New privacy laws regarding use of personal information – The Law

Reading Time: 3 minutes

Published: February 26, 2004

Have you ever purchased an item and received a manufacturer’s survey card asking for your occupation, your income level, your education and size of family?

Have you ever received a preapproved credit card application with your personal information and wondered how the company obtained it?

When you applied for a loan, did you have to provide personal information on health, employment history and financial information and wonder who will see that information? Have you been asked to provide your social insurance number when applying for an internet hookup?

Read Also

Jared Epp stands near a small flock of sheep and explains how he works with his stock dogs as his border collie, Dot, waits for command.

Stock dogs show off herding skills at Ag in Motion

Stock dogs draw a crowd at Ag in Motion. Border collies and other herding breeds are well known for the work they do on the farm.

All of the above situations are covered by the federal Personal Information Protection and Electronics Documents Act, which has established new rules regarding the collection and use of personal information.

As of Jan. 1, the rules apply to all commercial activity, including the “selling, bartering or leasing of donor, membership or fundraising lists.”

The law came into operation on Jan. 1, 2001, but initially its application was limited to those businesses operating under federal law (banks, airlines) and health information.

The rules require: your consent to the collection of personal information; that you be told why the information is being collected; that you not be required to provide personal information as a condition of supplying a product or service unless a reasonable person would consider the information is necessary; that the information must be kept securely; and that there be an easy means for you to find out what information an organization or business has about you and a procedure to correct inaccurate information.

The act does not specify how consent should be obtained.

However, it says “the form of consent sought by the organization may vary, depending upon the circumstances and type of information. In determining the form of consent to use, organizations shall take into account the sensitivity of the information.” It provides the example of a subscriber list to a newspaper as not being sensitive information.

The act is administered by the federal privacy commissioner (800-282-1376 or www.privcom.gc.ca) which deals with complaints from individuals regarding the collection and use of personal information.

In the first instance, the office will attempt to mediate disputes. However, the commissioner can conduct an inquiry and make findings and recommendations. If the complainant is still unhappy, she can seek a hearing before federal court, which can order that an organization correct its practices, publish a notice of corrective action and award damages.

In rulings to date, the commissioner has decided that requiring a SIN number for internet service was unreasonable but that the requirement of a credit check on a person opening a business account was not. The bank argued that such a check was necessary because small businesses have a high failure rate and pose a high risk of fraud. The commissioner noted that while by law individuals have a right to have banking services, the same was not true of businesses.

Federal law says that if provincial law provides substantially the same protection, then provincial law will apply. In both British Columbia and Alberta, personal information protection legislation came into force on Jan. 1 and there are discussions between privacy commissioners in those provinces and the federal office to develop “a harmonized approach to dealing with privacy complaints in the private sector.”

Quebec has also launched a constitutional challenge to the federal legislation. Generally, matters relating to private commercial transactions have been held to be within provincial jurisdiction.

Current provincial privacy laws in both Saskatchewan and Manitoba make violation of privacy a ground for a civil suit and deal with citizens rights regarding government agencies, but do not specifically deal with the collection and use of personal information.

Don Purich is a former practising lawyer who is now involved in publishing, teaching and writing about legal issues. His columns are intended as general advice only. Individuals are encouraged to seek other opinions and/or personal counsel when dealing with legal matters.

explore

Stories from our other publications