Off topic, but ...

This past week, a colleague and I gave a presentation on blogs and blogging to the Halifax Association of Law Librarians. We covered the usual topics, including an overview of some of the good legal blogs out there, RSS, aggregators, etc.

But I also talked about an issue that has been a concern to me since I started this blog but I really haven't heard any discussion of it among the dozens of legal blogs that I follow: conflicts and blogging. Legal ethics say that a lawyer can't reveal the identity of a client or do anything that may be prejudicial to a client, except with the client's consent. See Rule 22 of the Nova Scotia Legal Ethics and Professional Conduct Handbook.

In this blog, I usually post about articles and incidents of interest that have a privacy angle. If I see an article or another blog post that deals with privacy, I'll post a link to it. I hope that this blog is "one stop shopping" for everything of interest related to Canadian privacy law. But it simply can't be. From time to time, a story hits the media that involves a client of my firm. Also, from time to time, I'll get a call from someone in the media asking to comment on a privacy story that involves a client. I always decline to link to the story or to make the comment. Unless I have the client's OK. (Which I've gotten from time to time, particularly if the result of the matter is public knowledge.)

It is a real challenge and something to be very mindful of. I work in a firm with almost 200 lawyers, with six offices in four jurisdictions. We also are Atlantic Canadian counsel to many of the largest companies operating in North America. Our securities group does agency work on behalf of loads of public companies that require registration in Atlantic Canada. If a lawyer in one of our New Brunswick offices does work for the Canadian subsidiary of a huge insurance company, that company is a client and I have to keep my mouth shut. Even if it may be borderline or in a grey area, I have to err on the side of caution.

I would be very interested to hear the thoughts of other legal bloggers out there on this topic. I think this is an important topic that could bear some informed discussion.

UPDATE:

I solicited Alan Gahtan's thoughts on this subject, which he has posted on Gahtan's Technology and Internet Law Blog:

"My view is that lawyers who publish, whether through a blog or through more traditional print media, operate under a disability. They must not disclose client confidences and must not advocate a position that is contrary to their client’s interests. The magnitude of the disability is proportionate to the size of the firm that a particular lawyer practices with since conflicts are “shared” among the lawyers of a firm. It is less of a problem when the lawyer’s publishing activities involve ad hoc articles as opposed to the operation of a website or blog that tries to cover all developments in a particular area. I’m not a legal ethics expert but my view is that simply reporting other information that is already public should not create a legal conflict (although I can see that it could create a business conflict with a particular client). However, it does mean that the blogging lawyer will be limited in their ability to comment on a particular news item if such comment would be detrimental to the interest of a client of the firm. It likely also means that any third party comments will also need to be filtered so that they do not contain any content that is detrimental to any such client. "

I like the use of the term that we lawyers are blogging "under a disability." Our hands our tied and our lips are always sealed, but this isn't unique to the blogging environment. Lawyers always have very juicy gossip but have to keep their mouths closed at cocktail parties. Blogging lawyers also have to be mindful not to aliente present and prospective clients with their blog content. I try to be as even-handed and balanced as possible, with the minimum of personal and political opinion (which is distinct from professional opinion).

There have been a number of times when I've had to remain silent when clients have appeared in the news, even though I have no immediate knowledge of the incident (for example, if its US branch is in the news). There have also been cases when the clients have had positive privacy-related publicity, but it is not my place to speak for or about them without permission. But when it does not inovolve a client, I think I am free to link to public information even though my firm has clients in the same industry with similar business issues.

Thanks Alan, Rob, David and DP Thinker for the comments, above and below.

Technorati tags: legal ethics :: blogging :: blogs :: lawyers :: legal profession

Labels: information breaches, presentations, privacy

I was recently invited by the Canadian Bar Association - Nova Scotia's Insurance Law subsection to give a presentation on privacy laws and insurance claims, focusing on where we are now that PIPEDA has been in force for almost two years. The two principal themes were video surveillance and access to the claims file. You can download a pdf of the presentation here if you are interested: Privacy and Insurance Claims.

Labels: information breaches, presentations, privacy, surveillance, video surveillance

On Thursday night, I had the pleasure of giving a presentation alongside Nancy Milford (of the Nova Scotia Health Organizations Protective Assoc.) to the Nova Scotia Medical-Legal Society on issues related to consent and the release of patient information. The group is composed of lawyers and medical professionals who have an interest in health law. Almost all of them had very interesting questions on how PIPEDA is being applied (and should be applied) in the healthcare context. If you're interested in a copy of the materials, send me an e-mail at david.fraser@mcinnescooper.com.

Labels: health information, information breaches, presentations, privacy

I've been invited to speak on October 30 at the Fall Refresher for the Nova Scotia College of Pharmacists on privacy liability and pharmacy practice. The brochure for the full, two-day event is available here. If you are interested in the presentation materials, e-mail me at david.fraser@mcinnescooper.com.

Labels: information breaches, presentations, privacy

This morning, I gave a presentation on privacy and investigations by professional regulators as part of an InfoNex conference on professional regulation and discipline. A PDF of the materials are here for all who may be interested.

Labels: information breaches, presentations, privacy

On January 13, 2005, I led a roundtable discussion on privacy laws for the Ottawa chapter of Meeting Professionals International. The focus was on how those in the event planning industry should approach privacy laws. The event itself had a very interesting format: there were more than a dozen tables going at the same time, each on a different topic. Attendees signed up for their preferred choice when they arrived. Infolink, one of the sponsors, prepared a precis of each roundtable, including mine, which is available here.

As one would expect, the meeting was amazingly well planned....

Labels: information breaches, presentations, privacy

Phew! It has been a busy week. I flew back from Vancouver on Monday and hit the ground running. I gave four presentation this week, all of which are available for download for anyone who is interested.

• New regulations and document retention
• Privacy and Atlantic Canadian Businesses: Lessons from the first year of Canada's privacy law
• Private Sector Privacy Laws and Public Bodies: Presentation to Public Bodies Privacy Workshop hosted by the Nova Scotia Department of Justice and the FOIPOP Review Officer
• Privacy Laws and Security: Presentation to the High Technology Crime Investigations Association

I think I only have one presentation next week, but it's in Toronto. I'm getting too scared to look at my calendar, these days ...

Labels: information breaches, presentations, privacy, retention

Today, National Privacy Services and McInnes Cooper co-hosted a half-day program on lessons learned from the first year of PIPEDA's full implementation in the private sector. I kicked off the program with an overview of PIPEDA and what it's all about. Then, Heather Black, the Assistant Privacy Commissioner of Canada, provided some very interesting insights on trends that her office is seeing (complaints are up 50%, a smaller portion of complaints are determined to be well-founded than last year). Heather gave her presentation "without a net", but mine is available here.

Labels: information breaches, presentations, privacy

Last week, I gave a presentation to a group of directors of public libraries in Nova Scotia. Library staff are regularly called upon to consider privacy issues, particularly in connection with public use internet stations. Police regularly ask for information related to who was using a particular terminal at a particular time, often in connection with threats made or other allegedely illegal conduct. In addition, some libraries are contemplating offering reading suggestions based on reader preferences, a form of "data mining".

PIPEDA applies in Nova Scotia and public libraries are not, by and large, engaged in commercial activities. While they were interested in PIPEDA, most of the discussion related to privacy best practices they can adopt to meet the growing expectation of their users. The presentation is available here: Privacy and Public Libraries

Labels: information breaches, libraries, presentations, privacy

I was invited to give a presentation today on the effect of privacy laws on the call centre industry to ContactNB, the industry association for New Bunswick. The presentation is available here: Contact NB: Privacy and The Customer Care Sector

Labels: information breaches, presentations, privacy

Other than privacy (which is overwhelmingly the majority of my practice), I'm also an IT/technology lawyer. Before PIPEDA and the emergence of privacy as a legal discipline, IT took up all of my practice. In light of this, I was kindly invited by the Project Management Institute to give a presentation of the legal perspective of IT project management, which I did today.

I have seen far too many technology projects go completely sideways because there was no legal input in advance or because the contract was drafted by a software engineer and "legal" is called in after the development is complete to review the poorly drafted (or completely inappropriate) agreement the day before they plan to sign it. Aargh. An ounce of prevention is worth a pound of cure.

The presentation is available here, for anyone who may be interested: IT Project Management: The Legal Perspective.

Labels: information breaches, presentations, privacy

I spent the day today with Paul Bradley, VP of PricewaterhouseCoopers, giving a workshop for Insight Information on conducting workplace investigations in the new era of privacy regulation. Anyone who is interested can get a copy of my powerpoint presentation here: Privacy Law and Workplace Investigations: Workshop

Labels: information breaches, presentations, privacy

As promised a short while ago, I've posted the presentations from the CBA Annual CLE session on cross-border privacy issues. Many thanks to Simon Chester for compiling our three powerpoints into one coherent (and hefty) acrobat file.

Cross-Border Issues for Privacy Law Compliance in Canada, the US & the EU

Presented by the National Privacy Law Section and the National Business Law Section This panel will focus on issues facing multi-national organizations that seek to align their privacy law compliance procedures across jurisdictions. The panel will examine the approaches taken by multi-nationals in complying with the new Canadian laws, as well as requirements for Canadian companies doing business in the US and the EU.

Moderator: David M.W.Young, Partner, Lang Michener LLP (Toronto)

Speakers: Simon Chester, Partner, McMillan Binch LLP (Toronto)
Evelyn L. Sullen, Staff Counsel, Volkswagen of America Inc. (Auburn Hills, MI)
David T.S. Fraser, Associate, McInnes Cooper (Halifax)

Labels: cba, information breaches, presentations, privacy

I just returned from a very good few days at the Canadian Bar Association’s annual get-together in Winnipeg, Manitoba. There were quite a few privacy-related events during the two-day substantive program.

The first event was more administrative than anything. It was the meeting of the CBA Privacy Law subsection. The meeting was chaired by Brian Bowman, the section secretary who is also a privacy lawyer at Pitblado in Winnipeg. We reviewed the privacy-related resolutions passed by the CBA general meeting and the extensive activity undertaken by the section during its first year. (I’m told that it has an unprecedented level of activity for a brand-new section.) The next year should be just as busy.

David Young, who chairs the Advocacy and Government Relations subsection led a discussion of the contribution that can be made when the Personal Information Protection and Electronic Documents Act (Canada) comes up for full review in 2006. I expect there will be no shortage of suggestions. Ann Goldsmith, legal counsel to the Office of the Privacy Commissioner mentioned they have many suggestions already, with deemed consent for due diligence review in the course of sales of businesses near the top of their list.

Cross-border privacy issues

The second event was also on Monday: a panel discussion of cross-border privacy issues. Moderated by David Young of Lang Michener, the panel was composed of Simon Chester of McMillan Binch, Evelyn Sullen of Volkswagen of America Inc. and me. The presentation that I gave is available here and I’ll try to get permission to post Simon and Evelyn’s powerpoints.

Simon Chester began with a presentation on European privacy law, using three European women as illustrations of the law’s development and enforcement: (a) Bodil Lindqvist, (b) Naomi Campbell (see Campbell v. MGN Limited, [2004] UKHL 22) and (c) Princess Caroline of Monaco. The first example demonstrates how some authorities in Europe are being much more aggressive in enforcing the Data Protection Directive, including against clearly non-commercial and “domestic” use of personal information. The latter two examples show how the balance between privacy and freedom of the press are moving clearly towards privacy in Europe. (We will not likely see any of the Campbell/Caroline examples in Canada soon, as PIPEDA specifically does not apply to information collected for “artistic, literary or journalistic purposes. Any similar complaints against paparazzi will have to be grounded in the independent tort of “invasion of privacy”, which is being slowly developed in the Canadian provinces that do not have a statutory tort.) Interested readers should take a look at Simon's comprehensive paper, which is available here.

Evelyn’s presentation included an overview of the sectoral laws in the United States (COPPA, HIPAA, GLB, etc.) and a look at Volkswagen USA’s experience in addressing PIPEDA and the European privacy rules. It was estimated that VW spent about $500K in complying with PIPEDA, including postage for sending a “grandfathering/opt-out” letter to all customers in their database.

One of the questions posed was whether to adopt a fragmented privacy management system within an international company or should one try to develop a policy that complies with all legal regimes in which the company operates. Much of what was discussed in the international context is also applicable within the Canadian federal system. We are dealing with a number of privacy regimes in this country, including the present 100% overlap between federal and provincial laws in Alberta and British Columbia. (I am told that the Order-in-Council to declare AB and BC’s laws “substantially similar” to PIPEDA is on the agenda for the next meeting of the federal cabinet.) We also have an interesting overlap in the health privacy arena. Alberta, Saskatchewan and Manitoba each have provincial health information laws and none of them are expected to be declared substantially similar. This means that physicians in private practice, who are engaged in “commercial activities”, must comply with PIPEDA and with the local health information law. In most cases, the healthcare professionals can design their programs to comply with the most demanding individual rules and principles. In some cases, this is not always possible as some contradictions may appear between the laws.

Update on Canada’s Privacy Laws

On Tuesday, Brian Bowman moderated a panel of representatives from various privacy commissioners’ offices. On the panel was Heather Black, Assistant Privacy Commissioner of Canada; Brian Loukidelis, Information and Privacy Commissioner from British Columbia, Barry Tuckett, Manitoba’s Ombudsman and Mary O'Donoghue, legal counsel to the Information and Privacy Commissioner of Ontario. Each of the panelists gave an update on developments in their respective jurisdictions, beginning with Heather Black’s overview of the roll-out of PIPEDA. Heather made an interesting distinction between systemic and more accidental violations of PIPEDA. Systemic violations are those which demonstrate a systemic problem, such as a lack of awareness, policies or procedures. Accidental ones are simply where a company’s established – and otherwise compliant – procedures and policies are not followed, resulting in a breach. Both are problems, but the balance of complaints is leaning further away from systemic breaches. Heather also mentioned that the number of complaints that are “well founded” has declined (to the end of 2003) to around 20% from 45% a couple of years before.

Mary O'Donoghue, from the Ontario Information and Privacy Commissioner’s Office, provided a very good and brief overview of the Personal Health Information Protection Act, 2004.

At the moment, I’m a little jetlagged. I’ll try to write more about the conference when I’ve got a few more minutes and once I’ve heard back from my co-panellists about posting their materials.

Labels: alberta, bc, british columbia, cba, health information, information breaches, presentations, privacy

I just attended Insight Information Co.'s Health Privacy conference in Halifax. The content was fantastic and the presenters were really top-notch. It was a bit disappointing that there were no healthpractitioners in attendance, but with a $1300 price tag it is hard to manage unless you have a hospital or other organization paying your way.

Without a doubt, I found that the best speaker was Karen Rose, who is the new Info and Privacy Commissioner for PEI. She spoke about the challenges and advantages of privacy compliance. I've asked her for her speaking notes, which I'll also ask her if I can post here. Suellen Murray, from the Nova Scotia Department of Health discussed the process that is underway to harmonize the health information laws from coast to coast (minus Quebec). She wasn't able to discuss the substance since there are some minor revisions underway, but the process is promising.

I was asked to present on PIPEDA in private practices. Since everyone in attendance came from public institutions (read: non-commercial, and therefore beyond PIPEDA's hooks), the interest was largely academic. I tried to emphasise that many of the doctors who are present in hospitals are going to be grappling with this development, so they'd better be sensitive to it. My presentation, PIPEDA for Physicians, is available here.

Labels: health information, information breaches, presentations, privacy

Yesterday, I gave a two and a half hour presentation (see: Privacy Law and Project Management) [link fixed] to the Nova Scotia Chapter of the Project Management Institute. The presentation began with an introduction to PIPEDA and led into a discussion of integration of privacy into project planning, drawing heavily from privacy impact assessment methodologies, especially the Canadian federal government's PIA guidelines and PIA policy. These days, no significant technology project should proceed without considering the potential privacy risk presented by the project.

Labels: information breaches, presentations, privacy

I was invited to give a presentation to a conference arranged by Hewitt Associates (a leading HR outsourcing services provider) on PIPEDA for HR professionals. The presentation is available here: PIPEDA and Employers (Hewitt)

Labels: information breaches, presentations, privacy

Last weekend, National Privacy Services was invited to give a presentation on PIPEDA to a group of independent pharamcists. The presentation is available here: PIPEDA and Pharmacists.

Labels: information breaches, presentations, privacy

I was recently invited to give a presentation to the Annual General Meeting of the Medical Society of Nova Scotia on the impact of PIPEDA on physicians. (See presentation: PIPEDA and Physicians - MSNS AGM 2004.)

Since last year, I have been working with National Privacy Services and the Medical Society to design an easy-to implement solution for busy physicians. In our experience, most physicians don't have the time or the inclination to design their own compliance program. And as small business people with tightening revenue, physicians don't have the resources to engage a privacy lawyer to assist them. (Perhaps as important, most doctors don't know about the law, let alone what they need to do to address it.)

The final product is the Physician's Privacy Manual, which includes a complete suite of products that a physician can implement in his or her practice. The Manual includes:

• Privacy training manual (the only one of its kind designed from the ground up to address privacy in the private practice;
• Policies and procedures to adopt in the practice;
• Consent form for affirmative, opt-in consent;
• Educational tools, including a privacy statement for patients and poster; and
• Multi-media CD with a one-hour overview of PIPEDA and its requirements.

The procedures and tools contained in the Physician's Privacy Manual have been extensively field tested in private practices and subjected to review by a wide range of physician focus groups. For more information, contact National Privacy Services at http://www.privlaw.com or (toll free) at 1-877-PRIVLAW.

Labels: information breaches, presentations, privacy

Last week, in conjunction with National Privacy Services Inc., I was invited to give a presentation to the Tourism Industry Association of PEI (TIAPEI) on the impact of PIPEDA on the tourism sector. I think TIAPEI will be putting all our materials up on their website, but in the meantime, I've posted one of my articles on my website:

Labels: information breaches, presentations, privacy

In November and December, I gave a few presentations in Halifax, Truro and Sydney for the Nova Scotia Barristers Society continuing professional development department. The first was on advising clients about PIPEDA and the second was specifically focused to what lawyers need to think about to get their own houses in order. In the last month or so, I've been bombarded with phone calls from lawyers who have received letters from clients asking about privacy and aren't sure what to do or say. Many see their law firms as any other supplier and are asking for assurances that we are up to par. I've also had a couple of calls from people who weren't able to make any of the presentations for a copy of my powerpoint. So, for them and for anyone else who might be interested, here is a link to the online-viewable version of PIPEDA for Law Firms and a PDF version. I'm not going to post a native PowerPoint version online since I've seen too much of my stuff cut and pasted in other places. If you want a copy of it for a presentation you are going to give, drop me a line at david.fraser (a) mcinnescooper.com.

Labels: information breaches, presentations, privacy