The Information and Privacy Commissioner of Alberta, Frank Work, has authorized a company to ignore access requests as being vexatious. PIPA allows the Commissioner to authorize a company to ignore such requests. In this case, the individual had been involved in fifteen years of litigation with Manulife (the applicant). The company said it had no other information on the individual that had not already been handed over as part of the discovery process. The report of the Commissioner is availble here: http://www.gov.ab.ca/acn/200512/19181.pdf.
Showing posts with label pipa. Show all posts
Showing posts with label pipa. Show all posts
Alberta Commissioner authorizes an organization under PIPA to disregard an access request.
Alberta bar to continue scanning IDs despite Commissioner's advice not to
The saga related to the scanning of IDs in Alberta bars continues. The Gauntlet, a University of Calgary student publication, reports that the bar in question is planning to ignore the Information and Privacy Commissioner's recommendation by continuing to use the Secureclub system. The investigation by the IPC will likely continue and may culminate with an order under the Personal Information Protection Act of Alberta in the new year. In the meantime, the univeristy pub is going ahead with using the technology. See
Gauntlet News - Private info or no beer.
For some background on this complaint and the issue generally:
Admissibility of video surveillance evidence
The use of video surveillance has come under increased scrutiny in recent years, prompted mostly by new privacy laws such as PIPEDA and the western provinces' PIPAs. To insurance lawyers, the most important question is what impact do these laws have on the admissibility of video surveillance evidence.
The only published court decision on this point, Ferenczy v. MCI Medical Clinics, 2004 CanLII 12555 (ON S.C.), may be interpreted to hold that a violation of PIPEDA does not render video evidence inadmissible (but it could be much more clear):
"[35] For all of the foregoing reasons I conclude the evidence here in question was not collected, recorded, used or disclosed in contravention of the Act. However, as I indicated earlier in these reasons, the evidence is in any event relevant and its probative value exceeds its prejudicial effect. Its admission into evidence would not render the trial unfair and it is, in my view, admissible at trial in any event at trial."
Johannes Schenk recently wrote about a BC arbitration decision in which the arbitrator decided that a violation of that province's Personal Information Protection Act would render the resultant evidence inadmissible. From paragraph 58 of IN THE MATTER OF an Expedited Arbitration Between EBCO Metal Finishing Ltd. and International Association of Bridge, Structural, Ornamental & Reinforcing Iron Workers, Shopmens' Local 712, [2004] B.C.C.A.A.A. No. 260:
... The PIPA is clearly intended to apply to the employment relationship. The authority of the legislation would not be given effect were an employer to breach its provisions and be permitted to rely on the unlawfully obtained evidence anyway. For an arbitrator in British Columbia to admit the evidence in such a case would amount to error of law and abdication of jurisdiction.
Aribral decisions have little precedential value, particularly outside the particular province, but this highlights that this issue has not entirely been put to rest.
Alberta Commissioner welcomes substantially similar finding
Following the finding by the federal cabinet that the Personal Information Protection Act (Alberta) is "substantially similar to PIPEDA, the Alberta Information and Privacy Commissioner, Frank Work, has released the following statement:
Commissioner welcomes substantially similar finding:"Edmonton, October 26, 2004
Commissioner Frank Work today welcomed news that Industry Canada has found Alberta's Personal Information Protection Act (PIPA) substantially similar to the Federal Personal Information Protection and Electronic Documents Act.
The substantially similar finding means the provincial law rather than the federal law governs the collection, use and disclosure of personal information by private sector organizations in Alberta. Personal information in the custody or control of private sector organizations as it relates to commercial transactions or activities will be subject to the Act. Personal employee information is also covered by the PIPA.
"This is good news. It gives businesses in Alberta some certainty as to which law governs," says the Commissioner. "The finding enables my Office to make arrangements with the Privacy Commissioner of Canada to coordinate our efforts so that we do not have two Commissioners knocking on the same door, with respect to the same issue," adds the Commissioner.
The PIPA allows the Commissioner to review the decisions of private sector organizations to deny an individual access to their own personal information, or to refuse a request for correction to their own personal information. Individuals may also make a complaint to the Commissioner if they believe their personal information has been collected, used or disclosed without proper authority or without their consent.
The Information and Privacy Commissioner is an independent Officer of the Legislature. The Commissioner's mandate includes overseeing the access and privacy provisions of the Freedom of Information and Protection of Privacy Act, the Health Information Act, and the Personal Information Protection Act."
Commissioner releases report concerning collection and security of credit information
From the Alberta Information and Privacy Commissioner's Office:
Commissioner releases report concerning collection and security of credit information:"Commissioner Frank Work authorized an investigation under the Personal Information Protection Act ("PIPA" or "the Act') after receiving a complaint alleging that SAS Institute Canada ("SAS") Inc. collected personal credit information in contravention of the Act.
The complainant had applied for a job with SAS as an Administrative Assistant/Receptionist. During the recruitment process, she signed a consent authorizing the organization to obtain a credit inquiry report; however, she subsequently complained that the organization's collection of her personal credit information was not reasonable. She was also concerned about the security of her personal information held by the organization contracted by SAS to conduct background checks.
SAS advanced the following purposes for collecting the complainant's personal credit information during the recruitment process:
- To assess the applicant's suitability to manage petty cash.
- To minimize the risk of employee corporate credit card fraud.
- To validate employment history by identifying past employment listed in a credit report but not described on the applicant's resume.
The investigator found that the personal credit information collected by SAS was not reasonably required to establish an employment relationship because:
- The organization had less intrusive and likely more effective means to assess the complainant's ability to manage petty cash, including contacting previous employers;
- The complainant had not yet applied for a corporate credit card, and so the information was not required at this stage to minimize the possibility of fraud; and,
- The organization had less intrusive and more effective means to validate the complainant's employment history.
The investigator found that the organization's purposes of collecting personal information to assess suitability to manage petty cash and validate employment history were reasonable; however, the extent of the collection was excessive for meeting those purposes. Further, the organization's collection of personal information to minimize the risk of corporate credit card fraud was not a reasonable purpose considering the complainant had not yet applied for a corporate credit card.
The investigator also found that SAS had implemented reasonable measures to ensure that personal information collected on its behalf is safeguarded as required under the Act.
Prior to this investigation, SAS had taken steps to bring its practices into compliance with privacy legislation; however, the organization agreed to refine its hiring practices and implement the following recommendations:
- Review the responsibilities of a position when hiring to ensure that credit information is reasonably required to determine a candidate's suitability.
- Where credit information is reasonably required, clearly state the purpose(s) for collection.
- Where credit information is reasonably required, clearly state in all job postings/advertisements that a credit check may be required of the successful candidate.
SAS was cooperative throughout this investigation and demonstrated a commitment to ensuring the protection of privacy."
Alberta and British Columbia privacy laws declared to be substantially similar
The federal cabinet, on October 12, 2004, issued two very important orders, exempting organizations in Alberta and British Columbia from the application of PIPEDA: the provincial private sector privacy laws have been declared to be substantially similar to the federal law. Therefore, PIPEDA does not apply to the collection, use and disclosure of personal information by provincially regulated organizations that occurs within Alberta and British Columbia. (Surprise! PIPEDA will apply if you disclose it across provincial borders.)
PC2004-1163 relates to the Personal Information Protection Act (Alberta) and PC2004-1164 relatesto the Personal Information Protection Act (British Columbia). Both orders are long awaited. Neither have been "Gazetted", but they are effective on the date of registration, which was October 12, 2004.
(A big thanks to Michael R. Whitt, of Borden Ladner Gervais in Calgary, for sending me copies of the exemption orders ... and for his contribution to the privacy roundtable that Eloise Gratton and I moderated at the Canadian IT Law Association annual conference in Calgary this past week.)
Alberta Commissioner finds three businesses failed to protect personal information from identity thieves
The Alberta Information and Privacy Commissioner has released three investigation reports, castigating three Alberta businesses for failing to protect personal information from identity thieves.
Investigations find Alberta businesses failed to protect personal information from identity thievesRecent investigations by the Office of the Information and Privacy Commissioner (OIPC) found that three Alberta businesses failed to protect personal information in their custody.
On November 24, 2004, Edmonton Police Service (EPS) notified the OIPC that documents containing personal information from a number of Alberta businesses were found during a police investigation. Some of the records were found in a motel room; others were subsequently turned over to police by two individuals charged with credit card fraud. The records included return of goods slips, debtor account files from a collection agency, and cell phone contracts. Personal information in the records included Social Insurance Numbers, bank account information, credit card numbers, and customer signatures.
In response to the information from EPS, Information and Privacy Commissioner Frank Work initiated investigations of Linens ‘N Things, Nor-Don Collection Network Inc., and Digital Communications Group Inc., under the Personal Information Protection Act (PIPA).
PIPA applies to private sector organizations in Alberta, and requires them to protect personal information against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction.
The investigators found that these businesses failed to protect personal information in their custody.
Recommendations from the investigations required all three organizations to contact the individuals whose information was, or may have been, exposed to identity theft. In at least one case this meant contacting hundreds of customers. Additional recommendations required the organizations to:
- ensure all records containing personal information are stored securely,
- limit access to personal information to staff on a “need-to-know” basis,
- develop procedures for storage, retention and destruction of personal information, and
- provide privacy and security training/awareness for employees.
One organization was also required to obtain computer equipment to obscure credit card numbers printed on receipts and return slips. Along with the affected individuals, these three businesses were victimized in these incidents, but each is responsible under PIPA for securing personal information.
The OIPC is advising other businesses not to put themselves in the same situation.
To obtain a copy of an Investigation Report, click the following links:
Investigation #P2005-IR-001 http://www.oipc.ab.ca/ims/client/upload/P2005_IR_001.pdf (Linens ‘N Things)
Investigation #P2005-IR-002 http://www.oipc.ab.ca/ims/client/upload/P2005_IR_002.pdf (Nor-Don Collection Network Inc.)
Investigation #P2005-IR-003 http://www.oipc.ab.ca/ims/client/upload/P2005_IR_003.pdf (Digital Communications Group Inc.)
Canadian government proposes regulations to require disclosure of employee data without consent for policing employment insurance program
Human Resources and Skills Development Canada has proposed amendments to the Employment Insurance Regulations to ensure that HRSDC has access to employee payroll information to detect fraud and abuse of the Employment Insurance Program. The National Post has a large front page story on this, saying that the fraud detection program has been on hold for nine months because of fears of transgressing federal and provincial privacy laws. I would have suggested that this information collection without consent was already allowed under PIPEDA, the Alberta Personal Information Protection Act and BC's Personal Information Protection Act. Better to be safe than sorry ...
"REGULATORY IMPACT ANALYSIS STATEMENT
Description
The purpose of the proposed amendment to the Employment Insurance Regulations is to ensure that earnings verification programs conducted by Human Resources and Skills Development Canada (HRSDC), formerly Human Resources Development Canada, in cooperation with employers, satisfy the requirements of federal and provincial legislation pertaining to the disclosure of personal information.
As of January 1, 2004, subsection 7(3) of the federal Personal Information Protection and Electronic Documents Act (PIPEDA), applies to employers who fall under federal jurisdiction (i.e. airlines, banks, interprovincial transportation, radio and television broadcasting or telecommunications industries). Under the Act, these employers may not disclose personal information about an employee to HRSDC without the employee's consent unless HRSDC can demonstrate that it has the lawful authority to obtain this information. In addition, Quebec, British Columbia and Alberta have enacted privacy protection legislation requiring HRSDC to have lawful authority before it can obtain employee information from private sector employers in those provinces without employee consent. Similar legislation is being developed in other provinces.
With the implementation of the above-mentioned privacy legislation, regulatory clarification is required to ensure the ongoing functions of two verification programs administered by the Employment Insurance (EI) program: the Automated Earnings Reporting System (AERS) and the Report on Hirings (ROH) Program. These voluntary programs involve the comparison of EI claim files with current employee information provided to HRSDC by employers. HRSDC's lawful authority to obtain this information needs to be made explicit as a result of PIPEDA implementation. The AERS and ROH programs are currently under suspension (since January 1, 2004) and will be reinstated once the Regulations comes into effect.
Both the AERS and the ROH programs were developed in the late 1970s following recommendations made by stakeholders representing employers and employees. The level of participation has been considerable among employers because these programs are cost-effective and they help to alleviate the significant paper burden of requests for payroll information employers would otherwise receive.
Employees working for participants of AERS and the ROH benefit because the overpayment of EI benefits is minimized keeping financial hardship for the claimant to a minimum if repayments are required. This also means that subsequent administrative penalties or prosecutions are less likely because HRSDC is aware of the problem at the outset. As well, deterrence is achieved by encouraging participating employers to advise their employees that they participate in the AERS or ROH program. HRSDC provides employers with posters and inserts for use in informing employees that they share payroll and hiring information with HRSDC.
The proposed Regulations safeguards the privacy of Canadian workers and at the same time, it reduces the potential for making EI payments to claimants who are not lawfully entitled to receive them. The only information available to HRSDC that is collected from the verification programs, is information matching employees subject to an overpayment.
AERS and ROH are early intervention measures and serve as major deterrents to fraud and abuse of the EI program. HRSDC considers the use of regular and ongoing verification programs as crucial control mechanisms that assist HRSDC in meeting its obligations with respect to sound management practices and its fiduciary responsibility under the Employment Insurance Act.
To support the continuation of these voluntary verification programs, it is proposed that section 55.1 of the Employment Insurance Regulations be added to make explicit that HRSDC has the lawful authority to obtain employee information on a continuing basis. The information to be collected will include information in respect of the date of commencement of employment, duration of employment, amounts earned and reasons for separation from employment. It will apply to employers who (a) hired or recalled ten or more employees in a twelve-month period or expect to do so in the upcoming twelve months or (b) were required to issue ten or more records of employment in a twelve-month period or expect to do so in the upcoming twelve months.
...
Consultation
This proposed regulatory amendment was prepared by Human Resources and Skills Development Canada's Employment Program Policy and Design in consultation with Insurance Program Services, Investigation and Control, Legal Services and Privacy and Access to Information. External consultations have taken place with Industry Canada which is responsible for PIPEDA and the Department of Justice which agreed to the intent of the Regulations and drafted the wording. The Office of the Privacy Commissioner was also consulted during the developmental stages. The Employment Insurance Commission (including the Commissioners for Workers and the Employers) approved the Regulations in principle on November 14, 2003.
Compliance and enforcement
Existing compliance mechanisms contained in HRSDC's adjudication and control procedures will ensure that these changes are properly implemented. ..."
Alberta Commissioner slaps computer reseller for not wiping returned hard-drive
The Information and Privacy Commissioner of Alberta has just chastised a large retailer for reselling a computer without wiping the hard-drive. You've got to have a policy and consistent practices. The retailer has promised to address this issue in every province in Canada, not just Canada. See: Investigation Report P2006-IR-001.
World Tracker turns anyone into a cellphone spy
Engadget is pointing to an intersting service from the UK that appears to let you track the cell phone of your employee, spouse, mistress, next victim, etc. via a handy Google maps internet interface.
World Tracker turns anyone into a cellphone spy - Engadget:Forget those piddly wiretaps. The next frontier in warrant-free surveillance is upon us, and it's open to everyone. A UK service called World Tracker apparently uses cell tower data (or GPS, when available) to track the location of just about any GSM cellphone. Just enter the number you want to track into the service's handy Google Maps-based interface, and you'll be able to zoom in on the device's location, with accuracy somewhere between 50 and 500 meters. The first time you try to track a phone, a text message is sent to the owner, who must reply in order to enable tracking (we'll leave it to you to figure out how to work around this if you need to track a spouse, kid or employee). The service is currently compatible with O2, Vodafone, Orange and T-Mobile in the UK, and has plans to expand to other markets including Germany, Spain, Norway and the US. If, that is, privacy advocates don't shut it down first.
I checked out the site. The most appealing bit is the ability to be alerted when your loved one has strayed beyond the "geo fence" that you've set for her. Sign me up.
Hmm. What'll they think of next?
And if they have any expansion plans into Canada, they'll need to know that location based information is personal information and -- thanks to PIEPDA and PIPA -- it can only be collected and disclosed with consent.
Upcoming conference: Personal Information Protection Act Conference 2006: April 26-27 2006, The Westin, Calgary, Alberta
Both the Information and Privacy Commissioners of Alberta and BC are sponsoring and participating in an upcoming conference in Calgary. As you can guess, "PIPA 2006: Customers, Employees & Privacy: An educational Forum for Business" is about business and the private sector privacy laws of both provinces. Check out the site, from Verney conference management: Personal Information Protection Act Conference 2006: April 26-27 2006, The Westin, Calgary, Alberta.
Tasmanian public sector privacy law goes into effect today
Tasmanian readers take note: The Personal Information Protection Act of 2004 comes into effect today, regulating how the public sector handles personal information: Personal Information Protection - Judy Jackson, MHA - Tasmanian Government Media Releases.
Happy birthday to the Canadian Privacy Law Blog
It's hard to believe that I've been at this for two years. On January 2, 2004 I did the first posting to this blog (The Canadian Privacy Law Blog: Welcome to the Canadian Privacy Law blog). At the time, I was concerned that I wouldn't have the attention span to keep it going for the long term. Now, two years and 1711 posts later (more than two a day), I'm pleased with how it has all turned out. I've met some pretty incredible people through the blog. This summer I had a surreal experience when a stranger recognized me in an elevator and asked if I was "the guy with the privacy website."
At the time, some people thought that privacy was just the flavour of the day and all the hubub would blow over. Either PIPEDA would be declared to be unconstitutional and business would go back to normal or business and healthcare would come to a grinding halt. None of that came to pass. PIPEDA and the PIPAs are completely manageable. Very few reputable companies had much to change; mostly, compliance was putting policies, procedures and accountability in place to support their existing practices. Some had to fine-tune their practices and I'm generally impressed with the number of companies that are recognizing privacy issues and are seeking professional counsel.
I expect the year ahead will also be interesting on the privacy front. PIPEDA will come under review in the federal Parliament and there is much work to be done to clarify the law and make it more manageable. For consumers, privacy continues to be a strong priority and the growth of identity theft makes their concerns all the more acute. The PIPEDA review will bring that concern front and centre. I'm waiting to see whether the legislators will take any action to address this. Some provinces, such as Ontario, may look again at provincial privacy laws of general application. Other provinces may follow Ontario's lead and implement health privacy laws that will harmonize the rules in the public and private healthcare settings. And I am sure that we'll continue to hear about more and more privacy/security breaches, mostly from the US states where laws require disclosure.
For this blog, my plan is to keep it up. The blog's reason for being is to be a useful resource on privacy developments in Canada and elsewhere. I'd be delighted to hear what changes readers would like to see in the year ahead to make it more useful. Please feel free to leave a comment or drop me a note by e-mail: david.fraser@mcinnescooper.com.
Also a special thank-you to the many people over the last two years who have sent me links to privacy-related articles and have pointed out typos.
Happy new year!
Posts
