machines automatically. Computers can monitor every aspect of our online activities. In the work place, electronic monitoring of employees is not unusual. In many corporations it is becoming a standard practice in the name of administrative efficiency. In the industrialized countries there are billions of bits of information shared daily. Citizens often willingly give up their information so they can receive some benefit that a retailer is offering. Geo positioning satellite (GPS) technology can now send email, faxes and messages to our pagers and, now, even to our cars.
British Telecom (BT) is developing a software which will allow the computer to determine if you are under stress or upset. The computer can then automatically stop or filter out email or other electronic messages (such as voice mail) coming to the individual. This technology will sound enticing to the worker trying to cope in today’s frantic environment. But what could start out as a volunteer application of filtering out messages when upset or under stress could turn into another surreptitious surveillance technology. In the industrialized democracies of the world we are heading towards the total surveillance society as citizens eagerly glom onto the latest technological wizardry.
The irony of all this is that it is occurring in democratic societies where only a few seem to be vigilante enough to speak out and to warn the rest of us of the dangers of where we as societies are taking ourselves. In authoritarian and non-democratic countries surveillance technologies are instruments to ensure a compliant citizenry. In many countries attempt to put strict controls on the Internet because they fear the medium and its capacity to allow people to not only express their ideas but to be able to communicate to anyone or anywhere in the world.
All these developments suggest a need for an International Privacy and Human Rights Bill. It is essential that such an instrument be agreed upon as a defense against the darker forces of technology that could erode our basic democratic rights. In a civil society it is crucial that we have such instruments that balance our individual rights against the wider forces that drive society. Perhaps the proposed Canadian Bill of Privacy Rights could be the banner to bring this awareness to the wider world.
Thomas B. Riley, Riley Information Services Inc. Ottawa, Canada.
Thomas B. Riley
President, Riley Information Services Inc.
July, 1999
With author attribution, this document may be freely copied in whole or in part for online
distribution.
Any offline use requires the author's permission.