What’s mine is mine, and what’s yours is…?
By Rob Brickman
For Canadians to be passionate about a given subject, one of three conditions must be in place: hockey must be in-volved; a union must have incented us to be outraged; or the public service (or a politician) must have exhibited more than the usual degree of ineptitude. In all other cases, as my late father would remark, Canadians tend to “burst a blood vessel with apathy”.
I was reminded of this during the highly public and embarrassing ex-change between an elderly and disabled Canadian veteran seeking help from the Member of Parliament for Scarborough Southwest, Tom Wappell. You may recall that Wappell’s response to the inquiry demonstrated a shocking callousness to his constituents, particularly those who had voted for a different candidate.
Most observers noted that Wappell’s behaviour was cynical and reprehensible. But what captured the minds of Canadians in the first days of this story (until it was proven otherwise) was the insinuation that the privacy of the electoral process had been somehow compromised. How did this MP know how the gentleman had voted?
This groundswell of interest in electoral privacy issues was somewhat surprising since individual Canadians have been so quiet about privacy issues in the private sector. This is not to say, however, that businesses have been inactive.
For the past eighteen months, certainly since the Personal Information and Electronic Documents Act became active at the beginning of the year, many of my clients have been struggling with protection of information and the duty of care they have in protecting the personal privacy of others. In the months before the legislation was enacted, a number of my clients were outspoken and eloquent in their defense of rights to personal privacy. But they were also concerned about the impact on their business.
The Act, previously known as Bill C-6, deals with the protection of personal information that is collected, used or disclosed in the private sector. Personal information is defined as “information about an identifiable individual” such as race, ethnic origin, colour, age, marital status, religion, education, address, phone number, medical, criminal, employment or financial history — even tissue and biological samples! Both federal and provincial legislation exists to protect personal information in the public sector. Interestingly, perhaps frighteningly, MPs are exempt from many of these latter provisions.
Phased in over the next three years, the Act stipulates ten privacy obligations that organizations must meet and offers an overall requirement that an individual’s consent must be obtained before his or her personal information can be collected, used or disclosed. Moreover, personal information can only be used for the purposes for which it is collected — otherwise a new statement of consent must be obtained.
This legislation came at a critical juncture in the evolution of e-business in Canada. Those of us who tracked Bill C-6 through the legislative process read compelling submissions from organizations with a stake in privacy issues. Consumer and personal privacy advocates focused on informed consent, controls, precision, enforcement and education. The business sector focused on the possible restraints to trade and the possibility that a two-tier privacy environment might be created.
The Canadian Pharmacists Association pointed out a potentially interesting outcome of the Act that references the increasingly blurred line between the public and private sectors. They observed that public drug plans in Canada would be exempt from the provisions of the Act since provincial governments provide them. In other words, a patient receiving a prescription paid for by private insurance would be subject to Bill C-6 and the pharmacist would be required to obtain express consent to use and disclose information for a number of clinical, financial and administrative purposes. Whereas patients with a prescription paid for by the Ontario Drug Benefit Plan would not fall under the bill and informed consent would not be needed.
We’ll revisit this complex and fascinating topic in more detail in a later issue.
Rob Brickman, C.A. is a principal in the e-business Strategy & Change Practice for the Financial Services Sector at IBM Canada Ltd. Rob can be reached at firstname.lastname@example.org
SETTING THE MOOD FOR PRIVACY
Industry Canada’s Electronic Commerce in Canada. A good Primer on the Act. (ecom.ic.gc.ca/english/privacy/632d30.html).
The Privacy Commissioner of Canada (www.privcom.gc.ca) and the Privacy Commissioner of Ontario (www.ipc.on.ca). Excellent content on current privacy initiatives.
On the advocacy front, the Media Awareness Network at www.media-awareness.ca/eng/issues/ priv/privacy.htm.
For US issues, see the mother of all privacy sites, the Electronic Privacy Information Center (EPIC) at www.epic.org.