"47. Under PIPEDA, can regulatory bodies/colleges still continue to conduct their investigative practices? Does PIPEDA require any changes in the manner in which these investigative activities are conducted?

The relationship between a regulatory body/college and its members is most often of a noncommercial nature, and therefore not captured by PIPEDA. These bodies are also generally empowered by law to obtain personal information as necessary to fulfill their various functions. Professionals subject to the authority of a regulatory body/college would in all likelihood have agreed to the use of their personal information by the body, as part of a condition of membership. PIPEDA recognizes such authority.

Regulatory bodies/colleges may, in the course of their function, need to obtain personal information from other organizations that are subject to PIPEDA, such as financial institutions. Such organizations may only disclose personal information without consent to entities that have been designated as "investigative bodies" under PIPEDA, by regulation. As such, regulatory bodies/colleges may be required to obtain this designation if they wish to obtain personal information from these organizations without an individual's consent."

(d) made on the initiative of the organization to an investigative body, a government institution or a part of a government institution and the organization

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is ...

Yahoo! News - US Charges AOL Worker Sold Customer List for Spam:

"Jason Smathers of Harpers Ferry, West Virginia, has been charged with stealing a list of 92 million AOL customer screen names and selling them to Internet marketer Sean Dunaway of Las Vegas, said David Kelley, the U.S. attorney for the Southern District of New York in a statement. "

You're just a number: New technology is tracking you in ways that may be a surprise

"LYNN MOORE
The Gazette

Sunday, June 20, 2004

Most Montrealers first learned that late-model cars are equipped with 'black box' technology from media coverage of a recent trial.

Their surprise was likely tempered with satisfaction because the technology brought some justice to the tragic death of a university student. Black-box data showed that Eric Gauthier was driving along Ste. Catherine St. at 157 kilometres per hour just seconds before he struck and killed Yacine Zinet.

More surprising - and disturbing for some - is that the technology used to convict Gauthier is tame in terms of what is out there - to help us, it's said, but available for use against us."

Families private files left on a tram. 16/06/2004. ABC News Online:

"Families private files left on a tram

The Federal Government has apologised to 15 families whose private files were left by a Child Support Agency staffer on a tram.

Victorian Labor Senator Gavan Marshall has told Parliament the files contained personal details such as names and addresses and affected families were forced to change their tax file numbers and bank accounts at their own expense.

'Can the minister confirm that this serious breach has been referred to the privacy commissioner and whether the Government will compensate affected families for the costs and distress caused?' he said.

Families Minister Kay Patterson has told Parliament it was an unfortunate mistake, conceding some of the information still has not been located.

She says affected families were contacted and apologised to, but she will not commit to compensation.

'We need to move away from litigation and compensation,' she said.

Senator Marshall also told Parliament one of families was mistakenly sent another family's file more than a year ago, but the Minister would not confirm that."

A Closer Look at the Fine Print in Privacy Statements:

"Most major companies (Novell, IBM, Oracle, HP, Microsoft, and so on) have very similar privacy statements. Zubair Alexander takes a closer look at the fine print in these statements: what type of data or personal information may be collected from you, and who it's shared with. What's in the fine print may surprise you."

"News Story by Narayanan Madhavan

JUNE 10, 2004 (REUTERS) - India's booming software and outsourcing sectors are trying to improve data protection to please increasingly security-conscious clients and to preempt protectionist laws, industry officials said today.

Officials at the National Association of Software and Service Companies (NASSCOM) told a news conference that they will work with customers, regulators and law enforcers to bolster 'trustworthy outsourcing' in India.

India, where English-speaking workers earn a fraction of what their Western counterparts make, exported $12.5 billion worth of software and services in the past year, up more than 30% from the previous year. But protectionist laws have surfaced in some U.S. states to prevent local governments from outsourcing back-office jobs to India, while candidates in the U.S. presidential election have also spoken of measures to check job losses. "

"Quebec's privacy watchdog issued public surveillance guidelines Wednesday after video cameras were installed on a drug-ridden street in Montreal.

The provincial access to information commission said public cameras should only be used as a last resort to prevent serious crime problems or for the protection of property.

Commission president Diane Boissinot said the cameras should only be used only at specific times for a specific period."

"federal work, undertaking or business" means any work, undertaking or business that is within the legislative authority of Parliament. It includes

"EDMONTON -- Many small businesses are still confused about, or completely ignorant of, a new federal privacy law that governs commercial activities, federal privacy commissioner Jennifer Stoddart said yesterday. Businesses have been required to follow specific rules for the collection, use and disclosure of information since Jan. 1.

Stoddart told the audience of more than 300 at a conference organized by the University of Alberta that the Personal Information Protection and Electronic Documents Act has caused great confusion.

'It is smaller organizations that feel overwhelmed by government bureaucracy,' Stoddart said. "

The Globe and Mail:

"Dear Susan,

Can a recruiter or potential employer contact a reference without your permission?

--MYOB

Dear MYOB,

Employers can and do, but they shouldn't. "I heard it through the grapevine" is still the anthem of talent scouts in certain sectors, recent privacy legislation notwithstanding. But asking for the straight dope without consent is risky. Not only does the practice breach ethical and legal boundaries about personal privacy, the information gleaned this way is hardly reliable. An opinion about an employee says more about the referee than the worker, according to reams of studies, and thus off-the-record telephone exchanges are becoming less common in reputable human resources circles. Without the employee's nod even something as basic as checking where a candidate is currently employed can jeopardize her career if her boss doesn't know she's looking around. So seeking the low-down behind an employee's back is bad form, possibly illegal and not exactly how you welcome a new recruit into the fold. The whole practice smells.

So what if it already happened? I'm no lawyer, but a cursory look at the federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and the three provinces that have their own privacy legislation (Quebec, Alberta and British Columbia) shows that most explicitly discourage employers from disclosing information without the employee's okay. Alberta is one exception, allowing employers to collect personal information about public employees "from any party without specific consent," according to a human resources guide published on the provincial government's Freedom of Information and Privacy website and confirmed by one of the government's information officers.

But all it takes is one test case to make Canadian employers clam up forever, says Vic Catano, a psychology professor and recruitment expert at St. Mary's University. That's what happened in the United States, when a referee not authorized by a candidate gave a negative point of view that off-sided an applicant for a vacant position. The employee sued and was awarded damages, an event that cast a pall on the reference-giving world. Even if a candidate has given permission, information not germane to the job is off-limits. It's irrelevant if you curl with the candidate's father. Just the facts, ma'am. Except for checking biographical facts with the candidate's permission, when it comes to references the rule is don't ask, don't tell. "

Patient privacy at risk in hospitals' hallways, lobbies, cafeterias:

"Patient privacy at risk in hospitals' hallways, lobbies, cafeterias

WEST LAFAYETTE, Ind. -- New health communication research shows that casual conversations in hospital hallways and waiting rooms poses a threat to the confidentiality of patients' medical information.

Research conducted at Purdue University by Maria Brann, assistant professor of communication studies at West Virginia University, and Marifran Mattson, associate professor of communication at Purdue, shows patient privacy is breached when hospital employees talk about patient cases in public areas, such as the cafeteria, or with people outside of work. The researchers' paper appears in the spring issue of the journal Health Communication."

Yahoo! News - For Sale by Public Auction -- Juicy Laptop Secrets:

"... In all, the firm's technicians were able to pull sensitive details from 70 of the 100 machines it bought.

In one case, it obtained a particularly vulnerable hard drive from online auction site eBay that apparently once belonged to one of Europe's largest insurance companies.

On the hard drive were current details of customers' pension plans, payroll records, personnel details, login codes and administration passwords for the company's Intranet site. Home addresses, telephone numbers and dates of birth of customers were also listed in 77 Microsoft Excel files, the company said. ..."

4.5 Principle 5 -- Limiting Use, Disclosure, and Retention

Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.

4.5.2

Organizations should develop guidelines and implement procedures with respect to the retention of personal information. These guidelines should include minimum and maximum retention periods. Personal information that has been used to make a decision about an individual shall be retained long enough to allow the individual access to the information after the decision has been made. An organization may be subject to legislative requirements with respect to retention periods.

4.5.3

Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.

CNN.com - Think before you text - Jun 7, 2004:

"DENVER, Colorado (AP) -- A few hours after NBA star Kobe Bryant had sex with a Vail-area hotel worker last summer, the woman exchanged cell phone text messages with a former boyfriend and someone else.

What's in those messages could help determine whether the sex was consensual or whether Bryant is guilty of rape as charged. The judge himself said the content may be 'highly relevant' to the case.

That the judge could order the woman's cell phone company to produce the messages so long after they were sent shouldn't surprise anyone, analysts say.

Texters beware. Like e-mail and Internet instant messages, text messages tend to be saved on servers.

'One of the false assumptions that people make is that when they hit the delete button, messages are gone forever, but nothing can be further from the truth,' said Jeff Kagan, an independent telecommunications analyst in Atlanta."

The Daily Telegraph | This is an Act of total bastardry:

By DAVID PENBERTHY

June 9, 2004

JUST over a year ago while driving home along Parramatta Rd I had one of those car accidents that restores your faith in human nature. Or so it seemed.

While changing lanes I failed to check my blindspot and side-swiped another car in the inside lane, smashing its front bumper and headlight and doing a fair bit of damage to my right-hand side.

Given that I was the one who was changing lanes, the accident was my fault. The other bloke couldn't have been nicer, especially, as he explained, he'd just had a new front bumper fitted.

We exchanged names and numbers. I was insured, he wasn't, but given that I was in the wrong it was a simple matter of paying the excess and lumping it.

I processed the forms, but forgot to pay the excess. A couple of weeks later I received a call from my apparent friend which not only spurred me into lightning action, but made me reassess my initial appraisal of the once-genial knockabout with whom I had the pleasure of colliding.

The bloke rang me out of the blue, told me he knew where I lived, that I didn't know what sort of person he was, and that if I didn't pay up by the end of the week he'd get the money off me by other means.

I know when I'm being threatened and did the only manly thing. I panicked like a girl. I rang the insurance company, gave them my credit card details, had it all paid within 60 seconds, and asked if they could provide me with my frightening friend's mobile number so I could reassure him that everything was cool.

"Sorry sir, under the Privacy Act we can't give you that number," the woman said.

"But I gave you his number," I said reasonably. "He doesn't have insurance. The only reason you have his number is because I took it at the scene and gave it to you on the form. I want to call him now to sort this out but I don't have it on me."

"Yes, sir, but under the Privacy Act I can't give it to you."

"So how did you get his number?"

"That's not the point, sir."

Etcetera. After some journalistic theatrics – where I explained to the woman (with the mildest exaggeration) that I feared for my safety – the woman relented, albeit in a drawn-out New Price is Right-type charade where I guessed the first two numbers were 04, and then played higher and lower for the remaining eight digits.

I didn't win the car, or even the vacuum cleaner, but I came away with the feeling that the Privacy Act may be one of the daftest pieces of legislation going around.

..."

London Free Press: Business Section - Law amended for e-mail:

"The Criminal Code of Canada makes it an indictable offence to "willfully" intercept a private communication. On April 22, Bill C-14 came into effect, which among other things amends the Criminal Code to protect computer system managers from the threat of criminal conviction. The bill amends the Criminal Code to add a section that allows computer system managers to intercept a private communication. Interception under this new provision is lawful only if it is "reasonably necessary" for managing the "quality of service" of the computer system.

Preventing and dealing with intrusion detection and malicious attempts to compromise systems is a crucial issue for any business.

The concern was that without such a change, the viewing or scanning of e-mails by a computer systems employee for such things as virus detection or spam-blocking might be considered an illegal interception of a private communication. Other legitimate purposes include the prevention of data theft or the use of systems by unauthorized individuals. One could argue that, depending to some extent on employer policies, e-mails to and from the workplace are not private communications. But this amendment clarifies the issue.

...

Under the changes, intrusion-detection activities must be limited to authorized individuals who perform duties relating to the security management and protection of computer systems.

Intrusion-detection activities must be limited to what is reasonably necessary for legitimate management purposes to ensure service quality and protect systems against computer-related offences.

The then-Privacy Commissioner took issue with one aspect of the bill.

The commissioner opposed permitting a private communication that had been intercepted lawfully to be disclosed in the course of a civil or criminal proceeding, or for the purposes of any criminal investigation.

That would have meant that a manager operating a computer intrusion-detection system who discovered an e-mail attachment containing child pornography, or evidence of a murder plot, could not notify the police or use the material to discipline the employee.

The commissioner's proposal was defeated. ..."

PART IX COMMENCEMENT AND SHORT TITLE

Commencement

95. (1) This section and sections 71, 72 and 96 come into force on the day the Health Information Protection Act, 2004 receives Royal Assent.

Same

(2) Sections 1 to 70 and 73 to 94 come into force on January 1, 2005.

Short title

96. The short title of the Act set out in this Schedule is the Personal Health Information Protection Act, 2004.

Addition: For information about Bill 31 (PHIPA) training, see http://www.privlaw.com/pages/training_courses.htm

"As North America witnesses the rise of chief privacy officers, one of the fastest growing designations, companies must decide who within an organization will be responsible for this job, Cavoukian said. Ideally, the function should rest with a 'customer-friendly' department like marketing or business development, she said.

Karbaliotis predicted chief privacy officers will grow in importance because these will be individuals 'willing to stand for the company and say 'We're doing this right.'

'Maybe it shouldn't be the security officer. Maybe it shouldn't be the chief technology officer.'

Instead the right candidate should understand technology, business processes, the legislative environment and be involved in business planning, he said.

The 9/11 crisis allowed an increasing degree of security to marginalize privacy, but now 'we need a new paradigm,' urged Cavoukian, and added security and privacy are necessary for freedom to prevail."

Globetechnology:

"The best kept secret in privacy law is what to do about cross-border information transfers. There has been a lot written about the new Canadian privacy law, entitled Personal Information Protection and Electronic Documents Act (PIPEDA), but few lawyers or other experts are willing to offer an opinion on the legality of international cross-border information transfers under PIPEDA.

To date there is little to be found within the published rulings of the Privacy Commissioner that can definitively answer the numerous questions that this issue poses. This is surprising given that nearly every business in Canada faces the privacy question almost on a daily basis. The following is a practical overview for any business that sends or receives any personal information from or to Canada across international borders. ..."

Contributions Program Introduction:

"The Office of the Privacy Commissioner of Canada (OPC) has officially launched a $200,000 Contributions Program which will support research into, as well as the promotion of, the protection of personal information.

With this Program, we hope to encourage the development of a national privacy research capacity that will contribute to advances in knowledge and policy development in the areas of privacy and data protection. We also hope to support the development of expertise in selected areas of privacy and data protection, and to foster an understanding of the social value of privacy to address emerging issues and opportunities...."