|
Canadian
Business Faces Countdown to Privacy Law Compliance
With
only a few provinces preparing to enact their own private-sector
privacy protection laws before the New Years Day 2004 deadline,
many Canadian companies outside Québec now have just months
to address the complex task of complying with the existing federal
law. Here are some suggestions on how to start.
Before
this time next year, almost every organization in Canada will have
to comply with either federal or provincial legislation protecting
the privacy of personal information. The first question is which
legislation? The second question is how?
With
the Ontario government preoccupied by an election call for at least
the first part of this year, it is unlikely that the provinces
draft privacy legislation covering the private and healthcare sectors
will be introduced in time to become law by January 1, 2004.
This
means that Canadas federal privacy legislation, the Personal
Information Protection and Electronic Documents Act (PIPEDA), will
automatically take effect in Ontario on New Years Day next
year. It will also become law in the majority of other provinces,
which have made no move to date to enact legislation "substantially
similar" to PIPEDA, as stipulated by the federal law.
As
a result, private sector organizations in every province excluding
Québec (which has had legislation covering the private sector
since 1994) now have only about nine months to comply with PIPEDA
with respect to their customers unless their provincial government
enacts privacy legislation in the meantime. While it is likely Ontario
will not make the January 2004 deadline, British Columbia and Alberta
have indicated they are continuing to draft privacy legislation
for implementation in 2004.
PIPEDA
will not apply to businesses in relation to their employees unless
they are federally-regulated entities (banks, transportation and
telecommunication and broadcasting companies). With the prospect
of provincial privacy legislation applying to employee information
however, many organizations are implementing privacy compliance
now in relation to both customers and employees.
Nine
months isnt a great deal of time to ensure compliance. In
our work with leading Canadian organizations, weve found the
following steps essential to ensure theyre in conformance
with the Canadian Standards Associations Model Code on the
Protection of Personal Information, which is included as an appendix
or "schedule" to PIPEDA.
Step
1: Appoint a compliance team.
The CSA Codes first principle is accountability, which requires
the designation of people who are accountable for compliance. The
team should include marketing, human resources and legal representatives.
Step
2: Assess existing privacy policies.
This involves determining what your organization currently says
about its privacy policies (e.g., on your Website) and ensuring
these existing policies are in compliance with the CSA Model Code
and PIPEDA. Any conflicting or misleading statements should be removed.
Step
3: Adopt a privacy code or policy.
You can adapt the CSAs Model Code to meet your organizations
needs. Your industry association may have already developed a Privacy
Code for use by its member organizations. Bear in mind that your
privacy code/policy becomes your organizations public statement
about its privacy standards. Use your code to develop a privacy
compliance plan.
Step
4: Conduct a personal information practices audit.
This is a demanding process, requiring you to identify, for example,
what personal information is collected about employees and customers,
how it is used, how long its kept and to whom its disclosed.
Step
5: Assess purposes for use and disclosure.
Section 5 of PIPEDA requires that organizations use personal information
only for purposes that "a reasonable person" would consider
appropriate in the circumstances. Note that recent rulings by the
federal Privacy Commissioner have narrowed this definition of reasonable
use.
Step
6: Assess existing information on file.
Remember that individuals will have the right to access their personal
information so its important to take steps to ensure that
information is accurate and (subject to the requirement to keep
information used to make a decision about an individual) to remove
unnecessary or irrelevant information.
Step
7: Identify when, where and what kind of consents are required.
This task involves identifying every process where personal information
is collected about either customers or employees and where it is
used. Then, vehicles for getting consent must be designed, bearing
in mind the sensitivity of the personal information being collected
and the form of consent required (e.g., express consent, opt-out
or implied consent). Also assess whether each consent needs to describe
things such as ongoing use of existing information, how long the
information will be kept, indicate how consent can be withdrawn
and so on.
Step
8: Assess collateral collection and uses of personal information.
If your organization wants to collect information on, say, age or
telephone numbers for marketing purposes or wishes to verify customers
identities by checking addresses or birthdates, ensure these uses
are reasonable and strictly necessary to achieve the purpose. You
also need to make consent for these uses optional. (CSA Model Code
Principle 3.3 prohibits requiring individuals to consent to collateral
collection, use or disclosure of their personal information in order
to obtain goods or services.)
Step
9: Implement organizational protocols.
Formulate and communicate policies and procedures to govern ongoing
accountability, requirements and approvals for all information collection,
use or disclosure as well as for recording consents, security of
customer and employee data, and other factors.
Step
10: Plan for regular compliance audits.
Compliance with policies and procedures can become sloppy a year
after the initial implementation. Determine how your organization
can ensure its practices are up to par on a regular basis.
Copyright permission granted by
Patricia Wilson, The Osler Outlook, 3/24/2003.
Patricia Wilson is a partner in the Litigation Group in Osler,
Hoskin & Harcourt LLP's Ottawa office, practising in the area
of public and administrative law. She has been a partner since 1990.
Pat has appeared before federal administrative tribunals, the Federal
Court of Canada and the Supreme Court of Canada and has advised
and represented many clients in regulatory matters involving federal
and provincial levels of government in Canada.
Pat
has extensive litigation and advisory experience in the access to
information and privacy area, and has advised and represented corporations,
government institutions and the Information Commissioner of Canada
in numerous matters and proceedings under the federal and Ontario
access to information and privacy legislation. She has extensive
experience advising technology companies, retailers, e-commerce
businesses and financial services clients on privacy codes and on
compliance with Canadian privacy laws applicable to the private
sector.
She can be reached by email pwilson@osler.com
or by phone: (613) 787-1009 Fax. (613) 235-2867,
www.osler.com

|