CIPP/C Flashcards
What is the Right to Be Let Alone?
-1890
-Two famous American scholars advocated that society need to recoginize a privacy right
-Defined that right as “the right to be let alone”
-Occurred with the advent of the modern press and the ability to publish news in mass-distributed newspapers
What are the 3 (Main) Classes of Privacy
Information privacy
Privacy of the person
Territorial privacy
What is Information privacy?
One of three classes of privacy
Defined as “the claim of individuals or groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.”
Information’s protection is predicated on the assumption that all information about a person fundamentally belongs to them, for them to communicate or retain as they see fit.
By law is concerned with establishing rules that govern the collection and handling of PI (can include FI, medical data or other records)
Definitions of privacy include
Privacy has been defined as the desire of individuals to choose freely the circumstances and degree to which they expose their attitudes and behaviours to others
Been connected to the human personality and considered a means to protect an individual’s independence.
The right of the individual to be protected against intrusion into his personal life or affairs or those of his family by direct physical means or by publication of information
What is privacy of the person?
Protects bodily integrity, and in particular the freedom from physical contact that would reveal objects or matters a person wishes to conceal.
Bodily privacy is focused exclusively on a person’s physical body; invasions to this class of privacy include genetic testing, drug testing and body cavity searches.
What is Territorial privacy?
Concerned with placing limitations on the ability
of an individual or organization to intrude into another individual’s physical environment.
Original notion was founded on the principle that “the house of everyone is to him as his castle and fortress.
Invasion of an individual’s territorial privacy typically comes in the form of physical search of premises, video or audio surveillance, ID checks and similar intrusions.
3 Canadian Perspectives on Privacy
Privacy of the individual vis-à-vis the state
Privacy of the individual vis-à-vis other individuals.
Privacy of the individual vis-à-vis organizations
Privacy of the individual vis-à-vis the state
One ponders the extent to which an individual is free to live their life without the state interfering or knowing what the individual is doing
Privacy of the individual vis-à-vis other individuals.
One examines to what extent an individual can live life free from intrusion from another individual, such as a neighbour, coworker, spouse, parent or child.
Privacy of the individual vis-à-vis organizations
One looks at the extent to which organizations can collect, use and disclose personal information about an individual, and once they have collected such information, what obligations they have.
What are the 5 World Models for Data Protection?
Comprehensive Laws (Canada, European Union)
Sectoral Laws (United States)
The Self-Regulatory Model (United States, Japan and
Singapore)
Seal Programs
The Technology-Based Model
Describe the Comprehensive Laws (Canada, European Union) Model
These laws govern the CUD of PI in the public and private sectors
Country that has comprehensive data protection laws has an official/agency responsible for overseeing enforcement - called a DPA, but in Canada a commissioner/ombudsperson - ensures compliance with law and investigate alleged breaches of the law
Official also bears responsibility for educating the public on data protection and acts as an international liaison for data protection issues
What are 2 critical issues with the Comprehensive Law Model?
Enforcement and funding are two critical issues in a
comprehensive data protection scheme.
What can the movement toward comprehensive privacy and data protection laws be attributed to?
The need to;
(1) remedy past injustices,
(2) promote electronic commerce, and
(3) ensure consistency with pan-European laws
Describe the Sectoral Laws (United States) Model
This framework protects PI through the enactment of laws that specifically address particular industry sectors
Often are used as a complement to comprehensive laws to provide more specific protection for particular data.
What are 2 major drawbacks with the Sectoral Laws Model?
Technological Relevance
- b/c this model requires new legislation to accompany the introduction of new technologies, legislation often lags the technology that needs to be regulated
Oversight
-model lacks a central agency and a federal privacy mandate to provide oversight
Describe the Self-Regulatory Model (United States, Japan and Singapore)
Requires companies to abide by codes of practice as set by a company or group of companies as well as by industry and/or independent bodies to protect data
What are two major issues with the Self-Regulatory Model (United States, Japan and Singapore)?
Adequacy of codes of practice set by
companies and industry bodies
Enforcement.
Under the Self-Regulatory Model (United States, Japan and Singapore), what has happened b/c industry-developed codes provide limited data protection and are
coupled with weak mechanisms for enforcement?
Several coalitions and independent organizations have established codes of practice and seal
programs.
What is the Online Privacy Alliance?
A coalition of numerous online companies and trade associations specifically established to encourage the self-regulation of online privacy.
What did the Online Privacy Alliance introduce?
Guidelines for Online Privacy Policies
Who created the Guidelines for Online Privacy Policies and what occurs under them?
Online Privacy Alliance
Under these guidelines, OPA members agree to post a privacy policy that informs users about how their information is collected and used.
Notably, the guidelines do not provide for enforcement and instead encourage members to establish enforcement mechanisms independently.
What are Seal Programs?
Certifications and attestations provided by third parties
Is a prominent form of self-regulation
A seal program requires its participants to abide by codes
of information practices and adhere to some variation of monitoring to ensure compliance.
Companies that abide by the terms of the seal program are then allowed to display the program’s privacy seal on their websites.
Examples of such programs are TrustArc (formerly TRUSTe), BBBOnline, WebTrust, and the Digital Advertising Alliance (DAA).
Describe the Technology-Based Model
Technological security measures can be undertaken to ensure the protection of individuals’ personal data.
Developments in commercially available hardware and
software have enabled consumers to establish privacy protections for their own online activity.
Examples: Digital Cash and Encryption
What type of state is Canada?
Federal state
What are Canada’s three levels of government?
Federal, Provincial and Municipal
What are the two chambers of Parliament?
House of Commons -members elected in general elections held every four years
Senate - members are appointed
What type of system is used throughout Canada at the federal and provincial levels?
Parliamentary
How does a bill become law?
Must be approved by both the House of Commons and the Senate
What members are in the legislative branch?
House of Commons and the Senate
What do members of the legislative branch do?
Introduce, debate and pass bills and policy
Play a role in the oversight of the executive branch
Appoint officers of Parliament (i.e. the Federal Privacy Commissioner)
Describe the Judiciary Branch
Headed by the Supreme Court of Canada
Made up of a network of federal and provincial courts that hear and decide criminal and civil matters across the country
What act makes the federal gov responsible for issues such as criminal law, banking, national defence, and importantly for the topic of privacy protection - trade and commerce?
Constitution Act of 1867
Based on what legislation does the federal govt regulate privacy in Canada?
Constitution Act of 1867 - trade and commerce
What areas do provinces have jurisdiction over?
Provinces are responsible for such areas as hospitals, education, provincial courts and municipalities.
For provinces, what area of jurisdiction is thought to include privacy rights?
Property and civil rights
What is the role of the court in Canada?
Interpret laws
Review laws and government actions to ensure rights and freedoms are upheld
Judicial review - review of gov’t decisions (limited to review of such decisions for specific types of errors)
What are the role of administrative tribunals?
Interpret laws
Can enforce Charter rights
vehicles of the executive branch and are organized to administer specific programs with a certain degree of expertise
What are Charter Rights?
Charter rights are those created by the Canadian Charter of Rights and Freedoms.
Are constitutional rights and thus considered the most valuable rights in Canada
What is the Federal Privacy Commissioner misunderstood to be?
An administrative tribunal
What is the Federal Privacy Commissioner an officer of?
Officer of Parliament
Why must the Federal Privacy Commissioner table annual reports to Parliament outlining work accomplished and conclusions reached?
Is an Officer of Parliament, not a not a member of the executive branch of government, and is therefore accountable directly to the legislature.
What provinces use common law?
All except Quebec
What is a common law system?
In common law systems, laws are found in statutes (bills that have been introduced, debated and passed by the legislative branch of government) and in case law.
Accordingly, the judiciary’s role is instrumental in the development of law because this “judge-made” law is on equal footing with any statute-based law.
What is a civil law system?
In civil law jurisdictions, laws are are codified into a civil code, which obviates the need to search through judicial decisions to determine what laws exist.
What are 4 sources of Canadian law?
Legislation
Common Law
Contracts
Constitution and the Charter
What federal legislation imposes rules regarding PI?
The Privacy Act
What 3 things does the Privacy Act do?
Imposes rules that govern the government’s collection,
use and disclosure of personal information.
Provides for a right of access to PI
Sets up the OPC to oversee and enforce the Privacy Act
What is the name of the legislation that each province has that is similar to the Privacy Act typically referred to?
Freedom of Information and Protection of Privacy, though each law has slightly different approaches
What legislation governs the private sector?
Personal Information Protection and Electronic Documents Act (PIPEDA)
What organizations are excepted from PIPEDA?
Private sector organizations that that are subject to substantially similar legislation to PIPEDA passed by a province.
Which (4) provinces have substantially similar legislation to PIPEDA?
Personal Information Protection Act in
Alberta (“Alberta PIPA”)
Personal Information Protection Act in British
Columbia (“BC PIPA”)
Act Respecting the Protection of Personal Information in the Private Sector in Quebec (“the Quebec Act”),
Personal Health Information Protection Act in Ontario (PHIPA)
What is common law often referred to as?
Judge-made law because it is derived over time from the various rulings, decisions and interpretations made
by judges who hear the cases that are brought before them.
Judge-made law that protects privacy in Canada is in its infancy
Has there been any Supreme Court decisions that have endorsed a tort-based privacy right?
One Supreme Court of Canada decision from the late 1990s upheld a plaintiff’s claim for damages b/c a photograph of her was used on a magazine cover.
Have there been any court decisions that have endorsed a tort-based privacy right?
Ontario Court of Appeal recognized the tort of intrusion upon seclusion in Jones v Tsige in 2012
What is part of the problem with the advancement of privacy as a right protected in tort law?
Traditionally, the notion of privacy was well protected by more traditional interests such as trespass and nuisance
What are contracts?
Private laws created by parties who agree to be bound by certain terms
What do contracts do with respect to privacy?
Privacy rights can be created and protected by contracts when the parties to the contract agree to respect the confidentiality and security of the information they become privy to b/c of the contractual arrangement or other discrete terms within the contract, such as privacy or security terms.
Often occur within a commercial or employment context
When are contracts most often used?
In outsourcing situations where one party provides personal information under its control to another party. The receiving party is often asked to be contractually bound to protect that PI and to keep it properly safeguarded.
How does the Canadian Charter of Rights and Freedoms protect privacy?
Applies only to government action; private litigants would not be able to base a claim for breach of privacy against anyone other than a government entity
Section 7 of the Charter states that “everyone has the right to life, liberty and security of the person and the right not to be deprived thereof except in accordance with the principles of fundamental justice.” While there is no mention of the word privacy, there is an emerging body of case law that supports the view that Section 7 serves as a source of constitutional protection of the right to privacy.
Section 8 of the Charter states: “everyone has the right to be secure against unreasonable search or seizure.”
When is section 8 of the Charter used?
In the criminal and administrative context to prevent government authorities from violating privacy rights while gathering evidence, conducting investigations or conducting
administrative functions (such as inspecting food-packaging plants).
Triggered when the state interferes with an individual’s reasonable expectation of privacy and when such interference itself is found to be unreasonable.
In what context does contracts and tort-based privacy rights arise?
Between private parties and unless settled privately are enforced through the courts
In what context does Charter-based privacy rights arise?
In actions against the government?
Who oversees legislated rights to privacy protection under the Privacy Act and in PIPEDA?
OPC
Who oversees legislated rights to privacy protection in provinces where there is not a commissioner?
Ombudspeople
When is a privacy investigation by the OPC launched?
Only after a complaint is lodged- though sometimes the commissioners themselves can commence complaints.
What happens after the OPC completes an investigation?
Renders a report and matter may proceed to court.
What is a “de novo” hearing?
A brand new hearing.
Privacy in Canada is protected by rules and principles that govern what?
What governments and organizations can do with PI
What is the catalyst for any privacy issue?
A determination that the type of information being
discussed is indeed personal information
What is PI considered to be?
Any identifiable information about an individual
What is an example of what is not PI?
purely corporate information (e.g., trade secrets, confidential business info, or nonidentifiable info belonging to groups of people) is not PI, and such info is not protected by Canadian privacy laws (although non-privacy laws may apply)
Why is it important to determine which provincial or federal act a particular issue falls under?
B/c each provincial or federal law will have its own definition of PI
What information does the Privacy Act apply to?
To information under the control of federal government institutions
What PI does the Privacy Act apply to of note? Why is this important?
Privacy Act considers opinions about an individual to be the
personal information of that individual.
This important b/c it means that privacy laws provide a right of access to one’s own PI. Eg. if Jones has expressed an opinion about Smith that was documented, Smith can discover it by making a request to see his own personal information. Under the Privacy Act, not only can Smith see the content of the opinion about himself, but he will often be allowed to know the identity of the opinion holder as well. This is b/c the identity of the opinion holder is considered the PI of both the opinion holder and the opinion subject.
What is one stumbling block across Canada regarding the interpretation of PI?
The difficulty of interpreting the meaning of “about” as it is used in the phrase “about an identifiable individual”
What did the Supreme Court say about the Privacy Act’s definition of PI?
Definition is undeniably expansive.
Language is deliberately broad and entirely consistent with the great pains that have been taken to safeguard individual identity.
Its intent seems to be to capture any information about a specific person, subject only to specific exceptions.
What has the expansive definition of the term PI under the Privacy Act been used for?
To justify finding that many categories of info, regardless of whether the info is sensitive, private, innocuous or well-known are PI
Notably used by some judges to conclude that job-related info fall sunder the definition of PI and thus merits some protection under privacy legislation
When can information by itself that does not identify an individual be PI?
When if, in combination with other information, it could be used to identify an individual
Eg. In 2008, the federal court determined that data regarding the provincial location in which medical patients were treated was personal information because such data, when coupled with other available data, could lead to the identification of individual patients. In In adopting a new test to determine what should be considered PI, the court provided that “information will be about an individual where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information.
Why do most laws provide exceptions to the definition of PI?
Public policy reasons
To recognize that while some data might otherwise be considered to be about an identifiable individual, there is a public policy reason for not treating it as such.
Eg. information about public-sector employees
Under PIPEDA, how is PI defined?
Information about an identifiable individual.
Similar to the Privacy Act’s definition - intentionally broad and expansive interpretation
Who does PIPEDA apply to?
Applies to every organization that “collects, uses or discloses PI in the course of commercial activities” or “is about an employee of the organization and that the organization collects, uses or discloses PI in connection with the operation of a federal work, undertaking or business.
In the business context, what information is treated differently by PIPEDA?
An employee’s business contact information is treated differently in that it is said not to apply to an organization in respect of the business contact info of an individual that the organization collects, uses or discloses solely for the purpose of communication or facilitating communication with the individual in relation to their employment, business or profession.
This also includes an individual’s work cell phone records.
Under PIPEDA, what other context is caught by its definition of PI?
Health context
What does one of the most widely debated arguments in Canadian privacy law concern?
Whether separate laws ought to exist for employee information and work product information
What is employee info. often thought of and defined as?
“‘personal employee information’ means, in respect of an individual who is an employee or a potential employee, personal information reasonably required by an organization that is collected, used or disclosed solely for the purposes of establishing, managing or terminating:(i) an employment relationship; or,(ii) a volunteer work relationship between the organization and the individual but does not include personal information about the individual that is unrelated to that relationship
What is work-product info. generally thought of?
Information about an individual that is related to that individual’s position, functions and/or performance of their job.
What information does PIPEDA not differentiate between?
Regular personal information and employee-related information or work-product information.
What information does the Privacy Act carve out from its definition of PI?
Carves out some employment and work-product-related information
What is a common reason for not protecting PI?
Where the PI is publicly available.
Which provinces attempt to deal with the question of employee-related PI?
BC and AB by defining it.
How does the Privacy Act deal w/ publicly available PI?
Provides that a government’s restricted ability to use and disclose personal information does not apply if the information is publicly available.
However, the government’s obligations to collect the
information in accordance with the act are not affected by whether the info. is available
No definition in the Privacy Act to help guide users as to what is and is not considered publicly available.
What information does the Privacy Act provide a total exception to?
Any information that is found in a “library or museum material preserved solely for public reference or exhibition purposes; or material placed in the Library and Archives of Canada, the National Gallery of Canada, the Canadian Museum of Civilization, the Canadian Museum of Nature or the National Museum of Science and Technology by or on
behalf of persons or organizations other than government institutions.
How does PIPEDA treat publicly available info?
Generally, PIPEDA requires the knowledge and consent of an individual before collection, use or disclosure of personal information can take place.
However, PIPEDA states that an organization may collect, use or disclose personal information without the knowledge or consent of the individual if the personal information is publicly available and is specified by the regulations.
For the purposes of PIPEDA, it is a fact-specific inquiry as to whether info is found to be “publicly available”.
What are some general principles of PIPEDA compliance regarding publicly available information that have arisen from Canadian Courts?
Merely because an individual appears in public does not mean they “automatically forfeit” their “interest in retaining control over the personal information which is thereby exposed
For an organization to be exempted from the consent requirement, the personal information must be both publicly available and specified by the regulations
The exception to the consent requirement does not apply to the organization that initially collects the information for the purposes of subsequently making it publicly available.
How is more information meeting the criteria for publicly available?
With the advent of online social networking and the
ability to find info about individuals easily via the internet, more info is meeting the criteria for publicly available.
What does the law often dictate when making determination about whether private and sensitive information can be released?
The info. can only be released if doing so would not be an unreasonable invasion of privacy.
What is one of the most influential principles in the development of Canadian privacy law?
The Organisation for Economic Co-operation and Development (OECD)’s set of 8 privacy principles entitled “Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.”
What did the Canadian Standards Association do?
Broke the OECD’s code into 10 principles that were incorporated as a schedule to Canada’s private-sector privacy law, PIPEDA and formed the basis of the principles of the Canadian Standards Association.
What are the CSA’s principles called?
the “Model Code for the Protection of Personal Information” (“Code”)
Why did the CSA develop the “Model Code for the Protection of Personal Information”?
Developed in order to assist with finding a balance btw legitimate business interests and the individual right to privacy.
Who influenced the CSA’s “Model Code for the Protection of Personal Information”?
Was influenced by a committee concerned with protection of privacy in Canada.
What are the CSA’s 10 principles?
Accountability
Identifying Purposes
Consent
Limiting Collection
Limiting Use, Disclosure and Retention
Accuracy
Safeguards
Openness
Individual Access
Challenging Compliance
What does the CSA’s Accountability principle require?
An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles.
What does the CSA’s Identifying Purposes principle require?
The purposes for which PI is collected shall be identified by the organization at or before the time the information is collected.
What does the CSA’s Consent principle require?
The knowledge and consent of the individual are required for the collection, use or disclosure of PI, except where inappropriate.
What does the CSA’s Limiting Collection principle require?
The collection of PI shall be limited to that which is necessary for the purposes identified by the organization.
What does the CSA’s Limiting Use, Disclosure and Retention principle require?
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.
What does the CSA’s Accuracy principle require?
Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
What does the Canadian Standard Association’s Safeguards principle require?
Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
What does the CSA’s Openness principle require?
An organization shall make readily available to individuals specific info about its policies and practices relating to the management of PI.
What does the CSA’s Individual Access principle require?
Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
What does the CSA’s Challenging Compliance principle require?
An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization’s compliance.
Who developed the Generally Accepted Privacy Principles (GAAP)?
Jointly developed by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA)
Who is meant to use the Generally Accepted Privacy Principles (GAAP)?
The GAPP are meant to be used by any organization involved in the handling of personal information.
These principles were established to help businesses navigate the competing interests of business, government and consumers.
How is each principle in the Generally Accepted Privacy Principles (GAAP) supported?
Each principle is supported by “objective and measurable criteria” available in the full text of the document
What are the 10 principles of the Generally Accepted Privacy Principles (GAAP)?
Management
Notice
Choice and consent
Collection
Use, retention and disposal
Collection
Use, retention and disposal
Access
Disclosure to third parties
Security for privacy
Quality
Monitoring and enforcement
What is private-sector privacy legislation in Canada based on?
The 10 fair information principles found in Schedule 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA)?
What same basic tenet of the privacy principles as they apply to organization’ handling of PI does both Canadian and international privacy laws follow?
The Accountability principle.
What is the Accountability principle?
An organization:
- Must implement procedures that protect PI
- Establish procedures to receive and respond to complaints or questions
- Train staff
- Be transparent about all these procedures and practices
The obligations under the Accountability principle more often than not culminate in what document?
A privacy policy
What is a privacy policy?
A document that tells customers, potential customers, employees and any other individuals who might have their PI collected, used or disclosed by the organization what the organization’s PI-handling practices are.
What does the Accountability principle require?
An organization to appoint individuals with primary responsibility for privacy protection.
Makes organizations responsible for the PI over which they have either custody or control.
For ex. if an organization outsources some functions and the outsourced entity will have access to the PI collected by the organization, the organization must ensure that the 3P is contractually bound to the organization in a manner that provides adequate protection for the PI.
What case is an example of how the Accountability principle has been interpreted that arose?
Google Inc’s release of Google Buzz - a social networking tool that automatically draws upon contact information from a user’s Gmail account, adding certain contacts as “followers” and thereby revealing potentially sensitive user information.
As a result, the data protection commissioners from around the world called on Google and all large social media
companies to be more accountable for the information they control.
What is the Identifying Purposes principle?
The obligation of organizations to identify and document the purposes for the collection of any personal information at or before the time of collection.
When is the Identifying Purposes principle breached?
If personal information is collected for a different purpose then the individual’s privacy has been violated and the principle breached.
What must an organization do if subsequent to the collection and original identification of the purpose for the collection, the organization wishes to use the personal information for a different purpose?
It must procure new consent after the new purpose is communicated to the individual.
What challenges does the Identifying Purposes principle create for organizations?
To describe their purposes in ways that are precise enough to provide valuable information to individuals but broad enough to include potential future purposes so they don’t need to obtain consent every time they identify a new use for PI.
What is the Consent principle?
The general principle states that an organization may collect, use or disclose PI only if an individual consents.
What does the Identifying Purposes principle often lead organizations to do?
State purposes for use in a broad manner (i.e. be as vague and as broad as possible).
What is paramount to the concept of consent?
That it be informed and meaningful.
What does it mean that consent be informed and meaningul?
This requires the individual to know and understand the purposes for the C, U or D of the PI.
What is sensitive PI?
Sensitive PI is information that is more significantly related to the notion of a reasonable expectation of privacy (e.g. medical or financial info., also pieces of info that, if procured by the wrong individuals, could result in serious cases of identity theft, might also be considered sensitive PI).
Why is the Consent principle flexible?
Acknowledging that different situations require different standards.
When can organizations rely on implied consent?
When the PI being collected is innocuous and the purpose of the collection straightforward.
When are opt-out options for consent permitted?
When the PI being collected is innocuous and the purpose of the collection straightforward.
When are opt-in consent options required?
When the PI is sensitive, explicit and
documented.
What does the Consent principle require that organizations not do as a condition of the supply of a product or service?
Require an individual to consent to the
collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purpose.
For example: a customer entering
her favourite electronics store to buy AA batteries cannot be required to share her address as a condition for her transaction, as it is neither related or necessary.
What does the Consent principle give each individual the opportunity to do?
Withdraw consent
Regarding consent, what do organizations need to peform because of the difficulty and complexity of managing PI holdings?
The need for many organizations to perform periodic privacy audits to ensure the required consents are being obtained and documented.
What are privacy audits or assessments?
Exercises performed internally or by independent third parties to ensure that an organization holds personal information in compliance with the various privacy obligations to which the organization may be subject and with internal privacy standards established by the organization, such as commitments specified in an online privacy notice for customers.
Why is the Consent principle under considerable strain?
The opaque nature of the privacy policies that are the basis of consent, complex
information flows, and business processes that involved a multitude of 3P intermediaries.
In this complex and rapidly changing digital environment, it can be exceedingly difficult for consumers to determine exactly what info they are sharing and with whom.
What does the Limiting Purposes principle require?
Requires organizations to collect only the amount and type of PI legitimately needed to fulfull the identified purpose.
Requires that organizations not collect PI indiscriminately or beyond the scope of services provided.
What does the Limiting Use, Disclosure and Retention principle require?
This principle requires that “personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.
PI shall be retained only as long as necessary for the fulfillment of those purposes.
What principle prevents organizations from collecting PI by misleading individuals or being less than candid about the purpose of the collection?
The Limited Purposes principle
What notion is aligned with the Limiting Use, Disclosure and Retention principle?
The notion that collection of excess PI can become a potential liability for an organization, requiring the protection and destruction of information that was not needed in the first instance. For these reasons, it is important that organizations carefully consider the information required to fulfil the purposes they have outlined.
What does the Limiting Use, Disclosure and Retention principle require once the purpose for the C, U or D of the PI has been fulfilled?
This principle directs an organization to destroy the PI. This requires organizations to address the issue of retention schedules beforehand and to develop guidelines and procedures for the adequate destruction of PI at the appropriate time.
What are two important points to remember about retention regarding the Limiting Use, Disclosure and Retention principle?
(1) PI that has been used to make a decision about an individual should be retained long enough to allow the individual access to the information after the decision
(2) An organization may be subject to legislative requirements with respect to retention periods for certain types of information.
What does the Limiting Use, Disclosure and Retention principle provide little practical guidance on?
The time and manner of destruction of PI.
What is the specific implementation of the Accuracy principle heavily dependent on?
The context surrounding the collection, use, disclosure and type of PI.
What is the Accuracy principle?
The principle that obliges organizations to keep personal information as “accurate, complete and up-to-date as is necessary for the purposes for which it is being used.”
What is idea behind the Accuracy principle?
That organizations should make sure the
information they are using to make decisions about providing credit or medical
care to people is accurate in order to avoid inappropriate decisions or ill-fated
consequences.
What does the Accuracy principle not always require that organizations do?
Keep information up to date (unless such a process is necessary to fulful the purposes for which the info was collected).
What does the Safeguards principle require of security safeguards adopted by organizations?
Must protect PI against loss or theft as well as unauthorized access, disclosure, copying, use or modification. This obligation transcends media, applying equally to paper-based and electronic data.
What makes it difficult for the Safeguards principle to be implemented?
The complexity surrounding the technology of information holdings.
The rapid rate of technological change, which complicates any conclusion about whether a particular safeguarding method is sufficiently secure.
What type of PI must be encrypted according to the Safeguards principle?
Sensitive PI stored on any mobile device or information that can be accessed or transmitted across public wireless networks.
How should information be protected with respect to sensitivity according to the Safeguards principle?
The sensitivity of the information, such that financial or medical info should receive greater security protection than address info.
What does the level of encryption depend on according to the Safeguards principle?
Sensitivity of the information
Cost-benefit analysis of the various technological solutions
System performance.
What does the Safeguards principle imply the obligation for organizations to create?
Procedures and practices that formalize the manner in which personal information will be kept safe, in particular the appropriate level of security applicable to the sensitivity of the PI, often called “data classification.”
What does the Openness principle require organizations do?
Make readily available to individuals specific information about their policies and practices relating to the management of PI.
How are policies generally made available because of the Openness principle?
Because organizations must be open about their policies and practices with respect to the management of personal information, these policies are generally made available electronically on websites and on paper at the customer service point of interaction.
What does the Individual Access principle require?
Organizations must be able to respond to requests from individuals for access to their personal information.
What obligations does the Individual Access principle incorporate?
This principle incorporates such obligations as the requirement to inform individuals of the existence, collection, use and disclosure of PI. Moreover, if an individual reviews their information and find inaccuracies, the organization must be prepared to record this appropriately.
When responding to requests for access what must an organization not do under the Individual Access principle?
An organization cannot unduly delay
What obligation are organizations generally under regarding the Individual Access principle?
Obligation to assist individuals trying to access their own personal information by being helpful and providing the information in a user-friendly format.
What does it mean, practically, that an organization must provide because of their obligation to assist individuals trying to access their own PI?
Organizations provide information from inside a database via a printout that
includes explanations for any codes contained in the database.
What does the Individual Access principle recognize?
That access to PI will not be required or desirable in every instance.
What is the most common exception for refusing access to PI?
Information protected by solicitor-client privilege.
What is the Challenging Compliance principle?
Individuals should have an ability to challenge the organization’s PI-handling practices.
When did PIPEDA come into force?
Jan. 1, 2001
Why was PIPEDA passed?
The Act was passed as part of the government’s electronic commerce strategy - a policy initiative reportedly motivated by the desire to make Canada a world leader in electronic commerce.
Before PIPEDA, what was Canada’s approach to privacy legislation largely based on?
Industry self-regulation
How are provincial organizations exempted from PIPEDA’s application?
If the organization is otherwise subject to a provincial law that has been declared “substantially similar” to PIPEDA.
What are two key concepts that must be properly understood with respect to the application of PIPEDA?
(1) The first is a matter of determining whether an organization is involved in a commercial activity.
PIPEDA applies to every organization that “collects, uses or discloses personal
information in the course of commercial activities”
or
(2) Whether the organization operates as or in connection with a federal work or undertaking.
“is about an employee of
the organization and that the organization collects, uses or discloses in connection
with the operation of a federal work, undertaking or business.”
How is PIPEDA unlike any other federal statute?
PIPEDA was drafted to apply across the country; however, the federal government explicitly invited the provincial governments to occupy their own fields of responsibility and pass their own privacy laws.
In what circumstances does PIPEDA permit organizations to collect, use or disclose PI?
(1) Only for purposes that a reasonable person would consider appropriate in the circumstances.
It places a heavy burden on an organization to be prepared to demonstrate that it is always acting reasonably in its treatment of PI.
(2) Only with consent.
What is PIPEDA’s applicability based on?
The constitutional limit to the powers of the federal government in Canada.
In support of this argument is the fact that PIPEDA applies only to organizations involved in commercial activities. The basis for this limitation is that the federal government’s jurisdiction rests on its power to regulate trade and commerce across the entire country. PIPEDA’s application to employees of organizations connected to or operating as federal works and undertakings rests on its constitutional ability to regulate industries that operate at a federal level (such as telecommunication companies, railways and airlines).
Under PIPEDA, when is consent valid?
PIPEDA states that consent of an individual is only valid if it is reasonable to expect that the individual would understand the nature, purpose and consequences of the collection, use or disclosure of their PI (unless PIPEDA permits otherwise)
What was hoped that the term “substantially similar’ would result in?
A greater alignment of federal and provincial private-sector privacy laws.
What 3 things are required in order for a provincial law be found to be substantially similar to PIPEDA?
(1) Must be consistent with the schedule for PIPEDA
(2) Has an independent oversight body like the OPC
(3) Contain a redress mechanism for those who are aggrieved
What provincial laws have been found to be substantially similar to PIPEDA?
Alberta’s Personal Information Protection Act (“Alberta PIPA”)
British Columbia’s Personal Information Protection Act (“BC PIPA”)
Quebec’s Act Respecting the Protection of Personal Information in the
Private Sector (“the Quebec Act”
Ontario’s Personal Health Information Protection Act of 2004
(PHIPA)
New Brunswick’s Personal Health Information Privacy and Access Act
(PHIPAA), with respect to personal health information custodians
Newfoundland and Labrador’s Personal Health Information Act (PHIA), with respect to personal health information custodians
Nova Scotia’s Personal Health Information Act (PHIA), with respect to health information custodians
What does PIPEDA define commercial activity to mean?
“any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling,
bartering or leasing of donor, membership or other fundraising lists.
