Newsletter

ARCHIVED - Wanted: Your Input
Draft consultations paper posted for comment

In the spring of 2010, the Office of the Privacy Commissioner of Canada held public consultations on online tracking, profiling and targeting, and cloud computing. The Office received 32 written submissions and held three public events in Toronto, Montreal and Calgary. These events were attended by representatives of industry and government, academics, and advocates, as well as members of the public.

A draft consultations report has been posted on the OPC website for comment. The draft report summarizes the input gathered during the course of the consultations and proposes specific actions that the Office will undertake going forward. It also identifies issues for which we are seeking further input. We would like to encourage any interested parties to read the report and submit feedback via our website. The deadline for feedback is December 10, 2010. more

Privacy professionals and advocates from around the globe gather for Privacy Week

Commissioner Jennifer Stoddart recently joined her international data protection counterparts, privacy professionals from major international corporations, IT experts, academics and representatives from civil society groups in Jerusalem for “Privacy Week.” more

A meeting of the privacy and access minds

Canada’s information and privacy commissioners and ombudspeople gathered in Whitehorse, Yukon from August 31 to September 2, 2010 to discuss common issues and share best practices.

During the meeting, the commissioners and ombudspeople issued a joint resolution about the importance of governments sharing information with the public in more accessible, open formats.

The resolution notes that, while access to information legislation provides a right of access to government information, the laws are fundamentally reactive because access is granted only after a request is made. Canada’s access to information and privacy commissioners are advocating a paradigm shift from reactive to proactive disclosure, and ultimately to open government. more

OPC News

Jennifer Stoddart reappointed

On November 24, 2010, Prime Minister Stephen Harper announced Jennifer Stoddart’s nomination for reappointment as Privacy Commissioner of Canada. The nomination was approved in the Senate on November 30, 2010, and in the House of Commons on December 3, 2010.  The Commissioner appreciates Parliament’s confidence in her to continue on in this role and to have a chance to build on the important work the OPC has been doing over the past few years. At Ms Stoddart’s request, the reappointment  is for a three-year term. more

Putting our Heads Together

As part of an effort to better unify our public- and private- sector work, the Office of the Privacy Commissioner has united responsibility for both the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Privacy Act under a single Assistant Commissioner, Chantal Bernier.

This internal integration mirrors the changing external environment, in which so many technological challenges and public safety pressures apply equally to the public and private sectors.

For example, wireless communications pose risks and vulnerabilities to government and business alike. Financial institutions are just as likely as government agencies to be pressed into gathering information for use by law enforcement authorities. And computer analytics are equally useful for governments establishing a smart grid or companies developing an online enterprise.

We feel that this integration at the senior level will lead to greater cohesion and effectiveness for our Office. At the working level, we continue to build depth and expertise by specializing in both the public and private spheres.

Google contravened Canadian privacy law

On October 19, 2010, Privacy Commissioner Jennifer Stoddart announced that her Office’s investigation of Google Inc. had determined that the company had contravened Canadian privacy law when it inappropriately collected personal information from unsecured wireless networks in neighbourhoods across the country.

 “Our investigation shows that Google did capture personal information – and, in some cases, highly sensitive personal information, such as complete e-mails. This incident was a serious violation of Canadians’ privacy rights,” says Commissioner Stoddart.

The Privacy Commissioner made a number of recommendations, such as asking that Google ensure it has a governance model in place to comply with privacy laws, and that the company enhance privacy training to foster compliance amongst its employees. Google has until February 1, 2011 to confirm that it has implemented her recommendations. more

Enhanced online tool for small businesses

The Office of the Privacy Commissioner of Canada marked Small Business Week (October 17-23) by launching an enhanced online tool to help businesses protect their customers’ privacy.

The Privacy for Small Business online tool leads users step-by-step through an interactive privacy assessment, and provides them with the information they need to comply with privacy laws and protect their customers’ privacy. The enhanced tool is easy to use and it takes only about 30 minutes to complete all the questions.

Upon completion, businesses will know how much information they should have about their customers and how to protect it.

Privacy Commissioner recognized for outstanding achievements and leadership

Privacy Commissioner Jennifer Stoddart was recently recognized by both the Ontario Bar Association and the International Association of Privacy Professionals (IAPP) for her outstanding contributions to the protection of privacy.

Commissioner Stoddart is the 2010 recipient of the Ontario Bar Association’s Karen Spector Memorial Award for Excellence in Privacy Law. The award was established to recognize, honour and celebrate the outstanding achievements of Ontario Bar Association members practising in the area of privacy law. The award is named for the late Karen Spector, who established one of the first legal practices dedicated to privacy law in Ontario. more

The Commissioner was also recently awarded the 2010 Privacy Vanguard Award, which is awarded annually by the International Association of Privacy Professionals (IAPP) to privacy professionals who demonstrate outstanding leadership, knowledge and creativity in privacy and data protection. Commissioner Stoddart received the award during the IAPP Privacy Academy 2010 in Baltimore, Maryland. more

Earlier this year, during the 2010 Access and Privacy Conference, the University of Alberta’s Information Access and Protection of Privacy (IAPP) Certificate Program presented the Commissioner with an award to recognize her accomplishments as Privacy Commissioner of Canada.  The program, which marked its 10th anniversary this year, also presented special awards to Frank Work, Information and Privacy Commissioner of Alberta; and Alec Campbell, a private consultant and co-creator of the IAPP program.

Commissioner finds veteran's privacy rights were violated: OPC to audit

An investigation conducted by the Office of the Privacy Commissioner of Canada has highlighted serious mishandling of a veteran’s personal information, entrusted to the care of Veterans Affairs Canada.

“The veteran’s sensitive medical and personal information was shared – seemingly with no controls – among departmental officials who had no legitimate need to see it. This personal information subsequently made its way into a ministerial briefing note about the veteran’s advocacy activities. This was entirely inappropriate,” says Privacy Commissioner Jennifer Stoddart.

As a result of what was learned during the investigation, as well as information that came to light through media reports and telephone calls to her Office, the Privacy Commissioner announced her Office would conduct an audit of the Department’s handling of veterans’ personal information. more

Taking care of business: OPC officially opens Toronto office

On October 6, the Office of the Privacy Commissioner marked the opening its new Toronto office with the help of stakeholders, industry experts and academics who attended an afternoon open house. Attendees were able to chat with the Commissioner, Assistant Commissioner, senior management, and other OPC staff (based in Toronto and Ottawa), tour the new facility, and ask questions about the new office and its mandate.

Now that the Toronto office is up and running, staff there are working hard to create a stronger regional presence and establish good working relationships with the privacy stakeholder community, including those from academia, community groups, businesses, and industry associations. 

Under the leadership of Robin Gould-Soil, Director, Personal Information Protection and Electronic Documents Act, the Toronto office will also be building upon existing outreach activities and conducting investigations in the Greater Toronto Area.

The Toronto office is located at 25 St. Clair East, 9th Floor, Suite 901 in Toronto.

Privacy Commissioner finds poor computer disposal practices and lack of controls for wireless devices in government

On October 5, 2010, the Privacy Commissioner tabled her Annual Report on the Privacy Act. The report, which highlighted findings from two separate privacy audits conducted by the Office of the Privacy Commissioner of Canada, indicated that the federal government’s use of handheld communications devices and its practices for disposing of unneeded paper documents and surplus computers could expose the personal information of Canadians to unauthorized disclosure.

“Our audits turned up some disturbing gaps in the privacy policies and practices of government institutions,” Commissioner Stoddart said. “Whether they’re using a BlackBerry, shredding old papers or disposing of outdated computer equipment, public servants need to know that the security of people’s personal data is a top priority.” more

Commissioner announces findings in Facebook followup

The Privacy Commissioner has finished reviewing the changes that Facebook implemented as a result of her investigation of the social networking site and has concluded that the issues raised in the complaint have been resolved to her satisfaction.

In a statement, the Commissioner confirmed that “[t]he changes Facebook has put in place in response to concerns we raised as part of our investigation last year are reasonable and meet the expectations set out under Canadian privacy law.”

However, the Office has received several further complaints about issues that were not part of the first investigation and is now examining those. The new complaints deal with Facebook’s invitation feature and Facebook “Like” buttons on other websites.

“Facebook is constantly evolving and we are actively following the changes there – as well as on other social networking sites. We will take action if we feel there are potential new violations of Canadian privacy law,” says Commissioner Jennifer Stoddart. more

Settlement reached in legal proceedings related to night clubs' collection of identification card information

The Privacy Commissioner has reached a settlement with the Canad Corporation of Manitoba Ltd (Canad Inns), a hotel chain that operates a number of night clubs in Manitoba. This settlement follows legal proceedings stemming from an investigation into the collection of personal information of bar patrons using a machine that copies and stores personal information appearing on the front of an identification card such as a driver’s licence.

The Office of the Privacy Commissioner’s investigation was prompted by a complaint from a Canad Inns customer who objected to having her licence information scanned.

As part of the settlement between Canad Inns and the Privacy Commissioner, the company has made commitments to:

• Stop collecting personal information at its night clubs via its identification machines;
• Destroy the personal information collected with the machines; and
• Limit the amount of personal information found on its list of barred people and ensure that this information is adequately secured. more

Case Summaries

The Office of the Privacy Commissioner of Canada (OPC) is responsible for overseeing compliance with PIPEDA and the Privacy Act. These two laws protect our privacy rights and describe the obligations of organizations that seek to collect, use or disclose our personal information.

For real-life examples of how PIPEDA comes into play, visit our case summaries:

• PIPEDA Case summary #2010-004: Manager’s remark reveals employee’s salary – consent was necessary despite existing public disclosure requirement
• PIPEDA Case summary #2010-003: Poor response to customer’s access requests causes unnecessary deletion of his personal information
• PIPEDA Case summary #2009-021: Disclosure complaint against bank deemed not well-founded because the information came from public records