After nearly two years in the making, Bill C-6, the Personal Information Protection and Electronic Documents Act, was passed into law earlier this month by the federal government as a means to control the collection, use and disclosure of personal information.
Originally proposed in the fall of 1998, the law contains a protection component that will give individuals new legal rights when their personal information is collected, used or disclosed in the course of a "commercial activity."
John Gustavson, president and CEO of the Canadian Marketing Association says despite the fact the privacy issue has been front and centre within his association for the last several years, many businesses have done little, if anything, to prepare themselves for the passage of the law.
"A great part of Canadian business is sleepwalking into this," he says. "This will affect all personal transactions, not just Internet commerce, so marketers had better be aware of the fundamentals of handling personal information."
Gustavson adds that the CMA’s own Code of Ethics mirrors much of the new legislation, which goes into effect Jan. 1, 2001.
"If marketers have been paying attention and getting ready for this, they will be fine," he says. "It is not an overly onerous piece of legislation for those companies that are in the business of information handling. That’s why I say that CMA members are in good shape, but a lot of businesses across the country had better wake up."
Patricia Wilson, a partner with the Ottawa office of law firm Osler, Hoskin & Harcourt, agrees with Gustavson, saying that organizations that have adopted a privacy code such as the CMA’s should not find the legislation difficult to abide by.
"The legislation is directed at the activities of people who market in personal information, so to some extent, it will affect the operations of direct mailers and marketers," she says. "It will affect the operations and practices they use to handle the personal information they collect, but many of these companies have adopted a privacy code, so I can’t suggest that the law will be onerous for them."
Stacey Grant-Thompson, senior vice-president of marketing with ING Direct in Toronto, says that for her bank – and indeed, for most financial institutions – the legislation will actually have little impact.
"We’ve had a privacy policy right from the day we launched (in 1997)," she says. "As a bank, we’ve been pretty advanced. In effect, we’ve already been complying with the legislation (before it was enacted)."
The new law will be good, she adds, because it raises the bar with respect to how marketers deal with the privacy issue.
"It is important because it will reward good marketers," she says. "What the law might do is eliminate those who don’t have or respect privacy policies."
In a recent speech before the Canadian Bar Association, Privacy Commissioner Bruce Phillips said the legislation was about "the right to be let alone."
"It is about ensuring a fair balance between the legitimate information needs of the private sector and the essential rights of individuals in a democracy," he said. "It is not the objective of the bill to impede business.
"The objective is to help create a state of mind in which business routinely considers client, customer and employee privacy rights in developing products and administrative practices. This will not happen overnight. But business depends on satisfied clients and customers. Its reputation is any company’s most important asset, and no one will want to risk being singled out for willfully flouting the rights of individuals."
The Privacy Commission would receive and investigate any complaints under the new law. The Federal Court of Canada could impose penalties in case the law is broken, with punishment ranging from fines to ordering an organization to correct its practices, as well as publish a notice of any action taken to correct those practices.
Sidebar: What the law says
Bill C-6, the Personal Information Protection and Electronic Documents Act, comes into effect Jan. 1, 2001. Included here are some of the key elements of the new legislation, excerpted from the bill that was passed into law earlier this month. For more on the new law, see the federal government’s Privacy Commission Web site at: http://www.privcom.gc.ca/
• The data protection component of the act gives individuals new legal rights when their personal information is collected, used or disclosed in the course of a commercial activity.
• The identified purposes should be specified at or before the time of collection to the individual from whom the personal information is collected. Depending upon the way in which the information is collected, this can be done orally or in writing.
• When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use.
• Unless the new purpose is required by law, the consent of the individual is required before information can be used for that purpose.
• The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
• Consent shall not be obtained through deception. A person buying a magazine subscription, for instance, should expect that the organization, in addition to using the individual’s name and address for mailing and billing purposes, would also contact the person to solicit the renewal of the subscription. On the other hand, an individual would not reasonably expect that personal information given to a health-care professional would be given to a company selling health-care products, unless consent were obtained.
• The act contains a "primacy clause" meaning that the law takes precedence over subsequent laws, unless those laws specifically state otherwise.
• The law is designed to help Canada meet new data protection standards set by the European Union.
• The province of Quebec is currently the only jurisdiction in North America with a private sector data protection law that meets the EU requirements.
• Organizations shall not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is necessary to fulfil the purposes identified. DE
