BarTalk April 1999
Volume 11, Number 2

Expect a major impact on Canadian business

by Dr Colin J Bennett

Canadian lawyers should take a very close look at the Federal Government’s new Personal Information and Electronic Documents Act (Bill C-54). Introduced on October 1, 1998, the bill is now being considered by the House of Commons Industry Committee, and is expected to pass into law by June of this year. C-54 stands out (along with the gun control legislation) as one of the only efforts by this liberal government to extend the scope of regulatory activity into previously unregulated areas. So far, however, there has been very little public debate.

C-54 stems from a number of concerns about the ways that the private sector processes personal information. There are consumer concerns about the gradual loss of control over one’s personal data, and the consequent erosion of personal privacy. There are international concerns that Canada’s current incomplete and incoherent legal patchwork will not meet international (and particularly EU) standards for the international flow of personal information. There are business concerns that the lack of privacy protection will reward those free-riders that openly flaunt the attempts at self-regulation by major trade associations.

By far the most significant motivation for the government, however, has been the desire to promote electronic commerce. Evidence suggests that consumers balk at making purchases over the Internet because they are unsure about the security and privacy of their personal information. C-54 is one necessary component of Industry Canada’s efforts to promote e-commerce in Canada, and to “brand” Canada as a safe place to conduct electronic business, in contrast to the United States.

C-54 applies to the federally regulated private sector (banks, telecommunications and transportation companies). More cont-roversially, the federal government has relied on its powers under the “trade and commerce” clause to also cover any organization that collects, uses, or discloses personal information “in the course of commercial activities.” This has been defined as personal information that has commercial value, like a customer list, and that is traded within the Canadian or the international market. The bill also applies to personal information that the organization “collects, uses of discloses inter-provincially or internationally.”

In its efforts to minimize the incoherence, the government has also said that the provisions of Bill C-54 will apply to provincially regulated industries within three years, unless substantially similar legislation is passed in the meantime. At the moment, the only province with such a law is Quebec. C-54 has obviously put the issue of private sector privacy protection more firmly on provincial government agendas than at any time in the past. Unless the provinces legislate, C-54 will apply.

The provisions of C-54 are to be overseen by the Federal Privacy Commissioner who is given a range of investigative, advisory and educational powers, similar to those exercised under the federal Privacy Act. At the end of the day, however, the major sanction at the Commissioner’s disposal is the power to publicize wrong-doing. Experts are currently debating whether this is sufficient.

Initial discussions about C-54 have also centred on the complexities of its scope of application. It contemplates three types of personal information: that covered under C-54, that which will be covered in 3 years time, and that which will not be regulated (such as employee records) because it is not processed as part of a “commercial activity.” One could envisage some large businesses controlling personal information under each of these categories. One could even contemplate personal information that is regulated when it flows inter-provincially or internationally, but unregulated when it resides within a province. The efforts by the federal government to begin the process of developing a uniform set of legislative standards for the processing of personal information were bound to confront the constitutional distinctions between federal and provincial jurisdictions, which of course know nothing of the inter-connected and fast-moving nature of contemporary communications technologies.

Rather than bicker about technological complexities and jurisdictional issues, however, Canadian business would be better advised to embrace the issue of privacy protection and to comply with the basic principles within the legislation, whether their operations are regulated now, or in the future. And there is an easy way to do this.

C-54 is based on the Canadian Standards Association’s Model Code for the Protection of Personal Information, a national standard that was negotiated by business, government and consumer groups from 1992-95. Canada’s most forward-looking enterprises have already developed codes of practice based on this standard. Some have even begun to have their practices certified as being in conformity.

The standard (and the law) merely enjoin some commonsense principles, that all of us, as consumers, would expect the responsible organization to pursue. Be accountable for the personal information under your control. Only collect personal information for specified purposes. Don’t use or disclose it for other purposes without the individual’s consent. Keep personal information accurate and secure. Allow the individual a right to access and correct that information. Be open about your practices, and establish some process for complaints handling and resolution. The complexities of the legislation, the constitutional issues, and the technologies should not obscure the basic point that C-54 largely obliges businesses to do what is in their own commercial interests.

Provincial governments should also embrace privacy protection policy for its capacity to protect consumers and promote the interest of industry, particularly that in the high-tech sectors. Each province obviously needs to debate these issues in a consensual manner with the key stakeholders. But there is little point in re-inventing the wheel. The mechanism for the national harmonization of Canadian legislation is at hand in the form of the CSA’s privacy standard. The principles are common and generally agreed to. Let the debate focus on the methods of enforcement and implementation.

Dr Colin J Bennett is the recent co-author of Visions of Privacy: Policy Choices for the Digital Age (University of Toronto Press, 1999).

Dr Bennett teaches political science at the University of Victoria. He has researched and written on privacy protection issues for around 20 years. He is the recent co-author of Visions of Privacy: Policy Choices for the Digital Age (University of Toronto Press, 1999).

If you want to comment on Bill C-54, we want to hear your opinions. How are these issues affecting you? What issues are missing? What does the CBA need to do in response? What can individual lawyers do?

This article was published in the April 1999 issue of BarTalk and is subject to the copyright by the British Columbia Branch of the Canadian Bar Association, 2005, all rights reserved.