"Every time Erwin Eastmond goes to work, he is being watched.

Cameras set up around Canadian Pacific Railway Ltd.'s maintenance shop in Scarborough, Ont., make it impossible for the 200 workers in the facility to avoid having their movements tracked by an array of security cameras. And that, Mr. Eastmond says, 'makes us very uneasy.'

So uneasy that Mr. Eastmond, a diesel engine electrician, lodged a complaint last year with the Privacy Commissioner of Canada. It has led to a landmark federal court case over surveillance in the workplace that was argued before a justice last week.

The case has become the biggest test to date of Canada's legal protections for the privacy of Canadian workers from a proliferation of sophisticated and inexpensive monitoring technology."

Duluth News Tribune | 04/18/2004 | Privacy issues develop over work done overseas:

"The growing business of shipping sensitive personal data overseas threatens the privacy rights of U.S. citizens, according to Sens. Hillary Rodham Clinton, D-N.Y., Bill Nelson, D-Fla., and other foes of outsourcing.

Clinton is pushing legislation that would make U.S. businesses legally liable if a foreign subcontractor abuses American privacy laws.

The bill also would require U.S. businesses -- such as accounting firms, physicians, hospitals and banks -- to gain consent from consumers before shipping their private data to an overseas contractor if the Federal Trade Commission has determined that the country where the contractor is based doesn't have adequate privacy laws.

The privacy issue gained the attention of lawmakers after a Pakistani woman, Lubna Baloch, who transcribed confidential medical records of patients at UC San Francisco Medical Center, threatened to post them on the Internet last October unless the hospital helped her collect an overdue bill from a man who hired her as a medical transcription subcontractor.

Baloch withdrew her threat after she was paid.

Sue Blevins, president of the Institute for Health Freedom, a nonprofit concerned with medical privacy, said if personal information like mental illness, alcoholism treatment, marriage counseling, illegal drug use or a sexually transmitted disease gets out to the public, 'it could be devastating and cause emotional pain and affect people's career, families or even the ability to get a mortgage.'"

Duluth News Tribune | 04/18/2004 | Privacy issues develop over work done overseas:

"The growing business of shipping sensitive personal data overseas threatens the privacy rights of U.S. citizens, according to Sens. Hillary Rodham Clinton, D-N.Y., Bill Nelson, D-Fla., and other foes of outsourcing.

Clinton is pushing legislation that would make U.S. businesses legally liable if a foreign subcontractor abuses American privacy laws.

The bill also would require U.S. businesses -- such as accounting firms, physicians, hospitals and banks -- to gain consent from consumers before shipping their private data to an overseas contractor if the Federal Trade Commission has determined that the country where the contractor is based doesn't have adequate privacy laws.

The privacy issue gained the attention of lawmakers after a Pakistani woman, Lubna Baloch, who transcribed confidential medical records of patients at UC San Francisco Medical Center, threatened to post them on the Internet last October unless the hospital helped her collect an overdue bill from a man who hired her as a medical transcription subcontractor.

Baloch withdrew her threat after she was paid.

Sue Blevins, president of the Institute for Health Freedom, a nonprofit concerned with medical privacy, said if personal information like mental illness, alcoholism treatment, marriage counseling, illegal drug use or a sexually transmitted disease gets out to the public, 'it could be devastating and cause emotional pain and affect people's career, families or even the ability to get a mortgage.'"

Globetechnology: "The Canadian Recording Industry Association has filed an appeal of the recent court decision denying CRIA's request for Internet Service Providers to reveal the identities of alleged uploaders of digital music. ...

"Today we filed an appeal of last month's court decision," CRIA General Counsel Richard Pfohl said in a statement. "We will argue that the decision was in error on a number of legal bases.

"In our view, Canadian copyright law does not allow people to make copies of hundreds or thousands of musical recordings for global copying, transmission and distribution to millions of strangers on the Internet," he said.

"Any owner of intellectual property that can be digitally transmitted has a stake in this appeal process," CRIA president Brian Robertson said.

The appeal comes at a time when news of the recording industry's profits or losses have been highly contradictory."

TheStar.com - Weak enforcement undermines privacy laws:

"If the commissioner's office is to take the lead on cutting edge issues and increase its enforcement activity, the federal government must step up to the plate to provide it with much-needed resources.

In the wake of last year's scandal involving former privacy commissioner George Radwanski, the office has faced significant budget pressures that have constrained new hiring and sadly transformed the current privacy legislation into a complaints-only-driven process.

While there is no doubt the will at the commissioner's office to ensure that PIPEDA meets expectations, the federal government must help pave the way.

It is evident that privacy laws without effective enforcement and genuine transparency may provide Canadians with little more than placebo privacy protection.

Ensuring that this does not happen is, in the words of the privacy commissioner, a question of responsibility."

The law requires businesses, large and small, to put systems in place that will make sure customer information is secure, accurate, gathered with consent and not used beyond a stated purpose.

Heather Black, assistant federal privacy commissioner, said Canadians are taking advantage of their newfound privacy rights but many businesses, when asked to explain how and why they collect and use customer information, aren't providing adequate answers.

'When people ask why they're being asked for this information, they're not getting very satisfactory responses,' said Black. 'So it really is a communications gap.'

The commission began noticing this trend in January, specifically in the retail sector. Black said a number of people have filed complaints against certain retail outlets that require customers to provide their names, phone numbers and addresses when goods are returned for refund or exchange."

"4. Privacy legislation applies across Canada.

The federal privacy legislation constitutionality provided that, if similar legislation was not passed in each province by January 1, 2004, the federal legislation would apply provincially. Many provinces, including Ontario, have not yet passed Privacy Acts. However, virtually everyone is conducting themselves as if the federal privacy legislation applies. It does not. Despite the wording of that legislation, the federal government lacks the constitutional power to impose privacy legislation on the provinces and no attempt to do so would survive legal challenge. Therefore, contrary to seemingly everyone's belief, there is presently no effective, binding privacy legislation in most of Canada."

I just came across the reference to me on your blog (http://pipeda.blogspot.com/2004_01_04_pipeda_archive.html#107338559447219057).

It's ironic that your "sources at the Office of the Privacy Commissioner" infringed on my privacy by telling you that my complaint "was sent by e-mail on January 1, 2001 at 12:01 am." The Privacy Commissioner should not unnecessarily divulge details about complaints and complainants.

In any event the information is wrong. I did not file my complaint by e-mail.

You can post this email on your web site if you like, but of course not my email address (which is a disposable address anyway).

Mathew Englander

[ ConnectIT e-News Daily ]:
"Privacy officer for hire
6 April, 2004
by Liam Lahey

Security solutions provider Thor Solutions Inc. and law firm McInnes Cooper have teamed up to form National Privacy Services Inc. (NPSI) � a partnership designed to help small to mid-sized businesses (SMBs) understand and comply with Canada�s federal privacy legislation.

According to David T.S. Fraser, chair of McInnes Cooper's privacy group in Halifax, NPSI helps SMBs avoid the expense of building a solution from scratch, spending a great deal of time trying to become privacy experts themselves, and/or ignoring the legislation and risking their businesses by being identified as non-compliant. "

ITBusiness.ca: "Canada's largest marketing industry group has amended its Code of Ethics and Standards of Practice to deal with the growing volume of unsolicited commercial e-mail.

The Canadian Marketing Association said the amendments would apply immediately to all 800 of its corporate members, and would be specific to e-marketing programs.

Under the new rules, CMA members must obtain a consumer�s explicit or opt-in consent before disclosing their e-mail address to a third party; use the e-mail address only for the purposes that have been disclosed to the consumer; and clearly identify the CMA member and source of the e-mail. They must also provide the recipient with a simple and easy-to-use e-mail means to opt-out from receiving further e-mail marketing communications from the marketer.

CMA communications director Ed Cartwright recently spoke with Pipeline about the changes...."

The Financial Times: Security Scare for Business Laptops

Business travellers are unwittingly making company secrets available to rivals by ignoring the risks of local wireless networks, known as wi-fi hotspots, security experts warn.

IT security experts who have carried out checks at hotels, railway stations and other public places equipped with wireless internet access technology have found the networks and users' computers are often insecure. "It's actually happening: there is competitive intelligence being gathered," said Richard Hollis, chief executive of Orthus, a security firm.

Hackers - who need little specialist knowledge - can access contents of a rival's laptop because other users' files are visible to anybody using an unsecured wireless network. Hackers are also using wi-fi hotspots to store their files on other computers.

Articles and presentations

General

• Introduction to PIPEDA
• Does PIPEDA apply to my organization
• PIPEDA and information security
• PIPEDA and document destruction
• PIPEDA and websites
• PIPEDA and social insurance numbers
• PIPEDA and personal health information
• PIPEDA and the unionized workplace

Insurance

• PIPEDA and video surveillance

Call centres

• PIPEDA and call monitoring
• PIPEDA findings affect call centres

Credit Grantors

• PIPEDA and credit grantors (presentation)
• PIPEDA and social insurance numbers
•  

Tourism

• PIPEDA and Tourism Industry
• PIPEDA and the tourism sector (presentation)

Medical/health

• PIPEDA and employee medical information

Universities/colleges

• PIPEDA and universities and colleges.pdf

Law firms

• PIPEDA and law firms (presentation)

All articles are (c) David T.S. Fraser and/or McInnes Cooper

[13] I read the Norwich and Glaxco Wellcome cases as establishing that the test for granting an equitable bill of discovery involves the following five criteria: ...

Criterion e: the public interests in favour of disclosure must outweigh the legitimate privacy concerns

[36] It is unquestionable but that the protection of privacy is of utmost importance to Canadian society. In the words of Lamer J. in R. v. Dyment, [1988] 2 S.C.R. 417 (S.C.C.): Grounded in man's physical and moral autonomy, privacy is essential for the well-being of the individual. For this reason alone, it is worthy of constitutional protection, but it also has profound significance for the public order.

[37] In respect of the internet specifically, Wilkins J. in Irwin Toy v. Doe (2000), 12 C.P.C. (5th) 103 (Ont. S.C.J.) stated at paras. 10-11: Implicit in the passage of information through the internet by utilization of an alias or pseudonym is the mutual understanding that, to some degree, the identity of the source will be concealed. Some internet service providers inform the users of their services that they will safeguard their privacy and/or conceal their identity and, apparently, they even go so far as to have their privacy policies reviewed and audited for compliance. Generally speaking, it is understood that a person's internet protocol address will not be disclosed. Apparently, some internet service providers require their customers to agree that they will not transmit messages that are defamatory or libellous in exchange for the internet service to take reasonable measures to protect the privacy of the originator of the information. In keeping with the protocol or etiquette developed in the usage of the internet, some degree of privacy or confidentiality with respect to the identity of the internet protocol address of the originator of a message has significant safety value and is in keeping with what should be perceived as being good public policy. As far as I am aware, there is no duty or obligation upon the internet service provider to voluntarily disclose the identity of an internet protocol address, or to provide that information upon request.

[38] Parliament has also recognized the need to protect privacy by enacting PIPEDA, which has as one of its primary purposes the protection of an individual’s right to control the collection, use and disclosure of personal information by private organizations (section 3).

[39] However while the law protects an individual’s right to privacy, privacy cannot be used to protect a person from the application of either civil or criminal liability. Accordingly, there is no limitation in PIPEDA restricting the ability of the Court to order production of documents related to their identity. Section 7(3)(c) allows disclosure without consent if such disclosure is: c) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records. (emphasis added).

[40] Thus, both PIPEDA as well as the test set out in Norwich/Glaxco, require the Court to balance privacy rights against the rights of other individuals and the public interest.

[41] This motion is not a novel proceeding. In the past, third parties have been compelled to disclose documents identifying the name and address of a defendant previously identified solely by an Internet Protocol address. In no case have privacy or other concerns weighing against disclosure outweighed the interest in obtaining documents and information necessary to identify the defendants. See: Irwin Toy v. Doe (2000), 12 C.P.C. (5th) 103 (Ont. S.C.J.); Ontario First Nations Limited Partnership v. John Doe (3 June 2002) (Ont.S.C.J.); Canadian Blood Services/Société Canadienne du Sang v. John Doe (June 17, 2002) (Ont. S.C.J.); Wa’el Chehab v. John Doe (October 3, 2003) (Ont. S.C.J.); Kibale v. Canada, [1991] F.C.J. No. 634 (QL) (FC); Loblaw Companies Ltd. v. Aliant Telecom Inc. and Yahoo [2003] N.B.J. No.208 (N.B.Q.B.), online: QL (NBJ).

Turning online privacy into a joke | Perspectives | CNET News.com:
"In a survey of the adult online population, conducted by The Customer Respect Group in February 2004, the importance of respectful treatment of consumers' privacy concerns was underlined by some dramatic findings. When survey participants were asked how much they care about a company's privacy policy when invited to enter personal information to a Web site, 22.4 percent responded that in the absence of a privacy policy, they would not offer the information. A further 26.6 percent echoed this sentiment by indicating that if they were unhappy with a company's privacy policy they would leave the site. "