|
|
|
Volume 10 No. 4 Fall 2000 |
|
|
|
Volume 10 No. 4 Fall 2000 |
|
Response to the Special Committee on Information Privacy in the Private Sector: |
Report by Richard Dancy
Public Awareness, Advocacy and Legislation Committee
Background
On May 19, 2000 the Chair and Deputy Chair of the BC Legislative Assembly’s Special Committee on Information Privacy in the Private Sector (SCIPPS) sent the AABC a copy of the government’s Discussion Paper on Protecting Privacy in the Private Sector. The AABC was invited to submit a response. Email correspondence with the Office of the Clerk of Committees on June 28, 2000 indicates that a deadline for submissions will likely be set sometime this fall.
This report to the AABC Executive provides an overview of SCIPPS, the issues involved and how these relate to the BC archival community. I recommend that the AABC submit a written brief to SCIPPS and have highlighted a number of issues that I believe should be addressed.
Special Committee on Information Privacy in the Private Sector (SCIPPS)
SCIPPS was established by the Legislative Assembly on July 14, 1999, with a mandate to examine and make recommendations re: (i) protecting personal information in the private sector, and (ii) the impact of electronic documents on privacy and freedom of information for British Columbians.
The creation of SCIPPS is a response to a recommendation of an earlier Special Committee to Review the Freedom of Information and Protection of Privacy Act, which reported to the Legislative Assembly in June 1999 and called for a new committee to consider regulating privacy in the private sector. There is considerable overlap between SCIPPS and the previous committees in terms of membership.
SCIPPS is also a response to federal legislation in this field. In 1998, the federal government tabled Bill C-54, the Personal Information Protection and Electronic Documents Act. After public hearings in both the House and Senate, it was re-introduced in October 1999 with slight revisions as Bill C-6. Bill C-6 was passed and received Royal Assent on April 13, 2000. Part I contains provisions regulating the collection, use, retention, disclosure and access to personal information held by private-sector organizations. It comes into force on a staggered time-table:
January 1, 2001 for the federally regulated private sector (e.g. banking, air lines);
January 1, 2002 for the federally regulated health sector (e.g. hospitals);
January 1, 2004 for all organizations that engage in commercial activities anywhere in Canada.
The application to “all commercial organizations” in 2004 is controversial in that it seems to be a federal intrusion on provincial jurisdiction. The government hopes to avoid constitutional wrangling with the provision that the federal Act will not apply to any province which adopts “substantially similar” legislation of its own. Accordingly, one of the main tasks of BC’s SCIPPS committee is to recommend whether BC ought to:
do nothing legislatively and simply allow the federal Act to apply to BC in 2004;
pass essentially identical mirror legislation for the provincially regulated private sector, so that the same terms apply federally and provincially;
pass independent legislation which may go beyond and differ from the federal Act; or
revise the BC Freedom of Information and Protection of Privacy Act to include the private sector.
Since Bill C-6 forms the starting point, it is necessary to examine it briefly.
Federal Bill C-6
The immediate motivation behind Bill C-6 is commercial:
The European Union’s Data Protection Directive (1998) restricts the ability of EU members to exchange data with other jurisdictions unless the latter have adequate privacy protection measures in place. Bill C-6 is meant to provide such protections, thereby ensuring that Canadian businesses are not disadvantaged in European trade.
It is feared that Canada is falling behind in the development of e-commerce and that one of the reasons for this is Canadians’ lack of confidence in the security of their personal information in an electronic environment. Bill C-6 is meant to provide the protections which will bolster Canadians’ trust and willingness to engage in electronic transactions.
The economic focus is clear from the formal title of the Bill: “An Act to support and promote electronic commerce by protecting personal information….” The Act is primarily concerned with the collection, use, retention and disclosure of personal information in electronic business transactions.
Bill C-6 has 5 parts. Part 1 deals with privacy protection rights in the private sector; Part 2 addresses the use of electronic records in business transactions and their legal admissibility; and Parts 3, 4 and 5 amend other federal Acts. Only Part 1 has been controversial and the core of it is actually contained in an attachment to the Bill – Schedule 1, which is the Canadian Standards Association’s Model Code for the Protection of Privacy. The CSA Code was approved in 1996 as a voluntary code for self-regulation by private sector organizations and establishes 10 principles of fair information practices. Bill C-6 simply incorporates the CSA Code verbatim and thus makes these principles legally binding on all commercial organizations. Individuals will have recourse to the Privacy Commissioner in the event of complaints and the Commissioner will also have audit powers.
The 10 principles of fair information practices are (summarizing):
1. Accountability (someone to be designated as responsible for an organization’s compliance with fair information practices).
2. Identifying Purposes (purposes for which personal information is collected to be identified at the time of collection).
3. Consent (knowledge and consent of the individual to be required for the collection, use, or disclosure of personal information).
4. Limiting Collection (collection of personal information to be limited to that which is necessary for the purposes identified by the organization).
5. Limiting Use, Disclosure, and Retention (personal information not to be used or disclosed for purposes other than those for which it was collected and to be retained only as long as necessary for the fulfillment of those purposes).
6. Accuracy (personal information collected to be accurate, complete and up-to-date).
7. Safeguards (security appropriate to the sensitivity of the information to be in place).
8. Openness (policies and practices relating to the management of personal information to be readily available).
9. Individual Access (right of individuals to have access to their own personal information and to request correction).
10. Challenging Compliance (right of individuals to challenge an organization’s compliance with fair information practices).
Part 1 of Bill C-6 qualifies and interprets these principles, especially the principle of consent (by making provisions for exceptions) and specifies the mechanisms by which compliance can be challenged and remedies determined and applied.
Implications for Archives in British Columbia
Whatever legislation BC adopts (or does not adopt), the CSA Code will almost certainly form the basis for regulating information privacy in the private sector in this province. BC archives will have to deal with two Acts: the provincial FOI Act for the public records in their holdings and Bill C-6 (or a BC version) for the private records.
In general, the problem for archives arises from the fact that Bill C-6 and the CSA Code were framed with a certain context in mind: the use of personal information in current electronic business transactions. This is a very different context from that of the archives reading room, where personal information contained in private fonds will be disclosed and used. Yet the same regulations will apply to both contexts. This creates some unintended consequences which may hinder the capacity of archivists to carry out their work and the capacity of citizens and researchers to gain access to archival records.
Here are some of the issues:
(1) BC public sector archives acquire private sector records. Which Act will apply to these holdings? Bill C-6 says nothing about this scenario. The BC FOI Act says explicitly that private records held by public body archives are not subject to the FOI Act.
A BC Act should state explicitly whether it applies to private records donated to public archival institutions. There should be consistency between public and private sector legislation, so that archives can adopt a single standard for privacy protection for all records in their holdings, public or private.
(2) The principle of consent (CSA Code #3) poses difficulties for archives. When an archives acquires private records containing personal information, is this considered a new “collection” of personal information? Even if record subjects consented to their personal information being collected by the private body, they were never asked for their consent to that information being transferred to an archives. It would not be practicable to get their consent now or to require companies to ask for consent for possible future transfers. Nor would it be feasible to get record subjects’ consent to the disclosure of their personal information to researchers. If taken literally and in a purist sense, the principle of consent would destroy archives.
Bill C-6 provides for exceptions to the principle of consent:
Consent for collection is not necessary if “the collection is solely for journalistic, artistic or literary purposes” (s. 7(1)(c)).
Consent for use is not necessary “if it is used for statistical, or scholarly study or research” and the organization informs the Privacy Commissioner before the information is used (s. 7(2)(a)).
Consent for disclosure is not necessary if it is disclosed “for statistical, or scholarly study or research” and the organization informs the Privacy Commissioner before the information is disclosed (s. 7(3)(f)).
Consent for disclosure is not necessary if the record is 100 years old or more, or the individual it is about has been dead for 20 years or more (s. 7(3)(h)).
A BC Act should make explicit under which category the situation in the archives reading room falls. If it is disclosure (which seems the most intuitive), it is impractical to require an archives to inform the Commissioner before every disclosure. Researchers would have an impossibly long wait before gaining access to records.
The provision for disclosure without consent after 100 years after record creation or 20 years after record subject’s death is consistent with the BC FOI/POP Act. It is worth noting, however, that the Special Committee to Review the Freedom of Information and Protection of Privacy Act heard many complaints about the length of this time limit. In its Report to the Legislature the Committee in fact recommended lowering the threshold to 70 years after creation of the record or 20 years after subject’s death. If there are to be separate Acts for public and private sectors, they should be consistent on this point and the lower threshold figure is preferable.
The provision of a time limit beyond which all records can be disclosed implicitly recognizes that the sensitivity of personal information diminishes with the passage of time. A BC Act should make this principle explicit and give archives discretion to act in this matter accordingly.
(3) The principle of limiting use of personal information to the primary purposes for which it was collected and retention of the data only for as long as required by those purposes (CSA #5) would also, if taken literally, destroy archives – since it denies the legitimacy of any secondary use of records in research for purposes uncontemplated by the records creators.
A BC Act should explicitly state that the use of personal information for archival, historical, heritage, statistical or research purposes is a legitimate use of records.
(4) The principle of individual access (CSA #9) may challenge present practices when it comes to negotiating access restrictions with donors. Under Bill C-6, an individual would have a right of access to his or her own personal information held in an archival fonds, regardless of the restrictions placed on records by a donor agreement. This is probably a good thing for archives, but it may be something that potential donors should be informed of.
(5) The fact that archives fit only uneasily into the framework of Bill C-6 (and most likely into that of a provincial counterpart Act as well) provides another reason why BC needs an Archives Act, which could be a place where these issues are explicitly addressed.
SCIPPS Activities to Date
SCIPPS will likely present its Report to the Legislative Assembly sometime in the fall or spring. Its deliberations and activities can be followed on its web site, which includes minutes and hansard for all meetings to July 4, 2000.
SCIPPS advertised and held three public hearings early in 2000, in Victoria, Vancouver and Richmond. Committee members have expressed disappointment in the turnout and in the lack of public input, debate or even apparent interest in the topic. Most of the presentations have been from businesses and privacy advocacy groups.
The government’s Discussion Paper was prepared by the Information, Science and Technology Agency (ISTA). It discusses the evolution of regulation in this field and highlights some of the issues for public debate. ISTA has itself held some public consultations on the topic. It has been monitoring the federal legislation, prepared briefs and presentations to SCIPPS and will likely be responsible for any BC law which is drafted.
There are a couple of points that emerge from Hansard which the AABC should keep in mind when/if it drafts a brief:
(1) One of the concerns expressed by business and taken seriously by the Committee is a worry over “patchwork” regulations, i.e. a different privacy regime in every province and different again from that regulating federal affairs. This would be bad for business, hence the interest in “harmonization.”
The AABC can address this by affirming the 10 principles of the CSA Code, but recommending that BC improve upon the federal law in terms of how these principles are qualified so that unintended consequences harmful to archives can be avoided. Since we are dealing here with inactive archival records, in any case, it should have little impact on the conduct of current business.
(2) SCIPPS members fear they are only hearing from “special interest lobbies” rather than from the general public or citizen.
The AABC will likely be lumped in as another “special interest group.” Nevertheless the AABC should make its case not only with reference to archives and archivists but above all to the right of citizens to have access to the historical record as a means of understanding their society, evaluating past policies and practices, protecting their rights, and holding individuals and organization (public or private) accountable. The ACA’s brief to the Senate Committee on Bill C-6 contains many good examples, e.g. the use of residential school records (containing personal information) as evidence of past abuses. We need to make the point that there needs to be a balancing between the individual’s right to privacy and the citizen’s right to understand, scrutinize, evaluate and hold accountable; and that archivists have long experience working with such a balance and self-regulation (e.g. Code of Ethics).
3. Quebec alone in Canada has already had legislation regulating privacy in the private sector (since 1994). SCIPPS members have often asked presenters to tell them about how their Quebec counterparts have fared. Most of them are unable to say and in fact there seems to be very little information about the situation in Quebec.
The AABC should do some research on how archives have been affected in Québec and the views of Quebec archivists on their provincial Act.
Recommendations for AABC Action
The AABC should prepare a written brief to SCIPPS. It should consider making a personal appearance before the Committee. It should aim to submit its brief sometime this fall.
Although this means there is relatively little time to spare, ideally the following should be consulted in the course of drafting the AABC response:
the AABC’s submission to the BC Special Committee reviewing the FOI Act (Trevor Livelton and Terry Eastwood appeared, Terry made a presentation);
the ACA re: its presentation and experiences with the federal hearings on Bill C-6;
Quebec archivists re: the Quebec legislation and its impact;
BC archival institutions re: impact on their activities; and
other associations representing the BC historical profession and heritage institutions re: possible collaboration (for example, the ACA brief was co-authored by the ACA, the Canadian Historical Association and the Institut d'histoire de l'Amérique française).
In my opinion the AABC should:
support legislation for privacy protection in the private sector; and
support independent BC legislation in this field.
An independent BC Act on privacy in the private sector should:
incorporate the 10 principles of fair information practices as set out in the CSA Code and Bill C-6 (thus be “substantially similar” to the federal Act), but qualify these in such a way as to remove the largely unintended consequences detrimental to archives and research (thus improving on the federal Act); and
be consistent with the BC FOI/POP Act (amending the latter if necessary).
An independent BC Act should contain one or more clauses dealing with archives which explicitly state:
whether the Act applies to private sector records donated to public sector archives;
that the secondary use of records containing personal information for archival, historical, heritage, research or statistical purposes is a legitimate exercise of the citizens’ right to gain access to the historical record of their society’s past;
that the sensitivity of personal information contained in records diminishes with the passage of time;
that an archives can acquire private sector records containing personal information without the consent of records subjects;
that an archives can exercise discretion to disclose personal information in archival records without consent if it determines that an individual’s privacy rights will not be violated by the disclosure;
that an archives should be subject to the Commissioner’s review in the event that an individual complains about unfair information practices, but does not need to inform the Commissioner before every disclosure;
that records should be open after 70 years from date of creation or 20 years from death of the records subject, whichever is earlier, as the Special Committee to Review the FOI/POP Act recommended for public records (Recommendation 8 of their Report).
Resources
SCIPPS web site: http://www.legis.gov.bc.ca/cmt/priv_ps/
BC Information, Science and Technology Agency (ISTA) material on privacy in the private sector
http://www.ista.gov.bc.ca/FOI_POP/PSP.htm
BC Special Committee to Review the FOI/POP Act web site: http://www.legis.gov.bc.ca/cmt/foi/previous.htm
AABC’s presentation: http://www.legis.gov.bc.ca/cmt/foi/hansard/fi0224.htm (Hansard for February 24, 1998).
Bill C-6: http://www.parl.gc.ca/36/2/parlbus/chambus/house/bills/government/C-6/C-6_4/C-6_cover-E.html (official version)
http://www.privcom.gc.ca/english/02_06_01_01_e.htm (unofficial version from Privacy Commissioner’s website – easier to download)
Privacy Commissioner of Canada’s material on Bill C-54 / C-6: http://www.privcom.gc.ca/english/02_06_e.htm
ACA material on Bill C-54 / C-6 http://aca.archives.ca/official.com/c54/index.htm
Canadian Historical Association brief on Bill C-54 / C-6 http://www.yorku.ca/research/cha/html/english/burgess_bull_e.html
Institut d'histoire de l'Amérique française brief on Bill C-54 / C-6 http://www.caM.ORG/~ihaf/dossiers/resumeC54.html
Quebec Act Respecting The Protection Of Personal Information In The Private Sector
© 2000 Archives Association of British Columbia
