CIPP/C Flashcards
What is the Right to Be Let Alone?
-1890
-Two famous American scholars advocated that society need to recoginize a privacy right
-Defined that right as “the right to be let alone”
-Occurred with the advent of the modern press and the ability to publish news in mass-distributed newspapers
What are the 3 (Main) Classes of Privacy
Information privacy
Privacy of the person
Territorial privacy
What is Information privacy?
One of three classes of privacy
Defined as “the claim of individuals or groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.”
Information’s protection is predicated on the assumption that all information about a person fundamentally belongs to them, for them to communicate or retain as they see fit.
By law is concerned with establishing rules that govern the collection and handling of PI (can include FI, medical data or other records)
Definitions of privacy include
Privacy has been defined as the desire of individuals to choose freely the circumstances and degree to which they expose their attitudes and behaviours to others
Been connected to the human personality and considered a means to protect an individual’s independence.
The right of the individual to be protected against intrusion into his personal life or affairs or those of his family by direct physical means or by publication of information
What is privacy of the person?
Protects bodily integrity, and in particular the freedom from physical contact that would reveal objects or matters a person wishes to conceal.
Bodily privacy is focused exclusively on a person’s physical body; invasions to this class of privacy include genetic testing, drug testing and body cavity searches.
What is Territorial privacy?
Concerned with placing limitations on the ability
of an individual or organization to intrude into another individual’s physical environment.
Original notion was founded on the principle that “the house of everyone is to him as his castle and fortress.
Invasion of an individual’s territorial privacy typically comes in the form of physical search of premises, video or audio surveillance, ID checks and similar intrusions.
3 Canadian Perspectives on Privacy
Privacy of the individual vis-à-vis the state
Privacy of the individual vis-à-vis other individuals.
Privacy of the individual vis-à-vis organizations
Privacy of the individual vis-à-vis the state
One ponders the extent to which an individual is free to live their life without the state interfering or knowing what the individual is doing
Privacy of the individual vis-à-vis other individuals.
One examines to what extent an individual can live life free from intrusion from another individual, such as a neighbour, coworker, spouse, parent or child.
Privacy of the individual vis-à-vis organizations
One looks at the extent to which organizations can collect, use and disclose personal information about an individual, and once they have collected such information, what obligations they have.
What are the 5 World Models for Data Protection?
Comprehensive Laws (Canada, European Union)
Sectoral Laws (United States)
The Self-Regulatory Model (United States, Japan and
Singapore)
Seal Programs
The Technology-Based Model
Describe the Comprehensive Laws (Canada, European Union) Model
These laws govern the CUD of PI in the public and private sectors
Country that has comprehensive data protection laws has an official/agency responsible for overseeing enforcement - called a DPA, but in Canada a commissioner/ombudsperson - ensures compliance with law and investigate alleged breaches of the law
Official also bears responsibility for educating the public on data protection and acts as an international liaison for data protection issues
What are 2 critical issues with the Comprehensive Law Model?
Enforcement and funding are two critical issues in a
comprehensive data protection scheme.
What can the movement toward comprehensive privacy and data protection laws be attributed to?
The need to;
(1) remedy past injustices,
(2) promote electronic commerce, and
(3) ensure consistency with pan-European laws
Describe the Sectoral Laws (United States) Model
This framework protects PI through the enactment of laws that specifically address particular industry sectors
Often are used as a complement to comprehensive laws to provide more specific protection for particular data.
What are 2 major drawbacks with the Sectoral Laws Model?
Technological Relevance
- b/c this model requires new legislation to accompany the introduction of new technologies, legislation often lags the technology that needs to be regulated
Oversight
-model lacks a central agency and a federal privacy mandate to provide oversight
Describe the Self-Regulatory Model (United States, Japan and Singapore)
Requires companies to abide by codes of practice as set by a company or group of companies as well as by industry and/or independent bodies to protect data
What are two major issues with the Self-Regulatory Model (United States, Japan and Singapore)?
Adequacy of codes of practice set by
companies and industry bodies
Enforcement.
Under the Self-Regulatory Model (United States, Japan and Singapore), what has happened b/c industry-developed codes provide limited data protection and are
coupled with weak mechanisms for enforcement?
Several coalitions and independent organizations have established codes of practice and seal
programs.
What is the Online Privacy Alliance?
A coalition of numerous online companies and trade associations specifically established to encourage the self-regulation of online privacy.
What did the Online Privacy Alliance introduce?
Guidelines for Online Privacy Policies
Who created the Guidelines for Online Privacy Policies and what occurs under them?
Online Privacy Alliance
Under these guidelines, OPA members agree to post a privacy policy that informs users about how their information is collected and used.
Notably, the guidelines do not provide for enforcement and instead encourage members to establish enforcement mechanisms independently.
What are Seal Programs?
Certifications and attestations provided by third parties
Is a prominent form of self-regulation
A seal program requires its participants to abide by codes
of information practices and adhere to some variation of monitoring to ensure compliance.
Companies that abide by the terms of the seal program are then allowed to display the program’s privacy seal on their websites.
Examples of such programs are TrustArc (formerly TRUSTe), BBBOnline, WebTrust, and the Digital Advertising Alliance (DAA).
Describe the Technology-Based Model
Technological security measures can be undertaken to ensure the protection of individuals’ personal data.
Developments in commercially available hardware and
software have enabled consumers to establish privacy protections for their own online activity.
Examples: Digital Cash and Encryption
What type of state is Canada?
Federal state
What are Canada’s three levels of government?
Federal, Provincial and Municipal
What are the two chambers of Parliament?
House of Commons -members elected in general elections held every four years
Senate - members are appointed
What type of system is used throughout Canada at the federal and provincial levels?
Parliamentary
How does a bill become law?
Must be approved by both the House of Commons and the Senate
What members are in the legislative branch?
House of Commons and the Senate
What do members of the legislative branch do?
Introduce, debate and pass bills and policy
Play a role in the oversight of the executive branch
Appoint officers of Parliament (i.e. the Federal Privacy Commissioner)
Describe the Judiciary Branch
Headed by the Supreme Court of Canada
Made up of a network of federal and provincial courts that hear and decide criminal and civil matters across the country
What act makes the federal gov responsible for issues such as criminal law, banking, national defence, and importantly for the topic of privacy protection - trade and commerce?
Constitution Act of 1867
Based on what legislation does the federal govt regulate privacy in Canada?
Constitution Act of 1867 - trade and commerce
What areas do provinces have jurisdiction over?
Provinces are responsible for such areas as hospitals, education, provincial courts and municipalities.
For provinces, what area of jurisdiction is thought to include privacy rights?
Property and civil rights
What is the role of the court in Canada?
Interpret laws
Review laws and government actions to ensure rights and freedoms are upheld
Judicial review - review of gov’t decisions (limited to review of such decisions for specific types of errors)
What are the role of administrative tribunals?
Interpret laws
Can enforce Charter rights
vehicles of the executive branch and are organized to administer specific programs with a certain degree of expertise
What are Charter Rights?
Charter rights are those created by the Canadian Charter of Rights and Freedoms.
Are constitutional rights and thus considered the most valuable rights in Canada
What is the Federal Privacy Commissioner misunderstood to be?
An administrative tribunal
What is the Federal Privacy Commissioner an officer of?
Officer of Parliament
Why must the Federal Privacy Commissioner table annual reports to Parliament outlining work accomplished and conclusions reached?
Is an Officer of Parliament, not a not a member of the executive branch of government, and is therefore accountable directly to the legislature.
What provinces use common law?
All except Quebec
What is a common law system?
In common law systems, laws are found in statutes (bills that have been introduced, debated and passed by the legislative branch of government) and in case law.
Accordingly, the judiciary’s role is instrumental in the development of law because this “judge-made” law is on equal footing with any statute-based law.
What is a civil law system?
In civil law jurisdictions, laws are are codified into a civil code, which obviates the need to search through judicial decisions to determine what laws exist.
What are 4 sources of Canadian law?
Legislation
Common Law
Contracts
Constitution and the Charter
What federal legislation imposes rules regarding PI?
The Privacy Act
What 3 things does the Privacy Act do?
Imposes rules that govern the government’s collection,
use and disclosure of personal information.
Provides for a right of access to PI
Sets up the OPC to oversee and enforce the Privacy Act
What is the name of the legislation that each province has that is similar to the Privacy Act typically referred to?
Freedom of Information and Protection of Privacy, though each law has slightly different approaches
What legislation governs the private sector?
Personal Information Protection and Electronic Documents Act (PIPEDA)
What organizations are excepted from PIPEDA?
Private sector organizations that that are subject to substantially similar legislation to PIPEDA passed by a province.
Which (4) provinces have substantially similar legislation to PIPEDA?
Personal Information Protection Act in
Alberta (“Alberta PIPA”)
Personal Information Protection Act in British
Columbia (“BC PIPA”)
Act Respecting the Protection of Personal Information in the Private Sector in Quebec (“the Quebec Act”),
Personal Health Information Protection Act in Ontario (PHIPA)
What is common law often referred to as?
Judge-made law because it is derived over time from the various rulings, decisions and interpretations made
by judges who hear the cases that are brought before them.
Judge-made law that protects privacy in Canada is in its infancy
Has there been any Supreme Court decisions that have endorsed a tort-based privacy right?
One Supreme Court of Canada decision from the late 1990s upheld a plaintiff’s claim for damages b/c a photograph of her was used on a magazine cover.
Have there been any court decisions that have endorsed a tort-based privacy right?
Ontario Court of Appeal recognized the tort of intrusion upon seclusion in Jones v Tsige in 2012
What is part of the problem with the advancement of privacy as a right protected in tort law?
Traditionally, the notion of privacy was well protected by more traditional interests such as trespass and nuisance
What are contracts?
Private laws created by parties who agree to be bound by certain terms
What do contracts do with respect to privacy?
Privacy rights can be created and protected by contracts when the parties to the contract agree to respect the confidentiality and security of the information they become privy to b/c of the contractual arrangement or other discrete terms within the contract, such as privacy or security terms.
Often occur within a commercial or employment context
When are contracts most often used?
In outsourcing situations where one party provides personal information under its control to another party. The receiving party is often asked to be contractually bound to protect that PI and to keep it properly safeguarded.
How does the Canadian Charter of Rights and Freedoms protect privacy?
Applies only to government action; private litigants would not be able to base a claim for breach of privacy against anyone other than a government entity
Section 7 of the Charter states that “everyone has the right to life, liberty and security of the person and the right not to be deprived thereof except in accordance with the principles of fundamental justice.” While there is no mention of the word privacy, there is an emerging body of case law that supports the view that Section 7 serves as a source of constitutional protection of the right to privacy.
Section 8 of the Charter states: “everyone has the right to be secure against unreasonable search or seizure.”
When is section 8 of the Charter used?
In the criminal and administrative context to prevent government authorities from violating privacy rights while gathering evidence, conducting investigations or conducting
administrative functions (such as inspecting food-packaging plants).
Triggered when the state interferes with an individual’s reasonable expectation of privacy and when such interference itself is found to be unreasonable.
In what context does contracts and tort-based privacy rights arise?
Between private parties and unless settled privately are enforced through the courts
In what context does Charter-based privacy rights arise?
In actions against the government?
Who oversees legislated rights to privacy protection under the Privacy Act and in PIPEDA?
OPC
Who oversees legislated rights to privacy protection in provinces where there is not a commissioner?
Ombudspeople
When is a privacy investigation by the OPC launched?
Only after a complaint is lodged- though sometimes the commissioners themselves can commence complaints.
What happens after the OPC completes an investigation?
Renders a report and matter may proceed to court.
What is a “de novo” hearing?
A brand new hearing.
Privacy in Canada is protected by rules and principles that govern what?
What governments and organizations can do with PI
What is the catalyst for any privacy issue?
A determination that the type of information being
discussed is indeed personal information
What is PI considered to be?
Any identifiable information about an individual
What is an example of what is not PI?
purely corporate information (e.g., trade secrets, confidential business info, or nonidentifiable info belonging to groups of people) is not PI, and such info is not protected by Canadian privacy laws (although non-privacy laws may apply)
Why is it important to determine which provincial or federal act a particular issue falls under?
B/c each provincial or federal law will have its own definition of PI
What information does the Privacy Act apply to?
To information under the control of federal government institutions
What PI does the Privacy Act apply to of note? Why is this important?
Privacy Act considers opinions about an individual to be the
personal information of that individual.
This important b/c it means that privacy laws provide a right of access to one’s own PI. Eg. if Jones has expressed an opinion about Smith that was documented, Smith can discover it by making a request to see his own personal information. Under the Privacy Act, not only can Smith see the content of the opinion about himself, but he will often be allowed to know the identity of the opinion holder as well. This is b/c the identity of the opinion holder is considered the PI of both the opinion holder and the opinion subject.
What is one stumbling block across Canada regarding the interpretation of PI?
The difficulty of interpreting the meaning of “about” as it is used in the phrase “about an identifiable individual”
What did the Supreme Court say about the Privacy Act’s definition of PI?
Definition is undeniably expansive.
Language is deliberately broad and entirely consistent with the great pains that have been taken to safeguard individual identity.
Its intent seems to be to capture any information about a specific person, subject only to specific exceptions.
What has the expansive definition of the term PI under the Privacy Act been used for?
To justify finding that many categories of info, regardless of whether the info is sensitive, private, innocuous or well-known are PI
Notably used by some judges to conclude that job-related info fall sunder the definition of PI and thus merits some protection under privacy legislation
When can information by itself that does not identify an individual be PI?
When if, in combination with other information, it could be used to identify an individual
Eg. In 2008, the federal court determined that data regarding the provincial location in which medical patients were treated was personal information because such data, when coupled with other available data, could lead to the identification of individual patients. In In adopting a new test to determine what should be considered PI, the court provided that “information will be about an individual where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information.
Why do most laws provide exceptions to the definition of PI?
Public policy reasons
To recognize that while some data might otherwise be considered to be about an identifiable individual, there is a public policy reason for not treating it as such.
Eg. information about public-sector employees
Under PIPEDA, how is PI defined?
Information about an identifiable individual.
Similar to the Privacy Act’s definition - intentionally broad and expansive interpretation
Who does PIPEDA apply to?
Applies to every organization that “collects, uses or discloses PI in the course of commercial activities” or “is about an employee of the organization and that the organization collects, uses or discloses PI in connection with the operation of a federal work, undertaking or business.
In the business context, what information is treated differently by PIPEDA?
An employee’s business contact information is treated differently in that it is said not to apply to an organization in respect of the business contact info of an individual that the organization collects, uses or discloses solely for the purpose of communication or facilitating communication with the individual in relation to their employment, business or profession.
This also includes an individual’s work cell phone records.
Under PIPEDA, what other context is caught by its definition of PI?
Health context
What does one of the most widely debated arguments in Canadian privacy law concern?
Whether separate laws ought to exist for employee information and work product information
What is employee info. often thought of and defined as?
“‘personal employee information’ means, in respect of an individual who is an employee or a potential employee, personal information reasonably required by an organization that is collected, used or disclosed solely for the purposes of establishing, managing or terminating:(i) an employment relationship; or,(ii) a volunteer work relationship between the organization and the individual but does not include personal information about the individual that is unrelated to that relationship
What is work-product info. generally thought of?
Information about an individual that is related to that individual’s position, functions and/or performance of their job.
What information does PIPEDA not differentiate between?
Regular personal information and employee-related information or work-product information.
What information does the Privacy Act carve out from its definition of PI?
Carves out some employment and work-product-related information
What is a common reason for not protecting PI?
Where the PI is publicly available.
Which provinces attempt to deal with the question of employee-related PI?
BC and AB by defining it.
How does the Privacy Act deal w/ publicly available PI?
Provides that a government’s restricted ability to use and disclose personal information does not apply if the information is publicly available.
However, the government’s obligations to collect the
information in accordance with the act are not affected by whether the info. is available
No definition in the Privacy Act to help guide users as to what is and is not considered publicly available.
What information does the Privacy Act provide a total exception to?
Any information that is found in a “library or museum material preserved solely for public reference or exhibition purposes; or material placed in the Library and Archives of Canada, the National Gallery of Canada, the Canadian Museum of Civilization, the Canadian Museum of Nature or the National Museum of Science and Technology by or on
behalf of persons or organizations other than government institutions.
How does PIPEDA treat publicly available info?
Generally, PIPEDA requires the knowledge and consent of an individual before collection, use or disclosure of personal information can take place.
However, PIPEDA states that an organization may collect, use or disclose personal information without the knowledge or consent of the individual if the personal information is publicly available and is specified by the regulations.
For the purposes of PIPEDA, it is a fact-specific inquiry as to whether info is found to be “publicly available”.
What are some general principles of PIPEDA compliance regarding publicly available information that have arisen from Canadian Courts?
Merely because an individual appears in public does not mean they “automatically forfeit” their “interest in retaining control over the personal information which is thereby exposed
For an organization to be exempted from the consent requirement, the personal information must be both publicly available and specified by the regulations
The exception to the consent requirement does not apply to the organization that initially collects the information for the purposes of subsequently making it publicly available.
How is more information meeting the criteria for publicly available?
With the advent of online social networking and the
ability to find info about individuals easily via the internet, more info is meeting the criteria for publicly available.
What does the law often dictate when making determination about whether private and sensitive information can be released?
The info. can only be released if doing so would not be an unreasonable invasion of privacy.
What is one of the most influential principles in the development of Canadian privacy law?
The Organisation for Economic Co-operation and Development (OECD)’s set of 8 privacy principles entitled “Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.”
What did the Canadian Standards Association do?
Broke the OECD’s code into 10 principles that were incorporated as a schedule to Canada’s private-sector privacy law, PIPEDA and formed the basis of the principles of the Canadian Standards Association.
What are the CSA’s principles called?
the “Model Code for the Protection of Personal Information” (“Code”)
Why did the CSA develop the “Model Code for the Protection of Personal Information”?
Developed in order to assist with finding a balance btw legitimate business interests and the individual right to privacy.
Who influenced the CSA’s “Model Code for the Protection of Personal Information”?
Was influenced by a committee concerned with protection of privacy in Canada.
What are the CSA’s 10 principles?
Accountability
Identifying Purposes
Consent
Limiting Collection
Limiting Use, Disclosure and Retention
Accuracy
Safeguards
Openness
Individual Access
Challenging Compliance
What does the CSA’s Accountability principle require?
An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles.
What does the CSA’s Identifying Purposes principle require?
The purposes for which PI is collected shall be identified by the organization at or before the time the information is collected.
What does the CSA’s Consent principle require?
The knowledge and consent of the individual are required for the collection, use or disclosure of PI, except where inappropriate.
What does the CSA’s Limiting Collection principle require?
The collection of PI shall be limited to that which is necessary for the purposes identified by the organization.
What does the CSA’s Limiting Use, Disclosure and Retention principle require?
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.
What does the CSA’s Accuracy principle require?
Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
What does the Canadian Standard Association’s Safeguards principle require?
Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
What does the CSA’s Openness principle require?
An organization shall make readily available to individuals specific info about its policies and practices relating to the management of PI.
What does the CSA’s Individual Access principle require?
Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
What does the CSA’s Challenging Compliance principle require?
An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization’s compliance.
Who developed the Generally Accepted Privacy Principles (GAAP)?
Jointly developed by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA)
Who is meant to use the Generally Accepted Privacy Principles (GAAP)?
The GAPP are meant to be used by any organization involved in the handling of personal information.
These principles were established to help businesses navigate the competing interests of business, government and consumers.
How is each principle in the Generally Accepted Privacy Principles (GAAP) supported?
Each principle is supported by “objective and measurable criteria” available in the full text of the document
What are the 10 principles of the Generally Accepted Privacy Principles (GAAP)?
Management
Notice
Choice and consent
Collection
Use, retention and disposal
Collection
Use, retention and disposal
Access
Disclosure to third parties
Security for privacy
Quality
Monitoring and enforcement
What is private-sector privacy legislation in Canada based on?
The 10 fair information principles found in Schedule 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA)?
What same basic tenet of the privacy principles as they apply to organization’ handling of PI does both Canadian and international privacy laws follow?
The Accountability principle.
What is the Accountability principle?
An organization:
- Must implement procedures that protect PI
- Establish procedures to receive and respond to complaints or questions
- Train staff
- Be transparent about all these procedures and practices
The obligations under the Accountability principle more often than not culminate in what document?
A privacy policy
What is a privacy policy?
A document that tells customers, potential customers, employees and any other individuals who might have their PI collected, used or disclosed by the organization what the organization’s PI-handling practices are.
What does the Accountability principle require?
An organization to appoint individuals with primary responsibility for privacy protection.
Makes organizations responsible for the PI over which they have either custody or control.
For ex. if an organization outsources some functions and the outsourced entity will have access to the PI collected by the organization, the organization must ensure that the 3P is contractually bound to the organization in a manner that provides adequate protection for the PI.
What case is an example of how the Accountability principle has been interpreted that arose?
Google Inc’s release of Google Buzz - a social networking tool that automatically draws upon contact information from a user’s Gmail account, adding certain contacts as “followers” and thereby revealing potentially sensitive user information.
As a result, the data protection commissioners from around the world called on Google and all large social media
companies to be more accountable for the information they control.
What is the Identifying Purposes principle?
The obligation of organizations to identify and document the purposes for the collection of any personal information at or before the time of collection.
When is the Identifying Purposes principle breached?
If personal information is collected for a different purpose then the individual’s privacy has been violated and the principle breached.
What must an organization do if subsequent to the collection and original identification of the purpose for the collection, the organization wishes to use the personal information for a different purpose?
It must procure new consent after the new purpose is communicated to the individual.
What challenges does the Identifying Purposes principle create for organizations?
To describe their purposes in ways that are precise enough to provide valuable information to individuals but broad enough to include potential future purposes so they don’t need to obtain consent every time they identify a new use for PI.
What is the Consent principle?
The general principle states that an organization may collect, use or disclose PI only if an individual consents.
What does the Identifying Purposes principle often lead organizations to do?
State purposes for use in a broad manner (i.e. be as vague and as broad as possible).
What is paramount to the concept of consent?
That it be informed and meaningful.
What does it mean that consent be informed and meaningul?
This requires the individual to know and understand the purposes for the C, U or D of the PI.
What is sensitive PI?
Sensitive PI is information that is more significantly related to the notion of a reasonable expectation of privacy (e.g. medical or financial info., also pieces of info that, if procured by the wrong individuals, could result in serious cases of identity theft, might also be considered sensitive PI).
Why is the Consent principle flexible?
Acknowledging that different situations require different standards.
When can organizations rely on implied consent?
When the PI being collected is innocuous and the purpose of the collection straightforward.
When are opt-out options for consent permitted?
When the PI being collected is innocuous and the purpose of the collection straightforward.
When are opt-in consent options required?
When the PI is sensitive, explicit and
documented.
What does the Consent principle require that organizations not do as a condition of the supply of a product or service?
Require an individual to consent to the
collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purpose.
For example: a customer entering
her favourite electronics store to buy AA batteries cannot be required to share her address as a condition for her transaction, as it is neither related or necessary.
What does the Consent principle give each individual the opportunity to do?
Withdraw consent
Regarding consent, what do organizations need to peform because of the difficulty and complexity of managing PI holdings?
The need for many organizations to perform periodic privacy audits to ensure the required consents are being obtained and documented.
What are privacy audits or assessments?
Exercises performed internally or by independent third parties to ensure that an organization holds personal information in compliance with the various privacy obligations to which the organization may be subject and with internal privacy standards established by the organization, such as commitments specified in an online privacy notice for customers.
Why is the Consent principle under considerable strain?
The opaque nature of the privacy policies that are the basis of consent, complex
information flows, and business processes that involved a multitude of 3P intermediaries.
In this complex and rapidly changing digital environment, it can be exceedingly difficult for consumers to determine exactly what info they are sharing and with whom.
What does the Limiting Purposes principle require?
Requires organizations to collect only the amount and type of PI legitimately needed to fulfull the identified purpose.
Requires that organizations not collect PI indiscriminately or beyond the scope of services provided.
What does the Limiting Use, Disclosure and Retention principle require?
This principle requires that “personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.
PI shall be retained only as long as necessary for the fulfillment of those purposes.
What principle prevents organizations from collecting PI by misleading individuals or being less than candid about the purpose of the collection?
The Limited Purposes principle
What notion is aligned with the Limiting Use, Disclosure and Retention principle?
The notion that collection of excess PI can become a potential liability for an organization, requiring the protection and destruction of information that was not needed in the first instance. For these reasons, it is important that organizations carefully consider the information required to fulfil the purposes they have outlined.
What does the Limiting Use, Disclosure and Retention principle require once the purpose for the C, U or D of the PI has been fulfilled?
This principle directs an organization to destroy the PI. This requires organizations to address the issue of retention schedules beforehand and to develop guidelines and procedures for the adequate destruction of PI at the appropriate time.
What are two important points to remember about retention regarding the Limiting Use, Disclosure and Retention principle?
(1) PI that has been used to make a decision about an individual should be retained long enough to allow the individual access to the information after the decision
(2) An organization may be subject to legislative requirements with respect to retention periods for certain types of information.
What does the Limiting Use, Disclosure and Retention principle provide little practical guidance on?
The time and manner of destruction of PI.
What is the specific implementation of the Accuracy principle heavily dependent on?
The context surrounding the collection, use, disclosure and type of PI.
What is the Accuracy principle?
The principle that obliges organizations to keep personal information as “accurate, complete and up-to-date as is necessary for the purposes for which it is being used.”
What is idea behind the Accuracy principle?
That organizations should make sure the
information they are using to make decisions about providing credit or medical
care to people is accurate in order to avoid inappropriate decisions or ill-fated
consequences.
What does the Accuracy principle not always require that organizations do?
Keep information up to date (unless such a process is necessary to fulful the purposes for which the info was collected).
What does the Safeguards principle require of security safeguards adopted by organizations?
Must protect PI against loss or theft as well as unauthorized access, disclosure, copying, use or modification. This obligation transcends media, applying equally to paper-based and electronic data.
What makes it difficult for the Safeguards principle to be implemented?
The complexity surrounding the technology of information holdings.
The rapid rate of technological change, which complicates any conclusion about whether a particular safeguarding method is sufficiently secure.
What type of PI must be encrypted according to the Safeguards principle?
Sensitive PI stored on any mobile device or information that can be accessed or transmitted across public wireless networks.
How should information be protected with respect to sensitivity according to the Safeguards principle?
The sensitivity of the information, such that financial or medical info should receive greater security protection than address info.
What does the level of encryption depend on according to the Safeguards principle?
Sensitivity of the information
Cost-benefit analysis of the various technological solutions
System performance.
What does the Safeguards principle imply the obligation for organizations to create?
Procedures and practices that formalize the manner in which personal information will be kept safe, in particular the appropriate level of security applicable to the sensitivity of the PI, often called “data classification.”
What does the Openness principle require organizations do?
Make readily available to individuals specific information about their policies and practices relating to the management of PI.
How are policies generally made available because of the Openness principle?
Because organizations must be open about their policies and practices with respect to the management of personal information, these policies are generally made available electronically on websites and on paper at the customer service point of interaction.
What does the Individual Access principle require?
Organizations must be able to respond to requests from individuals for access to their personal information.
What obligations does the Individual Access principle incorporate?
This principle incorporates such obligations as the requirement to inform individuals of the existence, collection, use and disclosure of PI. Moreover, if an individual reviews their information and find inaccuracies, the organization must be prepared to record this appropriately.
When responding to requests for access what must an organization not do under the Individual Access principle?
An organization cannot unduly delay
What obligation are organizations generally under regarding the Individual Access principle?
Obligation to assist individuals trying to access their own personal information by being helpful and providing the information in a user-friendly format.
What does it mean, practically, that an organization must provide because of their obligation to assist individuals trying to access their own PI?
Organizations provide information from inside a database via a printout that
includes explanations for any codes contained in the database.
What does the Individual Access principle recognize?
That access to PI will not be required or desirable in every instance.
What is the most common exception for refusing access to PI?
Information protected by solicitor-client privilege.
What is the Challenging Compliance principle?
Individuals should have an ability to challenge the organization’s PI-handling practices.
When did PIPEDA come into force?
Jan. 1, 2001
Why was PIPEDA passed?
The Act was passed as part of the government’s electronic commerce strategy - a policy initiative reportedly motivated by the desire to make Canada a world leader in electronic commerce.
Before PIPEDA, what was Canada’s approach to privacy legislation largely based on?
Industry self-regulation
How are provincial organizations exempted from PIPEDA’s application?
If the organization is otherwise subject to a provincial law that has been declared “substantially similar” to PIPEDA.
What are two key concepts that must be properly understood with respect to the application of PIPEDA?
(1) The first is a matter of determining whether an organization is involved in a commercial activity.
PIPEDA applies to every organization that “collects, uses or discloses personal
information in the course of commercial activities”
or
(2) Whether the organization operates as or in connection with a federal work or undertaking.
“is about an employee of
the organization and that the organization collects, uses or discloses in connection
with the operation of a federal work, undertaking or business.”
How is PIPEDA unlike any other federal statute?
PIPEDA was drafted to apply across the country; however, the federal government explicitly invited the provincial governments to occupy their own fields of responsibility and pass their own privacy laws.
In what circumstances does PIPEDA permit organizations to collect, use or disclose PI?
(1) Only for purposes that a reasonable person would consider appropriate in the circumstances.
It places a heavy burden on an organization to be prepared to demonstrate that it is always acting reasonably in its treatment of PI.
(2) Only with consent.
What is PIPEDA’s applicability based on?
The constitutional limit to the powers of the federal government in Canada.
In support of this argument is the fact that PIPEDA applies only to organizations involved in commercial activities. The basis for this limitation is that the federal government’s jurisdiction rests on its power to regulate trade and commerce across the entire country. PIPEDA’s application to employees of organizations connected to or operating as federal works and undertakings rests on its constitutional ability to regulate industries that operate at a federal level (such as telecommunication companies, railways and airlines).
Under PIPEDA, when is consent valid?
PIPEDA states that consent of an individual is only valid if it is reasonable to expect that the individual would understand the nature, purpose and consequences of the collection, use or disclosure of their PI (unless PIPEDA permits otherwise)
What was hoped that the term “substantially similar’ would result in?
A greater alignment of federal and provincial private-sector privacy laws.
What 3 things are required in order for a provincial law be found to be substantially similar to PIPEDA?
(1) Must be consistent with the schedule for PIPEDA
(2) Has an independent oversight body like the OPC
(3) Contain a redress mechanism for those who are aggrieved
What provincial laws have been found to be substantially similar to PIPEDA?
Alberta’s Personal Information Protection Act (“Alberta PIPA”)
British Columbia’s Personal Information Protection Act (“BC PIPA”)
Quebec’s Act Respecting the Protection of Personal Information in the
Private Sector (“the Quebec Act”
Ontario’s Personal Health Information Protection Act of 2004
(PHIPA)
New Brunswick’s Personal Health Information Privacy and Access Act
(PHIPAA), with respect to personal health information custodians
Newfoundland and Labrador’s Personal Health Information Act (PHIA), with respect to personal health information custodians
Nova Scotia’s Personal Health Information Act (PHIA), with respect to health information custodians
What does PIPEDA define commercial activity to mean?
“any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling,
bartering or leasing of donor, membership or other fundraising lists.
What type of inquiry does determining whether an organization’s collection, use or disclosure of PI occurs during a commercial activity require?
A fact-specific inquiry.
How does the Office of the Privacy Commissioner of Canada (OPC) interpret the term “commercial activity”?
Quite broadly.
Who did the OPC determine operates outside of any commercial activity?
Nonprofit associations (presumably including unions) and private schools
However, the OPC has determined that even though an organization may be nonprofit and membership-based, it can still engage in commercial transactions that trigger PIPEDA.
What are important obligations imposed on all organizations under PIPEDA?
The requirement of obtaining consent and the obligation to act reasonably when doing so.
Right to provide access to PI.
Under PIPEDA, when does an organization not need to provide access to PI?
When doing so would reveal:
-info about a 3P, for specified national security or law enforcement reasons;
-solicitor-client privileged info;
-commercially sensitive info;
-info gathered as part of a formal dispute resolution mechanism; or
-info collected w/o consent b/c the organization was investigating a breach of agreement or law and obtaining consent would have compromised the availability or integrity of that info.
What is a common misconception about organizations in litigation with individuals?
That these organizations do not need to respond to requests for access to PI. The OPC has made it clear that the obligation to provide access to PI cannot be circumvented by the fact that the organization is involved in litigation with the same individual.
Under PIPEDA, what can organizations recover from individuals when providing access to PI?
Cost recovery. This is limited b/c organizations must respond to requests for PI at minimal or no cost to the individual. Thus, OPC has found that any type of flat fee would likely not be acceptable.
What is the role of the OPC?
The OPC is responsible for the enforcement of the act and is comparable to that of an ombudsperson.
What can an individual do if they believe their rights under PIPEDA have been violated by an organization?
Complain to the OPC.
What powers does the OPC have?
Investigate complaints under PIPEDA (are conducted in private)
Can initiate a complaint if there are reasonable grounds for doing so.
Power to subpoena and compel the giving of evidence
In April 2011, what was PIPEDA amended to provide the OPC with?
Enhanced powers regarding the conduct of investigations. Under 12(1), OPC may decline to investigate a complaint in certain circumstances. Under 12.2(1), the OPC may discontinue an investigation in certain circumstances.
What happens after the OPC completes an investigation?
A report is issued that details the findings and recommendations. The OPC report is nonbinding on the organization and rarely does the OPC name the organization.
What can the OPC do if an organization does not implement the recommendations contained in a report?
The OPC can apply to the federal court to request a court order enforcing the implementation of recommendations.
What does PIPEDA empower the OPC to do where the OPC has reasonable grounds to believe the organization might be violating PIPEDA?
Conduct an audit. At the end of the audit, the organization is given a nonbinding report (and OPC is not granted the power to initiate a application in federal court if an organization refuses to implement the recommendations contained in an audit report).
What is one of the key responsibilities of the OPC related to?
Education and awareness.
In 2015, how was PIPEDA amended?
By passage of the Digital Privacy Act (DPA).
What new provisions did the Digital Protection Act introduce into PIPEDA?
- Breach Notification and Record-keeping Requirements
- Updated definitions
- Update to Consent
- Compliance Agreements
- Public Interest Disclosures
What Breach Notification and Record-keeping Requirements are now required of organizations under PIPEDA because of the Digital Privacy Act?
Organizations will be subject to mandatory notifications to the OPC of any breach of security safeguards involving PI.
For breaches where there is a “real risk of significant harm to individuals” the requirement mandates notification to individuals.
Organizations must keep a record of all breaches involving PI and provide a copy to the OPC upon request.
Organizations that knowingly fail to report to the OPC or notify affected individuals of a breach that poses a real risk of significant harm, or knowingly fail to maintain a record of all breaches, could face fines up to $100K.
How has the definition of PI and business contact info been updated under PIPEDA because of the Digital Privacy Act?
PI - updated to mean info about an identifiable individual.
Business contact info - updated to include any info that is used to communicate or facilitate communication with an individual in relation to their employment, business or profession.
How has consent been updated under PIPEDA because of the Digital Privacy Act?
Consent is considered valid only if it is reasonable to expect that individuals to whom an organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting. `
What are the exceptions to the consent requirement for collection, use or disclosure under PIPEDA because of the Digital Privacy Act?
Investigations/fraud detection and prevention
Business transactions
Witness statements in insurance claims
Identifying injured, ill, deceased,; communicating with next of kin
Financial abuse
Employment relationships in federally regulated workplaces
PI produced in the course of employment, business or profession
What agreements can the OPC enter into now under PIPEDA because of the Digital Privacy Act?
Compliance agreements aimed at ensuring organizations comply w/ PIPEDA.
When is a compliance agreement reached between the OPC and an organization under PIPEDA?
Where the OPC believes, on reasonable grounds, than an organization has committed, is about to commit, or is likely to commit an act or omission that could constitute a contravention of PIPEDA, or a failure to follow a recommendation in Schedule I to the act.
Under a compliance agreement with the OPC, what does an organization agree to do?
Take certain actions to bring itself into compliance w/ PIPEDA.
What can a compliance agreement preclude the OPC from doing?
Commencing or continuing a court application under PIPEDA with respect to any matter covered by the agreement.
What can the OPC do if an organization fails to live up to commitments in a compliance agreement?
After notifying the organization, the OPC could:
(1) apply to the court for an order requiring the organization to comply with the terms of the agreement, or
(2) commence or reinstate court proceedings under PIPEDA, as appropriate.
What has changed with respect to Public Interest Disclosures under PIPEDA because of the Digital Privacy Act?
PIPEDA’s confidentiality provisions continue to apply, but the scope of what can be disclosed in the public interest has been broadened.
OPC may now make public any information that comes to its knowledge in the performance or exercise of its duties or powers under PIPEDA if it deems that doing so is in the public interest.
Previously, this discretion applied only to information “relating to the PI management practices of an organization.”
What is the Alberta Personal Information Protection Act and the British Columbia Personal Information Protection Act?
Both are considered to be substantially similar legislation to PIPEDA and therefore organizations that are subject to these acts are exempt from PIPEDA.
Apply to the CUD of PI by the private sector
Provide a right of access to one’s own PI
Set up an oversight body to which individuals can complain
What is notable about the Alberta PIPA and BC PIPA?
These acts apply to the CUD of PI of individuals in employment and noncommercial contexts.
What is the striking difference between the Alberta PIPA and BC PIPA, and PIPEDA?
Why is this difference important?
Alberta PIPA and BC PIPA apply to employee PI.
This is important b/c w/o provincial legislation filling the gap, the only employees afforded any privacy protection in Canada would be those of organizations that operated as, or in conjunction with, federal works or undertakings.
What are the consequences of information falling under the definition of personal employee information?
Data such as work contact information is clearly not afforded the same degree of protection.
Under Alberta PIPA and BC PIPA, what can employee PI be collected without?
Consent, if the collection is reasonable for the purposes of establishing, managing or terminating an employment relationship between the organization and the individual.
What term is not used or defined in PIPEDA? What has this failure allowed for?
Work product.
Allows for some ambiguity at the federal level, with a blurry distinction between i) work product, ii) business information and iii) contact information.
As a result, the extent to which work product and PI overlap remains unclear.
What does the OPC deem about an employee’s work product?
While the OPC recognizes hat an employee can produce unprotected work-generated information, it currently deems PI that may be work product as subject to the act and suggests work-product issues be addressed on a case-by-case basis.
How does BC PIPA treat an employee’s work product?
Excludes “work product” from PI treatment, thereby removing this information from protection under the act.
How does the Alberta PIPA treat an employee’s work product?
Similar to PIPEDA, it does not address work product or employee-generated information.
What overarching obligation does the AB and BC PIPAs have like PIPEDA?
Obligation to act reasonably.
Also, the 10 overriding principles found in the schedule to PIPEDA are all encapsulated in these laws.
What are two driving principles behind the AB and BC PIPAs?
Consent - before an organization can CUD PI , it must ensure that it has the requisite consent or that the situation is one that allows for nonconsensual CUD
Individuals have a right of access their PI and a right to correct inaccurate information.
What is one important provision that provides greater specificity found in AB PIPA?
Deals w/ professional regulatory bodies - for these entities, the AB PIPA allows organizations to establish PI codes ad thereafter abide by the code instead of all the obligations imposed by PIPA.
What is the definition of a code under the AB PIPA?
A set of rules governing the CUD of PI in a manner that is consistent with the purposes and intent of the AB PIPA.
Under which law is there mandatory breach notification - AB or BC PIPA?
AB PIPA - organizations are required to notify the OIPC of AB when a privacy/security breach results in a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure of their PI.
What is the body that oversees the AB and BC PIPAs called?
The OIPC - these commissioners are given very broad and powerful powers of investigation. They investigate complaints.
What is an important difference between the federal and provincial commissioners?
Provincial commissioners have the power to order an organization to take an action (under PIPEDA, the federal commissioner only has the power to recommend that an organization take an action.
What is the privacy legislation called in Quebec?
Act Respecting the Protection of Personal Information in the Private Sector (the Quebec Act)
What is probably the most difficult part of the Quebec private-sector privacy legislation for people outside of Quebec to understand?
The unique nomenclature used. Eg. organizations are called “enterprises” and disclosures are referred to as “communications”.
What does the Quebec Act apply to?
Applies to every enterprise that collects, stores, uses or communicates PI about a natural person to third parties.
To which legislation is an organization’s obligations in Quebec virtually identical to?
Those under PIPEDA, as the laws are substantially alike.
What is a notable difference between the Quebec Act and PIPEDA?
The Quebec Act’s provision dealing with the communication of PI outside of Quebec.
This provision, which is very similar to the way European data protection laws operate, provides that an enterprise in Quebec can disclose PI to a 3P outside of Quebec only if it is first satisfied that
-info will not be used for purposes not relevant to the object of the file or communicated to 3Ps w/o the consent of the personal concerned
-in the case of marketing lists, that the persons concerned have a valid opportunity to refuse to allow their PI to be used for commercial purposes
What is an intriguing aspect of the Quebec Act?
Is its specific code, which reflects close consultation between the lawmakers and the direct marketing industry.
What is the oversight body for the Quebec Act?
“the commission” - has the obligation of hearing and deciding cases related to the application of the provisions concerning access to or rectification of PI or cases dealing w/ marketing lists.
Has broad powers of inquiry and can order an organization to comply with its orders
Decision can be appealed but its findings of fact are final.
What is Canada’s Anti-Spam Legislation?
Introduced on Jul. 1, 2014, is considered the toughest anti-spam law in the world.
What is Canada’s Anti-Spam Legislation intended to foster?
The growth of electronic commerce by deterring certain practices that undermine the value of the internet as a medium for commerce.
What did Canada’s Anti-Spam Legislation establish rules for?
Sending of commercial electronic messages (CEM)
Installation of computer programs
Prohibits the unauthorized alteration of transmission data.
What does Canada’s Anti-Spam Legislation apply to?
Applies to:
-all forms of electronic messaging, including email, SMS test messages, and messages sent via social networking.
-any CEM that is sent from or accessed by a computer system located in Canada.
-senders of CEMs from Canada, as well as to those who send messages into Canada from other countries.
-nonprofit organizations and registered charities (however there are exceptions under the Income Tax Act)
What 3 obligations do organizations that send CEMs have under Canada’s Anti-Spam Legislation?
Obligations relating to consent, identification and unsubscribing:
Under Canada’s Anti-Spam Legislation, must be obtained from the recipient before a CEM is sent?
Consent
What is an organization’s obligation regarding express consent under Canada’s Anti-Spam Legislation?
Express Consent - when requesting express consent, senders cannot consent on behalf of the end user.
Moreover, silence or inaction on the part of the end user cannot be construed as providing express consent. (e.g. a prechecked box cannot be used, as it assumes consent).
Express consent must be obtained through an opt-in mechanism, as opposed to opt-out. This mechanism must prompt the end user to take a positive action in order to indicate their consent.
Under Canada’s Anti-Spam Legislation, how can an organization obtain express consent?
Consent can be obtained either in writing or orally. In both cases, the onus is on the sender of the CEM to prove it has in fact obtained consent in order to send the CEM.
Under Canada’s Anti-Spam Legislation, when can an organization rely on implied consent?
Consent may be implied in 4 circumstances:
1) Sender and recipient have an existing business relationship.
2) Sender and recipient have an existing nonbusiness relationship.
3) Recipient has conspicuously published their electronic address (e.g. on a website) and has not expressly stated that they do not wish to receive unsolicited messages. The message must be related to the recipient’s professional capacity.
4) Recipient has disclosed their electronic address directly to the sender and has not expressly stated that they do not wish to receive unsolicited messages. The message must be related to the recipient’s professional capacity.
What are senders of CEMs required to do under the CASL?
Clearly identify themselves.
if the message is sent on behalf of another person, that person must be identified as well. When a CEM is sent on behalf of multiple persons, all these persons must be identified in teh CEM; this specifically includes persons that play a material role in the sending of the CEM.
Under the CASL, what can senders do when it is not practical to include identification information for multiple persons?
Senders can include a hyperlink to a web page containing this information. Link must be clearly and prominently set out in the CEM and the web page must be readily accessible at not cost to the recipient of the CEM.
Under the CASL, what record must a sender of CEM keep?
Sender must demonstrate that it had the proper consent (implicit or explicit) to send CEMS to recipients. This also includes demonstrating adequate consent where the sender is relying on the existing business or nonbusiness relationship.
Under the CASL, what must every CEM contain?
A functional unsubscribe mechanism that enables the recipient to unsubscribe at no cost.
This must include an unsubscribe link that is functional for a minimum of 60 days.
Unsubscribe requests must be processed without delay and in no event more than 10 days after the request has been made.
An unsubscribe mechanism must be ‘readily performed” - it should be simple, quick and easy for the end user.
What organization enforces the CASL?
The CRTC
Under the CASL, what penalties can CRTC impose?
Administrative monetary penalties (AMPs) for violations of CASL of up to $1M per violation for individuals and $10M per violation for other persons (or businesses).
What happened in the Blackstone Learning Corp case?
CRTC found that Blackstone committed multiple violations including sending CEMs w/o consent through nine campaigns and targeting Canadian provincial and federal employees.
CRTC found that Blackstone did not demonstrate that it had received consent to send the messages at issue.
CRTC issued a $50K AMP
What is the largest fine that can be issued under PIPEDA?
$100K
What happened in the Compu-Finder case?
OPC investigation found that Compu-Finder did not have the appropriate consent for the collection and use of email addresses for the purpose of sending out emails promoting its business activities.
CRTC issued a $1.1M AMP.
What does the CASL’s provisions regulating the installation of computer programs require from an owner before installation?
Express consent
That the express consent of an owner or unauthorized user of a computer system be obtained before installing, or causing to be installed, a computer program on that individual’s device.
What comments did the CRTC make about the CASL?
That the purpose of the CASL is to protect consumers from computer program, such as malicious software (malware), that pose a real threat to individuals, and that it would be focusing its enforcement in that direction.
What are two examples of computer programs that are “caused to be installed”?
Malware - sometimes malware is installed along with other software.
Concealed software
Concealed software may be automatically executed when a consumer purchases a music CD and inserts it in their computer to listen to music or copy songs.
Under the CASL, when is a telecommunications service provider not required to obtain consent prior to installation?
When the telecommunications service provider is installing software to protect the security of all or part of an end-user’s network from a current an identifiable threat or updating or upgrading all or part of the network.
Under CASL, what computer programs do not need requested consent prior to installation?
Cookies
HTML
JavaScript
An operating system
Bug fixes
An executable program to which the end user already consented
However, organizations are only considered to have consent for these types of computer programs as long as the person’s conduct indicates that they consent to it.
What does the Bank Act apply to?
Applies to the use and disclosure of personal financial information by Schedule I, Schedule II and Schedule II banks. The act oversees the institution’s compliance w/ the protection of customer’s personal and financial information.
What do Canadian privacy law generally do not do regarding transborder data?
Canadian privacy laws generally do not prohibit the international transborder flow of PI from Canada to locations outside of Canada, including the US.
There is no language in PIPEDA to suggest there is a prohibition on the transfer of PI outside of Canada. In fact, the law explicitly contemplates transfers of PI.
What is used in behavioral advertising?
The use of the cookie.
What do cookies do?
Cookies allow web servers to keep track of the end user’s browser activities and connect individual web requests into a session.
Cookies can also be used to prevent users from needing authorization for every password-protected page they access during a session by recording that they have successfully supplied their usernames and passwords already.
What is a “first party” cookie?
A cookie placed by the website that is visited.
What is a “third party” cookie?
A cookie placed by a party other than the visited website.
What is a “session” cookie?
Cookie that is deleted when a session ends.
What is a “persistent” cookie?
A cookie that remains for a period of time after a session ends.
What does a cookie permit with respect to data?
Cookie permits data regarding browsing history to be recorded and saved to better predict a user’s interests and develop a more accurate marketing profile of the user.
What information does a cookie contain?
(1) An ID that is 18 characters long and unique to the individual’s browser
(2) the date, time and duration of the individual’s visit to the “cookied” website.
What happens when a cookie does not have an expiration date?
The cookies will remain on their computers in perpetuity unless the individual removes them.
What two questions does the applicability of any law to marketing activities depend on?
What is PI?
Is the data processor collecting, using or disclosing PI as part of its activities?
What has the OPC pronounced about IP addresses and cookie-related info?
That they are PI.
What is a data breach?
Is when an unauthorized access, CUD of PI occurs.
When do privacy breaches commonly happen?
When PI is hacked, stolen, lost or inadvertently disclosed to the wrong people.
What does the OPC monitor breach incidents to ensure?
That an organization takes steps to address the situation, mitigate harm, and avoid similar future incidents.
What did the Digital Privacy Act do to PIPEDA?
Introduced new data breach reporting and notification provisions, which include a requirement for organizations to notify the OPC and affected individuals
Does Canada’s privacy legislation allow organizations to conduct video surveillance?
Yes, however this must be equally supported by transparency and an individual’s right to privacy.
What is the most common code that has been adopted by organizations and associations as codes of practice designed to enhance privacy protection?
The Generally Accepted Privacy Principles.
What is the GAPP?
The Generally Accepted Privacy Principles framework promulgated by the American Institute of Certified Public Accountants in conjunction with the Canadian Institute of Chartered Accountants.
What fundamental privacy laws did the Canadian government pass in the early 1980s?
The Privacy Act in 1983
The Access to Information Act in 1985
What combined fundamental privacy law have provinces passed?
“Freedom of Information and Protection of Privacy” acts.
What do provincial Freedom of Information and Protection of Privacy acts apply to?
Government entities including crown corporations and education.
What are provincial Freedom of Information and Protection of Privacy laws designed to do?
Enforce transparency around Canada’s public sector.
They enable the public to request and obtain copies of records held by government ministries or the Office of the Premier when those records are not routinely available.
Also, individuals are able to request access to their own information held by public institutions.
What does the Privacy Act apply to?
Applies to government institutions (i.e. ministries, tribunals, Crown corporations etc).
What does the Privacy Act require government institution do when collecting PI?
Collect PI only if the information relates directly to an operating program or activity of the institution.
Significantly, there is no need for data subject consent prior to the collection of PI.
Under the Privacy Act, what is general obligation when collecting PI?
There is a general obligation to collect the PI directly from the individual when the information is going to be used for an administrative purpose unless:
1) this is impossible;
2) the individual authorizes the indirect collection; or
3) the collection is pursuant to one of 13 exceptions specified in the act. (these 13 exceptions mirror those for the nonconsensual disclosure of info.)
What does the Privacy Act require regarding the use of PI?
To use PI, consent is required; however, and importantly, an institution does not need consent to use the information if it is being used for the purpose for which the information was obtained or compiled by the institution, for a use consistent with that purpose, or for a purpose for which the information may be nonconsensually disclosed to the institution.
What does the Privacy Act require regarding the disclosure of PI?
General obligation is that government institutions must not disclose PI w/o consent from the individual to whom the information pertains. (There are 13 situations where nonconsensual disclosure is permitted).
Under the Privacy Act, what must an institution do when it discloses PI w/o consent pursuant to an exception?
There are often requirements that the disclosure be recorded.
Under the Privacy Act, what does the Access to Information Act Requests bank contain?
Contains the requests under the Access to Information Act submitted by individuals to access records under the control of Treasury Board of Canada Secretariat, the replies to such requests, and any other information relevant to the processing of the requests.
What is the right of access under the Privacy Act?
The Privacy Act provides a right of access to every Canadian citizen or permanent resident. It is a mandatory right that requires government institutions to release the PI under its control to the individual requestor to whom the information pertains.
Access must be granted within 30 days of the request’s receipt by the institution, though extensions of time are permitted in certain circumstances.
Access to PI may be denied only in certain prescribed situations.
Any individual who is granted access to information is also granted the right to request that corrections or notations be made to the PI.
Under the Privacy Act, what does the Applications for Employment bank contain?
Maintains an inventory of applications from individuals requesting employment w/ the Treasury Board Secretariat.
Under the Privacy Act, what type of PI is completely inaccessible?
The Privacy Act allows for the creation of exempt banks by institutions that have PI holdings consisting predominantly of PI that would be inaccessible b/c it is info that was obtained or prepared by any government institution or part of any gov’t institution that is an investigative body in the course of lawful investigations pertaining to the enforcement of any law of Canada or a province.
Under the Privacy Act, what obligations do institutions have to safeguard and retain PI?
The Privacy Act does not specify an obligation to properly safeguard and retain PI.
Under the Privacy Act, what is the role of the OPC?
The Privacy Act creates the OPC. The role of the OPC is to investigate complaints received by individuals who believe their Privacy Act rights have been violated.
Under the Privacy Act, why is the OPC given very broad powers of investigation and controls investigation procedures the commissioner deems appropriate?
To conduct effective investigations. However, the trade off is that at the end of the complaint’s investigation, the commissioner may only recommend solutions to gov’t institutions that may have been found to be noncompliant w/ the Privacy Act.
Under the Privacy Act, what is the exception to the OPC’s power to only recommend solutions to noncompliant government institutions?
Where an the commissioner finds that the government institution erroneously denied access to PI being requested. In such instances, the OPC may proceed to the federal court for a determination of whether or not the information was properly withheld from release.
What government program arose out of the push to collect more PI?
The no-fly list.
This was a Transport Canada program whereby individual names would be added to a list and then subsequently distributed to airlines operating in Canada.
What did the proliferation of affordable security cameras, coupled w/ a post 9/11 atmosphere of heightened vigilance lead to?
Led to increasing interest in video surveillance for both the private and public sectors. As result, the OPC issued guidelines for video surveillance in both sectors.
What does the OPC’s video surveillance guidelines provide?
Discourage the use of video as an initial security option.
Video surveillance should be viewed as an exceptional step, to be taken only in the absence of a less privacy-invasive alternative.
Public should be advised that they will be under surveillance
Video surveillance system should be subject to independent audit and evaluation
Fair information practices should be respected in CUD, retention and destruction of PI
How does the provincial approach differ from the federal approach to protecting privacy?
Reasonable expectation of privacy limitation.
What is the reasonable expectation of privacy limitation under the provincial approach to protecting privacy?
While the federal scheme relies solely on a broad definition of PI, the approach in many provinces is to protect the vast array of data that is included in the definition of PI in some instances, but in other cases to afford less protection to that PI if it does not merit a reasonable expectation of privacy. Especially, when dealing w/ the protections relating to the disclosure of PI.
Under the provincial approach, when is a nonconsensual disclosure of PI permitted?
When it does not result in an unreasonable invasion of privacy.
With respect to transfers of PI, what is a difference between the federal approach to privacy protection and public-sector laws of BC and NS?
BC and NS place significant restrictions on a public body’s transfer of PI outside of their respective jurisdiction.
What is the difference between the federal (i.e. Privacy Act) and the provincial models of oversight chosen for the privacy commissioner?
Provincial commissioners have order making powers
Most of the provinces chose to give the commissioners the power to issue orders after they conduct their investigations or inquiries. This power is significant because they have substantially more legal power to force proper privacy protections.
Why does the Privacy Act require substantial modernization in comparison to the recent private-sector privacy laws?
Because:
- it was written before the full development in Canada of the broad range of fair information practices.
-it does not require the same degree of openness and transparency as private-sector laws.
–it fails to address the issue of transborder data flows in a world where the pressure to disclose to entities and organizations outside of Canada is increasing almost daily.
What is Canada’s Digital Charter?
A document meant to signal the direction of future government policy in spheres of the digital economy, data and privacy protection.
It outlines 10 principles.
It is not a legal document and thus its principles have no enforceable effect.
Why is the 2018-2019 OPC Report on PIPEDA and the Privacy Act significant?
In its 2018-2019 Report to Parliament on PIPEDA and the Privacy Act, Commissioner Daniel Therrien announced that the government has finally committed to reforming Canada’s aging privacy legislation.
What approach does the 2018-2019 OPC Report call for?
Commissioner called for a rights-based approach that has 3 key impacts on Canada’s public sector privacy framework:
1) For the public sector to adapt the principles of “necessity and proportionality” in its data management practices.
2) Enforcement mechanisms should be strengthened so that federal institutions have the incentive for broad compliance.
3) The requirement of “demonstratable accountability’. Rather than having to engage in lengthy investigations into government institutions to uncover breaches of accountability, the institution would be expected to demonstrate its compliance with the regulator upon request and be required to design for privacy at the planning stages.
What is a Privacy Impact Assessment?
Required by federal gov
All gov institutions subject to Privacy Act must conduct a PIA
Meant to be sent to the OPC for the commissioner’s involvement
Purpose of the PIA is to evaluate whether program and service delivery initiatives that involve the CUD of PI comply w/ the obligations set out in:
-the Privacy Act
-the government’s Privacy and Data Protection Policy
-The Library and Archives of Canada Act
-Any other program-specific legislation or regulation dealing w/ information management
Under the Privacy Impact Assessment framework, what does the level of assessment need to commensurate with?
An assessment need only be “commensurate” with the level of risk at hand. Where risk is low, an assessment does not need to be as extensive as where risk is high.
What is data matching?
Defined by the federal gov as an activity that involves comparing personal data obtained from a variety of sources, including personal information banks, to make decisions about the individuals to whom the data pertains.
It is a specialized activity involving the collection, use and disclosure of PI, wh/ is subject to the various requirements of the Privacy Act.
What is the power of data matching?
It involves an indirect collection of PI that leads to discovery and new knowledge about individuals. The new info can then be used by the entity that controls the data for new purposes.
What is web analytics?
The collection, analysis, measurement and reporting of data about web traffic and user visits for the purpose of understanding and optimizing web usuage.
What is web analytics often used in?
Market research to improve advertising campaigns and website effectiveness.
Many gov institutions also use web analytics to learn about visitors to their sites in order to better meet the visitor’s needs and deliver more effective services.
What requirements do the Standard on Privacy and Web Analytics create?
Various, including:
Mandated privacy notices on institutional websites
Maximum retention periods
Use of strict privacy-protection language in any contracts w/ 3P service providers.
What use does the Standard on Privacy and Web Analytics address?
Use of web analytics by gov institutions and its associated privacy issues.
What and who does the Standard on Privacy and Web Analytics apply to?
PI (as defined by the Privacy Act) that is collected, used, retained and disposed of for web analytics.
All institutions that are subject to the Privacy Act are subject to it, including parent Crown corporations and their wholly owned subsidiaries.
When are the privacy risks introduced by web analytics are especially serious?
When IP addresses and other info about browsing behaviour are disclosed to 3Ps located outside of Canada.
What special considerations must be taken into account when PI is to be subject to a contract by wh/ the management of a program/service is outsourced to a company?
The sensitivity of the PI
The expectations of the individuals to whom the PI relates
The potential injury if PI is wrongfully disclosed or misused.
Whether a 3P operates only in Canada, subcontracts to parties outside of Canada or operates exclusively outside of Canada.
How does the Privacy Act deal with transborder data flow?
Privacy Act does not restrict the processing of PI by a 3P located outside of Canada.
Canadian business and gov institutions are free to engage in commercial relationships that involve the processing of info in the US as long as doing so is consistent w/ Canadian privacy practices including transparency, notice and application of adequate safeguards.
What is the Health Information Protection Act?
Introduced in 2016.
Amended ON’s PHIPA to assist in improving privacy and accountability by introducing new measures to protect PHI of patients.
Made breach reporting mandatory, increasing transparency, and doubling fines for offences to $100K for individuals and $500K for organizations.
Strengthened the process for prosecuting offences by removing the requirement to prosecute within six months of the alleged offence.
What is the aim of provincial health information privacy laws?
Aim to control the CUD of PHI by specified health sector participants.
End goal is to enhance privacy and confidentiality while simultaneously ensuring efficient health service delivery.
What two terms are used to describe health sector participants caught by provincial health privacy laws?
Trustees - Sask and MB
Custodian or HIC - AB, ON , NB, NFLD & NS
Which provinces do not have laws dealing specifically with health information privacy?
Nunavut and Quebec
What do health information network providers enable custodians to do?
Share PHI through electronic means by providing them w/ IT services.
They are subject to provincial health privacy laws.
What do all provincial health information laws define?
PHI and define it in similar terms: any info concerning an individual’s physical and mental health.
What is the concept of deidentifying health information found in all provincial health information laws?
Each law provides that if info is truly anonymized or deidentified, it is not protected by law.
Before an organization can treat the information as not being subject to the law, it must validate that no form of data mining or data manipulation can render the information identifiable.
What are most provincial health information laws modelled after?
The privacy principles contained in other information protection laws in Canada, w/ the same general obligations fond throughout each law.
Which provincial health information laws have been deemed substantially similar to PIPEDA?
ON PHIPA
NB PHIPAA
NFLD PHIA
NS PHIA
Which provincial health information laws have not been deemed substantially similar to PIPEDA?
AB and MB
As such the healthcare provider is expected to comply w/ both statutes.
What rights to individuals have under provincial health information laws?
Each law provides individuals with the right to access their own health information held by the entities covered by the law. Also, have the right to correct or amend inaccurate info.
What oversight is provided by provincial health information laws?
Each law provides that an independent agency, such as the privacy commissioner, has independent oversight of the entities covered by the law.
Role of the oversight body is, among other things, to review and resolve complaints from individuals who believe their rights were violated.
What accountability is placed on appliable entities under provincial health information laws?
Each law places the onus on the entity covered to remain accountable for the use proper use, retention, safeguarding and disposal of health info under its custody or control. This obligation remains even when the covered entity uses a 3P to outsource some of its functions.
Why is the consent requirement in PHI protection laws notably different than that in other PI protection laws?
Given the vast and varied flows of PHI, the central role of govt in the delivery of heatlhcare services, and the vital and time-sensitive nature of much of the information at issue.
What are common themes with respect to consent in PHI protection laws?
Must be meaningful.
Many situations will allow custodian/trustees to infer consent
Generally, the rule is that the individual will be deemed to have implicitly consented to CUD of their information within their circle of care.
Consent will not be implied if the disclosures will be made to non-custodians or to other custodians outside the circle of care.
What obligations do provincial health information laws impose on custodians/trustees regarding safeguards?
All provincial laws provide obligations on custodians/trustees to properly safeguard the health information under their control and custody.
Under provincial health information laws, what must custodians/trustees do to safeguard PHI?
Adopt reasonable administrative, technical and physical safeguards that ensure confidentiality, security, accuracy and integrity of the information.
Under provincial health information laws, what are custodians mandated to do when there is a privacy breach?
Mandate the custodian to notify the privacy commissioner in situations where a custodian reasonably believes there has been a material breach involving the unauthorized CUD of PHI.
The obligation to notify includes any instance where PHI is handled in a way that does not conform to the custodian’s published policy statement on its information-handling practices.
In NFLD, in situations where a custodian reasonably believes there has been a material breach involving the unauthorized CUD of PHI, what is the custodian required to do?
Notify the commissioner of the breach.
How do the provincial health laws deal with openess?
Generally, the provincial laws do not strictly adhere to the same standards as, for example, PIPEDA in terms of an organization’s obligation to develop comprehensive privacy policies and make them accessible.
Which provincial health laws resemble the general privacy principle of openness?
ON, NFLD and BC.
In these provinces, health data authorities are required to make available information that describes
In ON, NFLD and BC, what 4 pieces of information is health data authorities required to make available?
- The data authorities’ information practices.
- How to contact the appropriate data authority
- How to obtain access to or request correction of PHI (except for BC)
- How to file a complaint.
What did the move toward increased availability of e-health info and the proliferation of the use of the EHR in Canada spawn?
Created several different Canadian organizations that are tasked specifically w/ providing the proper infrastructure in the health sector that can be used securely.
What organization has done a fair amount of work in the specific area of protecting PHI?
Digital Health Canada
What was Digital Health Canada called before 2017?
Canadian Organization for the Advancement of Computers in Health (COACH), Canada’s health informatics association.
What is Digital Health Canada’s mission?
To “take health informatics mainstream” through the promotion of health technology systems and the effective use of health information.
They provide practical guidance and measures to ensure appropriate privacy and security in a healthcare context.
What is the Canadian Institute for Health Information?
A publicly funded health data aggregator that focuses on information about Canada’s health system and the heath records of Canadians.
What is the vision of the Canadian Institute for Health Information?
To “help improve Canada’s health system and the well-being of Canadians by being a leading source of unbiased, credible and comparable information that will enable health leaders to made better-informed decisions”
Under ON PHIPA, what is the Canadian Institute for Health Information designated as?
A HIC. This allows HICs in ON to disclose PHI to the CIHI w/o patient consent, for analysis and management.
What are 3 notorious cases involving a breach of PHI?
- Occurred in Toronto during the filming of a feature motion picture. Scrap paper was actually medical records. IPC found that clinic was ultimately responsible not the offsite shredding company.
- A man’s ex-wife who worked as an X-ray technician in an Ottawa hospital unlawfully accessed the medical files of her ex-husband’s girlfriend to find out whether he was trying to start a family w/ his new partner.
- Sale of thousand’s of patients PI by two former hospital employees.
- Health Canada disclosed the PHI of over 40K licensees of its Marihuana Medical Access Program when it sent written notices to these individuals outlining changes to its program. The envelopes had MMAP on them visible to anyone.
What has been a recent priority of the OPC, specifically in the context of life and health insurance companies?
Evaluating the privacy implications associated w/ the collection and use of genetic info.
What is the Genetic Non-Discrimination Act?
An important step for privacy and human rights as it helps to prohibit genetic discrimination across Canada.
It bars any person from requiring individuals to undergo a genetic test or disclose the results of a genetic test as condition of providing goods or services or entering into a contract.
Under PIPEDA, what must an insurance company receive from an individual before it can collect or use their genetic test results for underwriting purposes?
Consent
What is the 4 point test that the OPC has adopted for determining whether requesting access to genetic test results goes beyond what is necessary for legitimate business purposes or what a reasonable person would consider appropriate when applying for life or health insurance?
- Is the collect and use of the tests results necessary to achieve a legitimate business purpose?
- Are the test results likely to be effective in achieving that purpose?
- Are the collection and use proportionate to the benefits gained?
- Are there less privacy-intrusive alternatives to the collection and use of genetic test results?
What is Canada’s cultural definition of privacy a hybrid of?
The European and American approaches.
What is European privacy protection commonly referred to?
Data protection
What right is European data protection law based on?
The protection of privacy as a fundamental human right.
The general rule is to not allow any collection or use of personal data unless permitted to do so by law.
Before the EU adopted the General Data Protection Regulation, what was the legal framework in Europe based on?
Based on the EU providing member states w/ directives that instruct each member state to pass minimum laws that address the instructions found in each directive.
What did the EU adopt in December 2015 for data protection?
the General Data Protection Regulation
Before the GDPR was based, what two significant directives did the EU pass?
the EU Data Protection Directive (the Directive) (this one is the most important)
the Privacy and Electronic Communications Directive (ePrivacy Directive)
What is the central aim of the GDPR?
To create a clearer, more certain and trustworthy legal environment for both businesses and citizens, which will in turn increase both competition and innovation in the digital market.
In theory this legal uniformity with also yield less bureaucracy and thus level the playing field for all businesses on the Euromarket.
That said, although a uniform law will provide a certain degree of consistency across the EU, each member state will nonetheless be able to interpret the GDPR through the lens of its own national approaches and idiosyncrasies.
To whom does the GDPR apply to?
Any controller or processor of EU citizen data, regardless of where the controller or processor is headquartered and where the actual processing takes place (even if that is outside of the EU):
Examples
-A telecommunications organization that offers its goods and services through its EU-based regional offices to EU data subjects
-A retailer that offers its goods or services to EU data subjects via its online website
-A marketing agency that monitors the purchasing habits and behaviours of EU data subjects using data-processing techniques to create individual profiles and predict personal preferences, behaviours and attitudes
What is an important core principle of the GDPR?
“the purpose limitation” wh/ provides that personal data should only be collected for “specified, explicit and legitimate purposes and not further processed in a manner that is incompatible w/ those purposes.”
What principles has the GDPR introduced?
Principles of:
-purpose limitation
-data minimization
-accuracy
-storage limitation
-integrity
-confidentiality
How did the GDPR expand the scope of the Directive’s definition of “sensitive personal data” to include?
-biometric data
-genetic data
-data concerning sexual orientation
As a result, these types of data are now subject to the stricter rules governing processing and consent w/ regard to sensitive personal data
With respect to controllers and processers of data, in what key way did the GDPR expand on the privacy protections in the Directive?
By introducing a formal idea of accountability meaning that controllers and processors of data “shall be responsible for and be able to demonstrate compliance with” the law.
The GDPR has specific rules that allocate responsibility between what two parties?
Controllers and Processors
How does the GDPR’s Article 4(7) define a “controller”?
As “the natural or legal person, public authority, agency or any other body wh/ alone or jointly w/ others determines the purposes and means of processing personal data”.
How does the GDPR’s Article 4(8) define a “processor”?
As any same such body (as a controller) wh/ processes personal data on behalf of the controller.
What do the GDPR rules governing accountability include obligations to do?
to implement:
-compliance policies
-data protection by design
-data protection by default
-record-keeping obligations
-data protection impact assessments
engage in prior consultation w/ DPAs in high-risk cases
What is the EU counterpart to the roles played by the federal and provincial privacy commissioners in Canada?
data protection authorities (DPA)
Both the Directive and GDPR ensure that the DPAs for each country (and some provinces) are adequately equipped to provide what?
a forum for individuals to enforce the rights
What do the enforcement mechanisms used by the DPAs include?
Receiving complaints, mediating solutions and making orders.
What type of enforcement do both the Directive and the GDPR provide for?
civil and criminal enforcement of the data controller’s obligations
The GDPR created for the first time legal obligations on what?
data processors
What does the GDPR prevent a data processers from doing w/o the prior written or specific consent of the controller?
That a processor may not subcontract its services w/o the prior written or specific consent of the controller.
Data controllers now have extremely detailed requirements to impose contractually on their vendors who act as data processers.
A central aim of the GDPR was to enhance what requirements under the Directive?
The Directive’s notice requirements.
What resulted from the GDPR’s enhancement of the Directive’s notice requirements?
The GDPR features more detailed transparency obligations, which require controllers and processors to draft detailed privacy notices
What remains central to the European approach to data privacy, that was tightened by the GDPR?
Relying on consent to justify the use of PI
How did the central approach to data privacy, relying on consent to justify the use of PI, change from the Directive to the GDPR?
The Directive allowed controllers to rely on implicit and opt-out consent in some circumstances.
The GDPR requires the data subject to convey agreement by either an express statement or a “clear affirmative act.”
Affirmative consent must be freely given, specific, informed and unambiguous. Can include ticking a box on a website. Accordingly, silence, pre-ticked boxes or inactivity” does not constitute such consent.
If consent is presented as take it or leave it, it is not regarded as being freely given. In addition, consent can no longer be bundled w/ terms and conditions.
Under the GDPR, what is the key change from the Directive regarding consent?
Removal of the opt-out possibility.
What four additional requirements did the GDPR introduce with respect to consent?
- The right to withdraw
- The specificity requirement
- Age of consent deharmonization
- Services conditional upon consent
Under the GDPR, what is the right to withdraw consent requirement ?
Can retract consent at any time
Controllers must give notice of right to w//d before consent is given
Once consent is w/d, data subjects have the right to their personal data being erased
Under the GDPR, what is the specificity requirement for consent?
Consent must be specific to each data-processing operation and demonstrable upon demand.
Under the GDPR, what is age of consent deharmonization requirement?
Children under the age of 16 must get parental approval to give consent.
Under the GDPR, what is the services conditional upon consent requirement?
A controller may not make a service conditional upon consent unless the processing is necessary for the actual performance of the service or contract.
Under the GDPR, what are 2 new rights for data subjects that did not exist as part of the Directive?
- The right to erasure
- The right to data portability
Results in a greater need for data controllers and processors to be ready to honour people’s increased level of control.
What right does Article 17 of the GDPR codify?
the right to be forgotten and bestows upon it the new name “right to erasure”
Under the right to erasure, when must controllers erase personal data?
Controllers must erase personal data w/o undue delay if the data is no longer needed, the data subject objects to the processing, or the processing was unlawful.
The right is not unlimited - it must be balanced against freedom of expression; the public interest in health, scientific and historical research; and the exercise or defence of legal claims.
What must a controller do when a data subject makes an erasure request?
The controller must take reasonable steps to inform other controllers that are processing the data about the person’s objection, unless it would require “disproportionate efforts”.
Any controller processing the data must then erase copies of it or links to it.
When does the right to erasure automatically apply?
If the data was collected when the data subject was still a child in need of parental consent, OR
if the data collected falls into one of the special categories of sensitive PI, even if the data has already been made public.
What must controllers do because of the right to data portability?
Requires controllers to provide personal data to the data subject in a commonly used format and to transfer that data to another controller if the data subject so requests.
Controllers have to provide any information they hold about a data subject free of charge and within one month of request.
When does the right to data portability apply?
Only when processing was originally based on the user’s consent or on a contract; it does not apply to processing based on a public interest or the controller’s legitimate interests.
Like the Directive, the GDPR permits transfers of personal data to whom?
Nonmember state countries (“third countries”) that the European Commission has deemed as having an adequate level of personal data protection.
Unlike the Directive, the GDPR permits transfers of personal data to whom?
GDPR allows transfers also to a territory or specified sector within a third country (ie, a cross border transfer), or to an international organization provided that it has been awarded the Commission’s adequacy designation.
What does a Commission adequacy designation mean?
That the third country or specified entity ensures “an adequate level of protection essentially equivalent to that ensured within the European Union”
Which third country has received the Commission’s adequacy designation?
Canada’s PIPEDA
However, this adequacy ruling was made before the GDPR so amendments may be required to maintain adequacy status.
In the absence of the Commissioner’s adequacy designation, are cross border transfers allowed?
Yes; allowable if the controller or processor utilizes certain Article 46 safeguards
For cross border data transfers of personal data, what does Article 14(1)(f) requires controllers do?
Provide certain information to data subjects when their information is obtained.
The controller must provide disclosure of its intention to transfer personal data to a third country or international organization.
Must also provide either (a) disclosure that the transfer is pursuant to an adequacy decision by the Commission or (b) reference to the appropriate or suitable safeguards and the means for the data subject to obtain them.
How is the GDPR different from the Directive regarding data breaches?
Directive was silent
GDPR adopts specific breach notification guidelines
How does GDPR define a “personal data breach”?
As a “breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed”
Under the GDPR, who must data controllers notify when there is a personal data breach?
Notify the appropriate supervisory authority w/o undue delay and where feasible, not later than 72 hours after having become aware of it.
If notification is not made within 72 hours, the controller must provide a “reasoned justification” for the delay.
Notification is not required if “the personal data breach is unlikely to result in a risk for the rights and freedoms of individuals”
Under the GDPR, when there is a personal data beach, what must a controller’s notification to the supervisory authority do?
Must “at least” describe:
-the nature of the personal data breach,
-provide the data protection officer’s contact info
-the likely consequences of the personal data breach
-how the controller proposes to address the breach
Info can be provided in phases
Under the GDPR, when there is a personal data beach, who must a controller notify if they determine that the breach is likely to result in a high risk to the rights and freedoms of individuals?
It must also communicate info regarding the breach to the affected data subjects “without undue delay”
Under the GDPR, when there is a personal data beach, who must a processor notify?
the controller; otherwise no notification or reporting obligation
Under the GDPR, what new powers did national Data Protecton Authorities receive?
Enhanced into first-instance body where citizens of member states can submit complaints about data breaches.
GDPR also strengthens cooperation btw the respective national DPAs, wh/ helps ensure consistency and oversight.
Unlike the Directive, when there is a breach of personal data, what did the GDPR introduce the potential for?
The right to compensation for breaches for material or immaterial damage, as well as huge administrative fines.
If either a data processor or a controller is found to be noncompliant, the burden shifts to said defendant to prove it is not responsible for the damage.
Under the GDPR, what fines can be levied for a breach?
A noncompliant organization can be fined
-up to $20M or
- in case of an undertaking, up to 4% of the company’s total worldwide annual turnover from the preceding financial year, whichever is higher.
Also, citizens an pressure groups have the right to engage in group litigation to recover compensation for mere distress caused by contraventions of the GDPR.
Under the GDPR, what is the largest fine that has been levied for a breach?
Google - fine $50M Euros
Found to have (1) failed to meet the accessibility and transparency requirements and (2) failed to obtain valid consent form users to process their data for ad personalization purposes.
Under the GDPR, what officer are organizations required to appoint?
A data protection officer (DPO)
Under the GDPR, when must a data protecton officer be appointed?
-For all public authorities
-where the core activities of the controller or the processor involve “regular and systematic monitoring of data subjects on a large scale”
-where the entity conducts large-scale processing of the aforementioned “special categories of personal data that are provided in Article 9
Under the GDPR, what credentials must a data protection officer possess?
GDPR does not establish the precise credentials DPOs must possess, but it does require that they have “expert knowledge of data protection law and practices”.
Level of expert knowledge “should be determined in particular according to the data-processing operations carried out and the protection required for the personal data processed by the controller or the processor”
Under the GDPR, when can a company with multiple subsidiaries appoint a single DPO?
May appoint a single DPO as long they are easily accessible from each establishment.
When does the GDPR expressly prevent dismissal or penalty of the DPO?
For the performance of their tasks and places no limitation on the length of this tenure.
What directive did the EU pass to regulate the privacy and data protection issues inherent in online marketing practices?
the Privacy and Electronic Communications Directive (ePrivacy Directive)
What type of consent does the ePrivacy Directive require for electronic marketing communications?
Prior (opt-in) consent
What is the one notable exception to the ePrivacy Directive requirement for prior opt-in consent for electronic marketing communications?
Directive allows communications within an established customer relationship.
This exception permits companies to email or send text messages to a mobile phone to market products and services to customers who have purchased similar products or services from the company under the same brand name.
In this case, the company must offer an opt-out so that individuals can discontinue receiving the communications if they choose.
What computer files does the ePrivacy Directive impose controls over?
The use of cookie files on websites.
Requires transparency about the use of cookies by requiring a display of the terms under wh/ the company uses cookies on its websites.
What rights are provided to individual subscribers by the ePrivacy Directive?
Provides rights for individual subscribers to decide whether or not they want to be listed in subscriber directories and specifically permits value-added services such as location-based advertising to mobile phones provided subscribers have given their informed consent and are informed of the data-processing implications.
What is behavioral advertising?
Is one marketing approach in wh/ a marketer develops an understanding of a consumer through the use of cookies, which can be used to track a user’s preferences and online activities.
What Directive did the EU pass b/c of concern w/ the covert use of tracking software?
The EU Cookie Directive
What does the EU Cookie Directive require website providers receive from visitors?
Visitor’s consent “having been provided w/ clear and comprehensive info about the purpose of the cookie, before a cookie may be placed on the visitor’s device.
Also provides Europe’s DPAs w/ complementary enforcement powers.
Under the GDPR, when can data processing be characterized as profiling?
When it involves “any form of automated processing of personal data evaluating the personal aspects relating to a natural person”
Under the GDPR, when would an activity constitute profiling?
It must involve more than mere tracking; not only does such personal data have to be gathered, but the automated processing of that data must be for the purpose of making decisions about the data subjects.
Under the GDPR, when can a controller engage in the activity of profiling?
Must inform the data subject at the time the data is collected that profiling will occur, and it must also provide “meaningful info about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.”
What is the ePrivacy Regulation?
Aims to ensure respect for private life, confidentiality of communications, and the protection of personal data in the electronic communications sector.
Aims to ensure free movement of electronic communications data and electronic communications services within the EU.
Will allow for reinforcement of trust and security in digital services and the objectives of the Digital Single Market Strategy.
What does the ePrivacy Regulation apply to?
The processing of electronic communications data carried out in connection w/ the provision and the use of electronic communications services and to information related to the terminal equipment of end users.
What are the 3 key focus areas of the ePrivacy Regulation?
- Protection of of Electronic Communications of Natural and Legal Persons and Information Stored in their Terminal Equipment
- Natural and Legal Persons Rights to Control Electronic Communications
- Independent Supervisory Authorities and Enforcement, and Remedies, Liabilities and Penalties
What is the Asia-Pacific Economic Cooperation (APEC)?
An organization focused on the economic development of the Asia-Pacific region.
How is APEC unlike the EU and its mandatory Directive approach?
APEC works as a cooperative by coming to terms on nonbinding agreements. The purpose behind APEC is the enhancement of economic growth for the region.
What is the APEC Privacy Framework?
Framework promotes a consistent approach to information privacy protection across APEC member economies, while avoiding the creation of unnecessary barriers to information flows.
Its distinctive approach is to focus attention on practical and consistent information privacy protection.
It tries to balance info privacy w/ business needs and commercial interests, and at the same time, accords due recognition to cultural and other diversities that exist within member economies.
Sets out nine privacy principles that provide guidance to businesses operating in APEC economies.
The APEC Privacy Framework is drafted w/ what understanding?
That many member economies have well-established privacy laws and/or practices, while others may only be considering the issues.
What is the part of Asian privacy law most likely to be encountered by a Canadian business looking to do business with Asian consumer?
the Cross Border Privacy Rules found in the APEC privacy framework
What does the APEC Cross Border Privacy Rules System require business entities in participating APEC member economies develop?
Their own internal rules on cross-border data privacy procedures.
In addition, the internal rules must (1) comply w/ minimum requirements based on a set of commonly agreed-upon rules known as the APEC Privacy Framework and (2) be verified by assessment and certification from an independent public or private sector body - an accountability agent.
What is the aim of China’s Cybersecurity Law?
Came into force w/ the aim of protecting PI and individual privacy.
What is the focus of China’s Cybersecurity Law?
The law has a focus on the standardization of collection and usage of PI of Chinese citizens.
Specifically, organizations processing PI of Chinese citizens and information related to national security or both will be required to store data within China. This will make organizations responsible for setting up Chinese-local servers for data and undergoing a security review before any data can be moved outside of China.
Who does China’s Cybersecurity Law require network operators to fully cooperate w/?
Chinese crime or security investigators by providing them w/ full access to data and additional support upon request.
What is the US approach to privacy protection?
Very different from approach taken in Europe and Canada
Sectorial approach - results in a number of different laws, each of which address specific issues in specific industries
What does the Fair Credit Reporting Act require?
Accurate and relevant data collection by entities that compile consumer reports as well as persons who use consumer reports.
It gives consumers the ability to access and correct their information and limits the use of consumer reports to permissible purposes.
What is a consumer reporting agency (CRA)?
Any entity that routinely furnishes consumer reports to third parties for a fee.
Who enforces violations of Fair Credit Reporting Act?
The Fair Trade Commission, state attorneys general and individual have a private right of action.
What is the Health Insurance Portability and Accountability Act (HIPAA)?
Is a US law that specifically addresses health information privacy.
Requires the US Department of Health and Human Services to adopt national standards for electronic healthcare information transactions. These are referred to as HIPAA rules (one subset deals w/ privacy, another w/ security and a third set for transactions).
What is important to note about the Health Insurance Portability and Accountability Act (HIPAA)?
The HIPAA privacy and security rules are designed to establish minimum standards (i.e. to set the legal floor).
States are free to develop more rigorous requirements as long as these requirements do not conflict w/ HIPAA.
What does the Health Insurance Portability and Accountability Act (HIPAA) govern?
HIPAA governs a covered entity’s management of PHI.
What entities does the Health Insurance Portability and Accountability Act (HIPAA) define apply to?
Healthcare providers
Health plans
Healthcare clearinghouses
What legislation did US Congress pass to address concerns about how large organizations and their subsidiaries would share PI among themselves and with other 3Ps?
the Gramm-Leach-Bliley Act (GLBA), which among other things provided significant privacy and security protections for consumers.
To whom does the Gramm-Leach-Bliley Act (GLBA) apply?
Applies to domestic financial institutions, defined to include any US company that is “significantly engaged” in financial activities.
What is the PI that is protected by the Gramm-Leach-Bliley Act (GLBA) referred to?
Nonpublic financial information
What is the Children’s Online Privacy Protection Act of 2000 (COPPA)?
An example of a specific legal response to what can be considered a very specific concern: the protection of children in the online environment
Who does the Children’s Online Privacy Protection Act of 2000 (COPPA) apply to?
COPPA applies to the operators of commercial websites and online services (especially those directed to children under the age of 13), though it also applies to general-audience websites and online services if they have actual knowledge that they are collecting PI from children under the age of 13.
What is the major contrast between US and international approaches to marketing communications?
Choice
In the EU and Canada, laws generally require the consumer to opt-in to marketing programs, while in the US, the laws generally provide for opt-out choice.
Who does the US Telemarketing Sales Rules apply to?
For-profit organizations and cover charitable solicitations placed by for-profit telefunders.
What popular program that arises out of the Telemarketing Sales Rules?
The National Do Not Call Registry - this program provides a means for US citizens to register residential and wireless phone numbers that they do not wish to called for telemarketing purposes.
In the US, what are unfair trade practices defined as?
Commercial conduct that intentionally causes substantial injury w/o offsetting benefits and that consumers cannot reasonably avoid.
From a privacy perspective, what is the net effect of the US unfair and deceptive trade practices laws?
Organizations must be very careful in constructing privacy notices. Organizations must be honest and upfront about their PI handling practices.
What is the most expansive privacy law ever introduced at any level of US governance?
The California Consumer Privacy Act (CCPA)
Applies to for-profit businesses doing business in California that meet one of three thresholds.
