Welcome to PrivacyInfo.ca, a site maintained by Professor Michael Geist of the University of Ottawa, Faculty of Law. The site features summaries of all of the Canadian Privacy Commissioner's decisions under the Personal Information Protection and Electronic Documents Act (PIPEDA) . While those decisions are available in full-text on the Commissioner's site, this site provides additional search functionality, including full-text searches as well as searching by individual provisions, sector, and outcome.
The site also contains links to Canadian privacy legislation, privacy law news, and other resources. For regular updates of new decisions and additions to the site, click here.
This site is not affiliated in any way with the Canadian Privacy Commissioner's office. It is provided for informational purposes only and should not be treated or relied upon as legal advice.
The Canadian Press reports that the Canadian government has quietly dropped plans to let the United States house a database of personal information about Canadians who hold special driver's licences aimed at better securing the border. The move follows vocal criticism from federal and provincial privacy commissioners, who warned earlier this year the scheme could open the door to abuse of the sensitive data.
The Privacy Commissioner of Canada's blog notes the recent CRTC decision, stating that "the time has come for net neutrality, both as an economic and a social policy issue, to be examined by the Canadian government. And we look forward to being a part of that discussion."
The offices of the Privacy Commissioner of Canada, the Information and Privacy Commissioner of Alberta and the Information and Privacy Commissioner of British Columbia recently formalized their approach to cooperation in a number of areas: enforcement; policy; public education and compliance resources; and information sharing.
This week the Ontario legislature will resume debate on Bill 85, proposed legislation that could lead to the creation of an "enhanced drivers licence" in the province (referred to as an EDL). My weekly technology law column (Toronto Star version, homepage version) notes that the introduction of the new licence - which will also be available as a photo card for non-drivers - has received little public attention despite the urgent concerns expressed by privacy commissioners and civil liberties groups. Indeed, barring an unlikely change of plans, the legislation could be passed within a matter of days.
The primary impetus behind the EDL is the increased border security measures between Canada and the United States. As the U.S. increased identity card requirements for entry into the country (passports are now required at most border crossings), government officials in both countries have sought to develop an alternative to the passport. The EDL, which will embed new technologies including a radio frequency identification device (RFID) within the card, is the outcome of that work. While the enhanced card will be optional, it is expected that many residents may pay the extra fee for the EDL. Moreover, Ontarians will not be alone in this regard as other provinces and U.S. states have similar plans. As Ontario moves closer to an EDL with this new legislation, the concern from the privacy and civil liberties communities - who point to three overarching concerns - have continued to mount. The first concern is largely procedural. The introduction of the EDL is viewed as an important development with significant implications for personal privacy. However, few have participated in a consultation process and the legislative committee considering the proposed legislation allocated limited time to debate and discussion.
The second concern stems from the larger implications of the EDL. Although the new card is optional, some experts view it as a major step toward a national identity card. National ID cards have generated heated debate in the past with fears about the privacy and security implications of such schemes. In fact, after a failed attempt to introduce ID cards in the U.S. under the REAL ID program, some officials have acknowledged that enhanced drivers licences may ultimately serve the same purpose.
The third issue is by far the most important - the privacy implications associated with the use of biometric screening and the embedding RFID tags in the licences. RFID tags are tiny tracking devices that use radio waves to emit information to an RFID reader. While RFIDs have been innocuously used for inventory management with containerized shipping in the past, their use on identification cards raises a host of privacy concerns.
Earlier this year Canada's federal, provincial, and territorial privacy commissioners issued a joint statement expressing "their significant concerns about privacy and security aspects of EDL programs." The Commissioners pointed to the long-term retention of Canadian driver data in the U.S., the lack of program oversight, and the use of insecure RFID technology.
Research into the use of RFID has revealed that they are vulnerable to snooping and copying, which may open the door to cases of identity theft or to surreptitious surveillance. The Ontario government notes that the RFID tag will only contain a numerical identifier (rather than a full personal profile), yet access to the identifier could open the door to misuse.
To guard against unintended access to card information, an RFID with an "on/off" switch could be used. To date, the government has rejected proposals to use RFIDs with that more updated technology, instead supporting the use of "protective sleeve" that it argues will guard against unwanted surveillance.
Facilitating faster and more secure border controls is unquestionably a worthwhile goal. Rather than introduce a flawed licence, Ontario Transport Minister Jim Bradley should put the brakes on Bill 85 by first addressing the lingering privacy and security concerns.
The Privacy Commissioner of Canada has released a letter she wrote in response in concerns about Bill C-61. Commissioner Stoddart expresses clear concern about the anti-circumvention provisions, noting that:
the amendments would allow companies to use digital rights management (DRM) software on media sold to Canadian consumers. These tools have been used in the past to collect personal information without users' knowledge or consent. DRM software has also been shown to create other security problems. These practices largely ignore the principles found in Canada’s private-sector privacy legislation, the Personal Information Protection and Electronic Documents Act. As a result, I have asked the Ministers who oversee the copyright file to consider the privacy implications of any new law.
The National Post reports on the glitches (or overwhelming demand) on day one of Canada's do-not-call registry. iOptOut.ca experienced a huge traffic spike as well, sending out roughly one million opt-out requests over the past two days.
posted
on Thu. Oct. 2/08
Site Last Updated: 2008-11-24 Copyright (c) 2003 Michael Geist
First (12/06/2007)
Previous
#13 of 27
Next 
Last (12/01/2009) 
