[IP] Online data brokers target Canadian privacy commissioner
Begin forwarded message:
From: Michael Geist <mgeist@xxxxxxxxx>
Date: November 28, 2005 11:18:11 AM EST
To: dave@xxxxxxxxxx
Subject: Online data brokers target Canadian privacy commissioner
Dave,
Of possible interest -- my weekly Law Bytes column focuses on a
recent Canadian incident in which a reporter obtained the personal
phone records of Privacy Commissioner Jennifer Stoddart. I argue
that in a year dominated by almost daily privacy and security
violations that have placed the personal information of millions at
risk, that this privacy breach, which affected just one person, ranks
as 2005's most shocking incident.
Although major Canadian telecommunications providers such as Bell
Canada sought to characterize themselves as "victims" of fraudulent
activity and claim that a rapid response to the incident is proof
that the Canada's privacy laws are working as intended, the reality
is that Canadian law is simply ill-equipped to deal effectively with
such incidents.
In light of the privacy breach, the public might naturally expect
that the Privacy Commissioner of Canada has the powers to address the
issue. She does not.
The investigation will naturally focus on both the telecommunications
providers that disclosed the phone records as well as the U.S.-based
data broker that obtained and later sold the information.
The Privacy Commissioner has little recourse against the
telecommunications providers. Although she can investigate the
incident, without possessing order-making power, the Commissioner is
reduced to issuing a non-binding "finding" that must be pursued in
federal court in order to levy any financial penalties.
Indeed last week it was the CRTC that was better able to immediately
address the issue. Within days of the report, it sent a letter to
the telecommunications providers demanding an internal investigation
and imposing a strict 10-day deadline to furnish a host of
information, including descriptions of the safeguards that were in
place when the breaches occurred, explanations of how the companies
verify customer identity, and new measures being taken to improve
security.
The situation with respect to the U.S.-based data broker is even
bleaker. Last week the Privacy Commissioner declined to investigate
a complaint against another U.S. data broker, arguing that Canada's
privacy laws do not provide sufficient powers to investigate out-of-
country operators.
The implications of that decision are stunning, suggesting that
Canadians enjoy no privacy protection for personal information that
is disclosed to non-Canadian entities. Although the Commissioner' s
interpretation of the limits of the law are subject to challenge -
there is a good argument that the jurisdictional limitations on
investigation should not act as a barrier to issuing a finding
against a foreign entity - it is increasingly clear that Canadian law
is not up to the challenge of providing effective privacy protection
in a world of global data flows that do not respect national borders.
Tackling this challenge will not be easy, particularly as the
Commissioner is asked to address a growing number of concerns
including spam, spyware, and the threat of secret disclosures
compelled by U.S. law enforcement. A starting point, however, is to
provide the Commissioner with order making power, the unquestioned
ability to name the names of privacy violators, and the resources
necessary to meet her mandate.
While a statutory review of Canada's national privacy legislation is
slated for 2006, there is no need to wait for the review. With an
imminent national election call, Canada's political leaders should be
required to answer a simple question - how are they prepared to
reform Canadian law to provide meaningful privacy protection in the
Internet era?
Toronto Star version at
http://geistprivacywakeupcall.notlong.com
Freely available version at
<http://www.michaelgeist.ca/index.php?
option=com_content&task=view&id=1024>
Best,
MG
--
**********************************************************************
Professor Michael A. Geist
Canada Research Chair in Internet and E-commerce Law
University of Ottawa, Faculty of Law
57 Louis Pasteur St., Ottawa, Ontario, K1N 6N5
Tel: 613-562-5800, x3319 Fax: 613-562-5124
mgeist@xxxxxxxxx http://www.michaelgeist.ca
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/