Ottawa Citizen

Privacy finally becomes a right for Canadians starting Jan. 1

JENNIFER DITCHBURN

OTTAWA (CP) - Airlines, cable and telephone companies, banks and scores of other organizations that handle our private information will have a few New Year's resolutions to deal with Jan. 1:

1. Ask customers for permission before we take down their personal information.

2. Tell them why we need it and who's going to see it.

3. Make sure we keep the information safe and protected.

For the first time, protection of personal data will be a right in Canada, and companies whose work is federally regulated will have these and other rules to live by when they collect and use that information.

The Personal Information and Electronic Documents Act was passed this year after years of negotiations, initially designed to instil confidence in electronic commerce.

It will apply to federally regulated work in 2001, to health information used in the private sector in 2002 and to all other organizations by 2004, including commercial businesses.

Federally regulated work includes interprovincial transportation, telecommunications and financial institutions. It will also apply to any organization that transfers personal information files, such as mailing lists or customer profiles, across provincial borders.

"There is so much information about us . . . (that) we have to go through some trouble to ensure that what we want to be private remains private," said George Radwanski, the federal privacy commissioner.

Radwanski has been given an expanded mandate to enforce the act, including the job of spreading the word about the new legislation to businesses and the public.

In a nutshell, the act attempts to give Canadians more control over their personal information by giving them the power to say yes or no to the collection of data about them.

Sometimes consent can be implied, like when a subscription to a newspaper is automatically renewed.

Citizens are also entitled to an explanation of why their data is being collected and how it will be used.

An organization cannot use that personal information for anything but the purpose it originally told the customer about. If it wants to use the data for something else, it has to ask permission again.

A company also has to have a legitimate reason to withhold a service from a client who will not provide the personal information. For example, a cable company could not refuse to provide a service simply because a customer didn't want to provide information for internal marketing purposes.

And there will be legal avenues for people who feel their new privacy rights have been violated.

An individual is expected to take up a complaint with the organization in question first. Banks generally have ombudsmen that deal with problems regarding privacy.

If that doesn't work, the complainant can write to the federal privacy commissioner, who has a year to file a report with recommendations on the case.

The commissioner has a team of investigators who have the power to subpoena witnesses or obtain search warrants when looking into privacy violations.

From there, a person can decide to take the matter even further, to Federal Court, and argue such wrongdoing as humiliation. There is no limit on the amount the court can fine a business or institution.

As with any federal law, there are exceptions.

Members of law enforcement agencies don't always have to ask permission when they go looking for personal information.

Personal information that is collected for journalistic, artistic or literary use is also exempt from the act. And consent is not required for gathering information in a life or death situation.

There's also the matter of health information.

Only medical information gathered for commercial use or by private businesses will be covered by the act.

All of those health records collected by the federal and provincial governments are on the table, and some provinces have already started to eat away at any confidentiality that now exists.

The Ontario government has tabled highly controversial legislation that would allow bureaucrats, police and researchers to use private medical information without the consent of the patient.

Alberta has moved toward similar laws. Organizations including the Ontario Medical Association have cried foul, saying that infringes on the pact of confidentiality between doctors and patients.

In the meantime, Health Canada and its provincial counterparts are discussing how they can share information across borders.

This health "info-structure" is supposed to allow various levels of government to better understand the needs of the population and plan for changes.

But there is no agreement on how far they can go in delving into private medical files.

"If you cannot defend your health information, privacy might as well be written off, because this is the most important information of all," said Darrell Evans, of the B.C. Freedom of Information and Privacy Association.

"It's a joke that they're defending you against the private sector, when they're as much to fear as the private sector. This is the government, and how much information should they have on citizens?"

Privacy advocates say that while they support the federal personal information act, there's still a lot of legislative work to be done to protect Canadians.

Senator Sheila Finestone is set to introduce a so-called Charter of Privacy Rights when Parliament returns this winter, establishing privacy as a human right.

Valerie Steeves, spokeswoman for the National Privacy Coalition, says governments and private citizens need to talk about the impact of the massive collection of personal information on private relationships, the workplace, and society as a whole.

"I need a certain sense of control and autonomy, and one of the ways that we can protect that is if I'm discriminated against . . . I think there should be some remedy for me," said Steeves, who teaches at Carleton University in Ottawa.

"Those processes, whether it's through the Human Rights Commission or the courts, is where society has traditionally worked out the human rights balance."

Radwanski said he's personally committed to keeping privacy on the front burner of political dialogue. With the introduction of the act, he has been given an expanded job description and financial resources to promote public awareness about privacy and the new act.

He said he considers privacy the defining issue of this decade, one that will determine what kind of society Canadians will have in the future.

"If we have to go through life wondering who is monitoring what we are doing, if you have to gauge every action from the point of view of how it would look to some third party . . . we are not really free," Radwanski said.

"That's been the hallmark of totalitarian societies, and we have to make sure that it does not become a characteristic of our Canadian society, however incidentally or accidentally."

-- Rachel Gibson (rgibson@hotmail.com), December 17, 2000