BC outsourcing fight not over yet

The BC union that kicked off the Canadian debate over privacy, outsourcing and the USA Patriot Act has taken their arguments to court, according to ITBusiness. The article doesn't really say what the legal basis of their attempt to derail the government's ousourcing plans are, particularly after the government amended the public sector privacy law:

ITBusiness.ca:

"The British Columbia Government and Service Employees' Union on Wednesday ended the third and final day of a Supreme Court case to block the outsourcing of its Medical Services Plan database management to a U.S. firm.

Union lawyers told the court that privatization of the Medical Services Plan (MSP) would violate the Canada Health Act and potentially jeopardize the privacy of patient data. The province has already signed a $324-million with Reston, Virginia-based Maximus Inc., which will deliver its services through two new Canadian subsidiaries, Maximus BC Health Inc. and Maximus BC Health Benefit Operations Inc. The BCGEU has asked for an injunction that would prevent the partnership from moving ahead until the broader issues in the case can be resolved. The Supreme Court had not made a decision at press time...."

Privacy Commissioner considers USA Patriot Act / Outsourcing complaints against Canadian bank

Not too long ago, the Canadian Imperial Bank of Commerce gave the users of the bank's Visa card notice that processing of account information may take place in the United States, which would make the information accessible to US law enforcement and intelligence officials. This caused a relatively minor stink in the press but did result in a number of complaints to the Office of the Privacy Commissioner of Canada.

Today, the Assistant Commissioner has released her finding related to these complaints and has found that there is nothing in PIPEDA which prevents oursourcing such as this or that requires getting consent for the processing of personal information by third-party service providers. There was some question of whether CIBC appeared to offer an opt-out option. With respect to the cross-border outsourcing issue, there is again no requirement to get consent from the customer. The company has to use contractual means to make sure that the information has a comparable level of protection, but the existence of the USA Patriot Act doesn't mean that you can't have comparable protection in the US. (Canada has similar legislation that has garnered less attention.) Personal information is equally vulnerable to disclosure to law enforcement, whether it is located north or south of the Canada-US border.

The Assistant Commissioner did state that companies that do outsource the processing of personal information are under an affirmative duty to inform their customers. While the customer cannot "opt out" of the outsourcing, they can choose not to do business with the company.

Read the full finding here: Commissioner's Findings - PIPEDA Case Summary #313: Bank's notification to customers triggers PATRIOT Act concerns (October 19, 2005).

Michael Geist has a comment here: Michael Geist - Canadian Privacy Commissioner Denies PATRIOT Act Complaints.

CIPPIC also has a thing or two to say: Privacy Commissioner OKs outsourcing to US.

Canada moves to counter privacy threat posed by U.S. Patriot Act

According to the Canadian Press, the Federal Government is in the final stages of taking contractual steps to limit the access of American authorities to personal information of Canadians. It is worth noting that this appears to apply only to future contacts and that the government is content to include blocking clauses in agreements with contractors, rather than amending the Privacy Act, as has been done in British Columbia:

Yahoo! News - Canada moves to counter privacy threat posed by U.S. Patriot Act:

"OTTAWA (CP) - The government will revamp the wording of future federal contracts with the aim of countering U.S. powers, granted under anti-terrorism laws, to tap into personal information about Canadians.

The move is intended to prevent the U.S. Federal Bureau of Investigation from seeing sensitive Canadian data the government supplies to American firms doing business with federal departments in Ottawa.

The government has also asked all agencies and departments to conduct a 'comprehensive assessment of risks' to Canadian information they release to U.S. companies carrying out work under contract.

The U.S.A. Patriot Act, passed following the Sept. 11, 2001 terrorist attacks, gave the FBI broader access to records held by firms in the United States.

The FBI can apply to a U.S. court to have a company disclose records, including information about Canadians, to assist with investigations involving prevention of terrorism or espionage.

Privacy Commissioner Jennifer Stoddart says that if a federal institution hires a U.S. company to process personal information about Canadians, then American laws apply to the data if the work is being done south of the border.

The federal Treasury Board leads a working group that is now busy finalizing special clauses to be used in future business proposal requests and contracts.

The group is consulting with Stoddart's office on clauses 'that we believe to be fundamental' to include in future request proposals and contracts, says a federal notice recently circulated to departments...."

Nova Scotia Auditor General concerned about effect of USA Patriot Act on citizen privacy

The Nova Scotia Auditor General released his report for 2005 in December. The fourth chapter is entitled Electronic Information Security and Privacy Protection.

In his report, he reviews the privacy and information security practices of a number of departments, including Justice and Community Services. He also touches upon the USA Patriot Act and its possible impact on the personal information of Nova Scotians. Data processing and information storage services for the province are provided by wholly-owned subsidiaries of American companies, which are undoubtedly subject to American laws. The province has carried out a study of the situation, but refused to provide it to the Auditor General, citing solicitor-client and cabinet privilege. In an interview by the Canadian Press, the provincial Minister of Justice hinted that Nova Scotia will be introducing a law in the spring sitting of the Legislature to mirror that passed by British Columbia to better protect personal information from being disclosed to foreign law enforcement.

Read the CP article here: N.S. auditor concerned citizens information could be leaked to U.S. agencies - Yahoo! News.

Technorati tags: privacy ::
Patriot Act ::
Nova Scotia ::
privacy law.

Nova Scotia FOIPOP Review Officer to form Right to Know coalition upon retirement

As reported here on Saturday (The Canadian Privacy Law Blog: Nova Scotia's FOIPOP Review Officer to step down), Nova Scotia's Freedom of Information and Protection of Privacy Review Officer will be stepping down from his post on January 23, 2006 when his term concludes. Today's Halifax Chronicle Herald reports on the retirement and mentions that Darce will not be disappearing into the sunset. He is planning to start a "Right to Know" coalition to educate people about access to information laws and to lobby for greater openness. See: Freedom of information protector leaving his post:
Fardy plans to start citizens coalition called Right to Know

Technorati tags: privacy :: access to information ::
nova scotia.

Nova Scotia's FOIPOP Review Officer to step down

I've just received a nice note from Darce Fardy, the Nova Scotia Freedom of Information and Protection of Privacy Review Officer. (Roughly the province's equivalent of a privacy commissioner, though most of his time is spent on the access side of his mandate.) His Order-in-Council expires on January 23, 2006 and he has decided not to re-up for any further term. He will stay on in an interim capacity until his successor is appointed.

Darce began his career as a journalist and found himself as the Head of Network Television Current Affairs before he switched gears to the access and privacy file. He has also worked with the United Nations in New York.

On a personal note, I have to say that he has been great to work with. He's a true gentleman and I've always found him to be very willing to see both sides of an issue.

Anybody who knows him knows that he is a "true believer" that access to information is among the most important levers that holds a democratic government accountable to citizens. I think it must be a thankless task and he has lamented in the past that a citizen's right of access to information is not sufficiently well known. His suggestions for reforms of the province's access to information laws have been generally ignored by the parties in power, but he plans to continue to "spread the gospel", as he has called it, after his retirement.

For more info, you can check out the FOIPOP Review Office website.

Enjoy your retirement and all the best, Darce.