Probably, the next big privacy issue to hit Canada will be the availability of public records in electronic form. "Public records" are, by their very nature, open to public view but electronic avaiability means that they are infinitely more available, mineable (if that's a word) and may be connected with other public and private data in an unprecedented way. This is entirely a new issue, particularly in the United States, where companies like ChoicePoint, Abika and Lexis Nexis collect disparate bits of data, assemble them, link them and make them available to marketers, insurers, lenders and government.

In Canada, we've seen some controversy with Abika, following a complaint made against the company to the Canadian Privacy Commissioner. (Which was not pursued by the Commissioner because the company has no presence in Canada. See PIPEDA and Canadian Privacy Law: CIPPIC complaint raises a number of novel and interesting issues, Jurisdictional limitations on Canadian privacy law, CIPPIC v Abika.com: Part deux.)

Under PIPEDA, public records are treated in a peculiar way. You can collect, use and disclose publicly available information without consent as designated in the regulations:

7. (1) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may collect personal information without the knowledge or consent of the individual only if ...

(d) the information is publicly available and is specified by the regulations.

As with so many aspects of PIPEDA, it is never straightforward. The regulations not only designate what is "publicly available", but tell you how you can use it without consent:

Regulations Specifying Publicly Available Information:

"1. The following information and classes of information are specified for the purposes of paragraphs 7(1)(d), (2)(c.1) and (3)(h.1) of the Personal Information Protection and Electronic Documents Act:

(c) personal information that appears in a registry collected under a statutory authority and to which a right of public access is authorized by law, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the registry;

(d) personal information that appears in a record or document of a judicial or quasi-judicial body, that is available to the public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the record or document; and ..."

So public records can only be used in a manner that is consistent with the puropse for which it is made available in the first place. This means that you have to ask yourself: Why does the registry of deeds exist? Why are court records open? Why are tax assessments available? I'm relatively confident that they are not public records so they can be mined by marketers. Other than that, it's a matter of interpretation.

PIPEDA only applies to commercial activities, however, so there is no restriction on the ability of journalists or your busy-body neighbours to peruse databases. And criminals, who can glean social security numbers from public filings in the US, are not too concerned with the law. So it falls to the governments in question to consider whether it is prudent to put this information online.

On a related note, a quick Google News search turned up a number of interesting articles, starting with this editorial that argues that accident records should continue to be available to keep the government on its toes:

The Sanford Herald: What others say:

"By law and by tradition, government records in North Carolina are open to the public. It is a healthy policy that allows citizens to find out what their government is up to - and to make it accountable to the people it serves.

So it's especially troubling when electronic advances that make it easier for governments to create and maintain records also keep those records out of the public's hands. A prime example is a new software program the state Department of Transportation began using last year that lets law enforcement officers file accident reports directly from their patrol cars instead of filing a paper copy...."

Newsday.com - State/Region News:

"COLUMBIA, S.C. -- Officials in two South Carolina counties have asked a company to stop posting some county government land records online after concerns about the availability of residents' Social Security numbers.

Officials in York and Berkeley counties asked to have some documents removed from the Web site registered to Dallas-based Affiliated Computer Services, Inc...."

Way sought to make court file data honest:

"TALLAHASSEE - A panel helping the Florida Supreme Court figure out how to balance the public's right to access with the right to privacy wants to stop inflammatory documents from getting into court files.

The panel's recommendations are intended to help the state's 67 clerks of court cope with the advent of Internet access to court files and its effect on 'practical obscurity,' the privacy afforded litigants and defendants when court documents pile up in file rooms and warehouses.

Now, paper that once gathered dust can be read, copied, transmitted and analyzed instantly when it enters the court record.

In 2003, the state Supreme Court placed a moratorium on electronic filing of court records until a panel recommends how to protect the public from 'data-miners' - data collection agencies that gather information about individuals. That moratorium came after the Florida Legislature ordered all court records to be put online by 2006...."

Labels: google, health information, information breaches, privacy