18th International Privacy and Data Protection Conference

Notes for an Address

September 18, 1996

Honorable Allan Rock, P.C., Q.C., M.P.
Minister of Justice and
Attorney General of Canada

---

First, let me thank the Privacy Commissioners for inviting me to be a part of this event. On behalf of the Government of Canada, allow me to extend a special welcome to those of you who have come here from other countries.

And to Bruce Phillips in particular, let me express my special appreciation for the effectiveness with which he has served as advocate and defender of privacy rights in Canada.

The role of Privacy Commissioner calls for vigilance in the matter of transgressions, eloquence in defining the issues, and the ability to be an unremitting gadfly when the circumstances require.

I can testify on behalf of my department and my cabinet colleagues, that Bruce has performed these roles effectively. Clearly, this is an important conference. It is also for me a timely one given the level of activity on the Canadian privacy front this year. Your presence focuses attention on challenges that have assumed new complexity in this era.

The English jurist Sir Edward Coke coined a phrase that has echoed through the centuries: "The house of every one is to him as his castle and fortress. Implicit in that declaration is that the house comprised not only wood and bricks but privacy. Privacy is a basic human right." L'évolution des sociétés justes fondée sur la primauté du droit a pu se produire à cause de l'affirmation et de la préservation de ces droits. En ce sens, la protection de la vie privée a été un défi que toutes las générations ont dû relever. [The evolution of just societies based on the rule of law has come about through the assertion and preservation of such rights. In that sense the protection of privacy has been a challenge in balance for every generation.] The nature of the challenge changes as societies become more complex, and as technologies advance.

I want to use my time with you today to discuss some of the challenges we are confronting in Canada at this time, to outline our goals for the future, and to report briefly on the progress we have made.

In both the public and private sectors, Canada's privacy rights agenda is driven by several forces.

The first and most fundamental grows out of our national values. Canadians cherish their rights and freedoms and are determined to preserve them. The right to privacy is based not only on respect for an individual's anonymity and privacy, but also his or her autonomy. The Government of Canada recognizes the rights of individuals to privacy and is committed to their protection.

Effective privacy protection is based on four basic practices:

• governments, businesses and other data users will only collect personal information they need;
• they will only use information they collect on individuals for the purpose for which it was originally collected;
• they will not share the information without the individuals' permission; and
• they will, at the individuals' request, divulge the information they have collected back to the individuals.

Second are the external pressures of this period. In particular, the agenda is influenced by the huge strides made in information technology over the past three decades and the new services made possible by these advances as our markets adapt to electronic commerce.

Une troisième force de changement est la mondialisation des marchés financiers et autres. Dans ce contexte, la protection de la vie privée est devenue non seulement une préoccupation liée aux droits de la personne, mais une question commerciale. [ A third driving force is the globalization of financial and other markets. In this setting, privacy has become not only a human rights concern but a trade issue.]

With other countries we share the need to harmonize existing and new arrangements governing the transfer of personal data across borders. A current example is the European Union's directive on the transfer of personal data to third countries. I can assure you that we are aware of how the approaching deadline of 1998 will affect the transfer of personal data from the Union's member countries.

Our goal is to enter the next millennium equipped with a system that meets all of these challenges effectively.

To get where we want to be, we will have to drive forward vigorously on at least four tracks. And when I say we, I do not mean just governments or privacy commissions, or even business leaders, but all Canadians in every sector of society.

One track runs through the legislatures of the land. In this case, the task includes the updating of existing statutes and the writing of new ones that respond to the needs of the time.

Another track runs through the research and development labs of the information technology industry. The revolutions in software and hardware development of the past three decades have put in our hands a two-edged sword. New information technology not only generates new pressures on effective privacy rights, but new methods for containing them. The system we need to devise will make use of these methods.

The third track runs through every business enterprise and private sector institution in Canada. Total privacy protection will never be achieved simply by legislation. To be effective, the system must engage the wholehearted support and cooperation of the private sector in general.

This will require a revolution in thinking similar to that which has taken place in regard to environmental protection. Businesses and other private institutions will come to regard protection of privacy not as an abstract civic virtue but as an element of sound business practice.

The fourth track runs right down Main Street. In any system designed to protect human rights, and privacy is exactly that, informed public is an essential component.

The most rigorous laws and the most sophisticated technological safeguards will not shield privacy in an environment of ignorance and misinformation. For the system to work, Canadians will need to understand their rights and how to protect them.

La seul façon pratique de mettre au point un tel système est un project de collaboration entre tous les secteurs et les gouvernements. Nous avons commencé sur ce thème. Permettez-moi de décrire d'abord l'aspect législatif de la question.

The only practical way to build such a system is as a cooperative project among all sectors and governments. We have begun in that mode. Let me start with the legislative aspect.

By the year 2000, we aim to have federal legislation on the books that will provide effective, enforceable protection of privacy rights in the private sector.

Up to now, laws to protect data and privacy have focused on the public sector. And understandably so. When legislatures of the day enacted these statutes, government was by far the main collector, storer, and user of information on individuals.

Our laws and our public policies reflected that situation. Our Canadian Privacy Act, for example, deals exclusively with the information held by the federal government.

Another example: In 1984, when Canada signed on to the OECD guidelines on transborder flows of personal data, we adopted a two-tiered approach for its implementation. Basically it was this: legislation for the public sector, and self-regulation for the private sector.

The Government of Canada has now reconsidered that approach.

We have done so because it is obsolete. Modern information technology has made it infinitely more feasible for businesses and other private institutions to amass and exchange data, within and across borders. Advances in computer and networking technology have multiplied and magnified the challenges to privacy.

Meanwhile, Canada has been evolving rapidly from a resource based economy to one based on information and knowledge. In this environment, more and more private institutions are collecting, using, and exchanging information about our consumption habits and services.

In this situation, the Government of Canada takes the position that the protection of personal information can no longer depend on whether that data is held by a public or private institution. This does not mean that the rules governing the collection, use, communication and disposal of personal information need to be exactly the same for every individual and organization. It does mean they should be based on a common set of principles. And it means that personal information held in the private sector should be protected by law.

Last spring, my colleague the Minister of Industry announced that he and I would begin preparing legislation to that end. We are looking at options for possible new legislation to cover the private sector.

Work has already begun. Officials of the federal Departments of Justice and Industry have begun preliminary talks with their provincial government counterparts.

Let me pause here to explain that the field of privacy is governed by laws created at both the provincial and national levels. Because we in this country work in a federal system, we at the national level must work in concert with our provincial and territorial counterparts in order to achieve change, recognizing that, in this innovative field of law, many of the jurisdictional questions have not been completely sorted out by the courts.

The federal Minister of Industry and I have also been preparing a consultation paper on this initiative. Within the next few weeks we will be distributing it to our provincial government counterparts, to representatives of business and other groups, and to the public at large. It will serve as a framework for a preliminary examination of the issues and the options.

In addition, on September 30, federal and provincial ministers responsible for the information highway will be gathering in Winnipeg. The issue of privacy in the private sector will be on the agenda.

These are first steps along a path that will take us where we want to be in terms of privacy rights protection by the year 2000. I would like to underline two aspects of this journey.

First, government is not walking this road alone. We are moving ahead as fellow-travellers with our partners in the provincial governments and in the private sector.

Second, we are not starting from scratch. Let me point to a recent milestone that illustrates both these points.

Earlier this year, Canada became the first country to adopt a national standard for the protection of personal information. Under the auspices of the Canadian Standards Association, a committee including representatives from business, consumer, labour and nongovernment organizations developed the Model Code for the Protection of Personal Information. Officials of federal and provincial privacy commissions were at the table too. So were representatives of the federal government, including the Departments of Justice and Industry, in the role of facilitator.

The code is the product of five years of hard work by every sector and group committed to ensuring good privacy practices. The result was not only a consensus document, but one that lives up, quite literally, to its title of a "model" code.

The code deals with two central data protection issues. One is the way organizations manage and protect personal information. The other is the right of individuals to access and correct their personal information and challenge an organization's compliance with the ten data protection principles.

As a Canadian, I am glad to be able to say that the Canadian Standards Council's approval of the Canadian Standards Association's code as the national standard puts us in a position of leadership. This is the first code on the protection of personal information, based on what amounts to a national consensus.

There have been some other privacy-related milestones on the legislative front.

Last June, in the House of Commons, I tabled a bill that proposes certain amendments to the Criminal Code of Canada. The thrust of these changes is that they would restrict access to the personal records of complainants and witnesses in the prosecution of people accused of sexual offences.

In such cases, the accused would have to show that the records are likely to be relevant. The judge would then review the records in private and decide on access.

As law enforcement technology grows ever more complex, and potentially intrusive, governments must take privacy into account before they can develop legislation that is effective without being worthy of Big Brother.

For instance, in Canada, judges can now issue warrants allowing police to obtain DNA evidence for use in criminal investigations. Police have welcomed this powerful investigative tool, which has already resulted in convictions.

Legislation may be introduced later this year to permit the establishment of a national DNA databank. If that happens, I can assure you that privacy concerns will be part of our considerations.

In closing, I want to make two final observations. The first is about cooperation. Our success has been based on cooperation across jurisdictional and other barriers. In many situations it requires nothing short of consensus.

Anyone familiar with this country knows that consensus does not come easy in Canada. In this area of privacy protection, the federal and provincial governments share jurisdiction.

Consensus, applied to privacy rights, means balancing the interests of data users and data subjects. Consensus means reconciling the imperatives of efficiency with the sanctity of privacy rights.

We must also attend to the international aspects of this challenge. In this era when data flows across borders electronically, when information circles the planet at the speed of light, privacy rights need international protection. Gatherings like this will bring us closer to that goal.

My second and final observation concerns the ongoing nature of the task.

I have talked with you today about Canada's goals for the year 2000. But I know, as you do, that by then, a whole new slate of issues and challenges will have surfaced.

Success in this work requires constancy of commitment in the face of ceaseless change.

As the American jurist Benjamin Cardozo wrote about change and the law: "Existing rules and principles can give us our location, our bearings, our latitude and longitude. The inn that shelters for the night is not the journey's end. The law, like the traveller, must be ready for the morrow. It must have the principle of growth."

That applies with full force to the protection of individual privacy rights. The work is ongoing, the journey never ends. The fortress is always under siege.

I wish you well in your deliberations.