The most widely read magazine for Canadian lawyers
Issue link: https://digital.canadianlawyermag.com/i/50831
Stoddart's office has trod carefully. A few years ago, she asked the office of the priva- cy commissioner to look into an American web site, abika.com, that was, accord- ing to court documents, allegedly selling information about Canadians, including background checks, psychological profiles, cellphone numbers, and criminal records. Lawson, who paid $119 for a report on herself, filed a complaint under the Personal Information Protection and Electronic Documents Act alleging the company gave out information on Canadians without their permission. Stoddart's office, the Privacy Act, which governs the actions of government departments. Much of the advice focuses on how departments man- age privacy issues, especially in light of information-sharing practices that have developed among law enforcement agen- cies following the Sept. 11, 2001, terror- ist attacks. The Canada Border Services "One of the things we're dealing with though, declined to probe the case, arguing it didn't have jurisdiction to take action against compa- nies outside Canada even though the complaint had merit. In response, Lawson took the commis- sioner to Federal Court, which ruled that while privacy legislation doesn't specifi- cally authorize her to investigate such mat- ters, it doesn't preclude her from doing so either. Further, the judge noted that while probing the case might be difficult, espe- cially when the alleged violator declines to respond or co-operate, that doesn't mean it's not worth a try. The commissioner could also attempt to locate the company's Canadian operations, the judge wrote. It was the second time Lawson had launched a court challenge against the privacy commissioner over a cross-border matter, something she argues exemplifies the office's cautious approach. At the same time, Lawson disagrees with Stoddart's point that contracts between Canadian companies and the entities they outsource to can mitigate the risks of data breaches since a foreign government — under the U.S. Patriot Act, for example — can over- ride those agreements through the guise of national security. As a result, she'd like to see Stoddart adopt a blacklist of coun- tries that don't offer comparable privacy protection to Canadian laws. Stoddart has identified changes she would like to see to federal privacy legisla- tion to improve protections. In particular, she recommended several amendments to many advantages and conveniences in new technologies." Agency should consider its practice of verbally sharing information with other countries and track how often it does so, Stoddart's office recommended. She also addressed the issue of mandatory report- ing of data breaches to her office, some- thing neither government agencies nor private companies have to do now. "There are some irritants in PIPEDA that should be ironed out," she says, noting the act is to come up for review next year. Still, Lawson would like the govern- ment to go a few steps further in reform- ing privacy legislation. First, she wants authorities to lessen the financial risks people who take privacy cases to Federal Court face when they lose and find them- selves liable for costs. As well, she feels the court process should protect complain- ants' personal information, something that doesn't happen even though privacy is usually what the case is all about. Lawford, too, would like to see Stoddart have the authority to, in some cases, pro- hibit the transfer of sensitive information to outsourced companies overseas. "That could be an outcome, but we're not there because when she had a chance to ask for order-making powers, she didn't," he says, referring to her remarks before a parlia- mentary committee reviewing PIPEDA a few years ago. Stoddart, though, does have her hands is that people push their privacy or their personal information protection to the background because they see so — JENNIFER STODDART, PRIVACY COMMISSIONER OF CANADA full with the constantly emerging ways Canadians find their privacy in jeopardy. Just recently, her officials met with repre- sentatives of Google Inc. over that com- pany's plans to introduce interest-based advertising, which essentially allows mar- keters to target consumers based on what they do on the Internet, including the web pages they visit. "Clearly, behavioural advertising generally is again another challenge," she says, noting that while companies may vow to collect information in a way that masks who the user is, such protec- tions don't always work out as planned. "[Y]ou have data spills inadvertently. You have data breaches. You have organized crime being interested." One of the biggest issues, however, involves balancing the need to protect privacy with the desire by law enforcement agencies to probe cases that technology has rendered increasingly complex. Even in cases that appear to be legitimate intrusions for the purposes of law enforcement, Stoddart remains cau- tious. She praises Alberta privacy commis- sioner Frank Work's victory in that prov- ince's courts against a bar that challenged restrictions on the scanning of driver's licences. The club owners argued collect- ing the information would help prevent violence in bars, but Work ruled the bar didn't prove that doing so would stop the problem and ordered it to stop. Recently, the courts upheld that conclusion. It's on such stances against a so-called "surveillance society" that people like Lawford praise Stoddart's performance despite concerns over her actions against the private sector. In the end, however, Stoddart herself acknowledges the con- flicts inherent in privacy protection. Even she doesn't follow all the advice privacy advocates put out there. She doesn't do anything different with her garbage, for example, despite stories about how vul- nerable it can be to intruders. And while she worries about financial institutions sending out pre-approved cheques to their customers, she's not yet ready to heed rec- ommendations to lock her mailbox. www. C ANADIAN Law ye rmag.com M AY 2009 31