Federal Commissioner polls Canadians on privacy attitudes

The Privacy Commissioner of Canada has commissioned a poll on Canadians' attitudes on privacy issues. It just came out, so I haven't reviewed it yet but the Commissioner's release is below:

CNW Group: "Poll says Canadians want personal information treated more responsibly

OTTAWA, June 30 /CNW Telbec/ - Canadians want the government and businesses to take their responsibility for safeguarding personal information more seriously, according to the Privacy Commissioner of Canada, Jennifer Stoddart, who released today the findings from a poll commissioned by her Office. The study reveals that most Canadians believe that neither the government nor businesses take their responsibility to protect their personal information very seriously. Only 14 per cent of Canadians believe that the federal government takes its responsibility to protect personal information very seriously and only 11 per cent are confident that businesses take this responsibility very seriously.

"The current government has pledged to make accountability a trademark of government operations, and I can't think of a better way to demonstrate this principle, than by holding it to account for the way in which it treats the personal information," says Privacy Commissioner Jennifer Stoddart. "Establishing sound privacy management frameworks would help organizations protect individuals' personal information by identifying the inherent privacy risks, and how best to mitigate those risks."

In March 2006, The Office commissioned a public opinion study by EKOS Research Associates to revisit benchmarks from the previous year and to better meet Canadians educational needs about privacy.

While Canadians do not consider privacy on par with priorities such as healthcare and education, they place updating privacy laws on similar footing to issues such as ethics and accountability, public security and taxation. In fact, according to the study, close to 90 per cent take it as a given that the rapid pace of technological innovation means that existing privacy legislation needs to be updated regularly and virtually no one believes there is little need to modernize the law. These findings support the Commissioner's calls for reform of the Privacy Act, which covers the personal information handling practices of federal departments and agencies. The Privacy Act is a first generation privacy law that has not been substantially amended since its inception in 1983. On June 5, 2006 the Commissioner tabled her proposals for reform of the Act with the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

"The Privacy Act is an often inadequate public sector data protection law that is woefully out of date," says Ms. Stoddart. "Since my appointment, I have been urging the Government of Canada to reform the Privacy Act. My recommendations to Parliament call for strengthening the Act to address critical issues such as the transborder data flow of personal information."

According to the study, approximately two-thirds of Canadians surveyed are highly concerned about their government's transfer of individual personal information across borders, by outsourcing works to companies in the U.S. The privacy implications related to the USA PATRIOT Act has become the symbol of the increasing concern of Canadians about the security of their personal information when it leaves Canada. In fact, almost 90 per cent of those who are aware of the USA PATRIOT Act express some concerns about the law.

In late March 2006, the Treasury Board released a national strategy and guidelines to address the public's heightened concerns over the transborder flow and the possible privacy risks posed by foreign legislation such as the USA PATRIOT Act. Although the initiative was commended by the Privacy Commissioner as a welcome step toward addressing the concerns, a modernized Privacy Act would further strengthen the federal privacy regime.

Other key highlights of the 2006 EKOS survey:

• The proportion of Canadians reporting that they have a good or very good understanding of their privacy rights has doubled since 2001, rising from 13 to 26 per cent, which suggests that Canadians may be taking more control over of their personal information. Perhaps this explains why more than 85 per cent of them want to be informed by companies about the privacy implications of products or services they buy.
• Approximately 8 in 10 Canadians believe their country should be equipped with strong laws to protect their personal information. The inability to have strong privacy legislation will continue to undermine trust in their government to protect their personal information seriously.
• Although Canadians are among the most technology savvy in the world and they understand that processing personal information is core to a modern and competitive economy, only 50 per cent of those polled say they have enough information to know the privacy implications of new technologies. In response to this need and to better serve Canadians, the Office is developing information and guidance to help individuals better understand the privacy risks and implications of new technologies such as radio frequency identification devices (RFID).

The Office of the Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy rights in Canada.

For a copy of the 2006 EKOS Research Associates survey, please visit: Revisiting the Privacy Landscape a Year Later (www.privcom.gc.ca)

Canada prepares to roll out biometric passports

According to the Toronto Star, Canada is laying the regulatory groundwork to introduce biometric passports.

TheStar.com - Ottawa takes `big step' to biometric ID

... The latest issue of the Canada Gazette, the government's official notice paper, contains several proposed changes to the formal rules governing passports, including two specific provisions for biometric data.

"Passport Canada may convert any information submitted by an applicant into a digital biometric format for the purpose of inserting that information into a passport or for other uses," says one proposed change.

"Passport Canada may convert an applicant's photograph into a biometric template for the purpose of verifying the applicant's identity, including nationality, and entitlement to obtain or remain in possession of a passport," says another.

Passport Canada officials confirmed yesterday that this is a big step toward a large-scale debut of biometrics — the technology that allows citizens to be identified by physical characteristics, which is increasingly becoming a part of many countries' national ID systems.

In Canada's case, the biometrics will be facial-recognition technology, according to Passport Canada spokesperson Francine Charbonneau.

"There is no timeline yet. There's not even a ballpark figure of the timeline," she said. "But it is a good sign that we have the modification.... It's a big step."

Here is the relevant portion of the Canada Gazette notice about amendments to the Passport Order:

Canada Gazette - Order Amending the Canadian Passport Order - P.C. 2006-529 June 15, 2006

(2) Subsection 8.1(2) of the English version of the Order is replaced by the following:

(2) Passport Canada may convert an applicant's photograph into a biometric template for the purpose of verifying the applicant's identity, including nationality, and entitlement to obtain or remain in possession of a passport.

Laptop with veterans' info found

According to the New York Times, the laptop stolen from an employee of the Department of Veterans' Affairs (containing information on more than twenty million veterans) has been recovered.

According to the FBI, the information has not been accessed. I'm enough of a propeller-head to know that you can't ever tell with certainty that information has not been accessed. A drive can be copied without altering the data in any way. (Please, correct me if I'm wrong.)

Here's part of the NYT's article:

Missing Laptop With Veterans' Data Is Found - New York Times:

WASHINGTON, June 29 - The government has recovered a stolen laptop computer and hard drive that contains sensitive information, including birthdates and Social Security numbers, for millions of veterans and military personnel, the Department of Veterans Affairs said today.

The Federal Bureau of Investigation said in a statement issued by its Baltimore field office that an initial examination had found that the data had not been copied or misused in any way.

'A preliminary review of the equipment by computer forensic teams has determined that the data base remains intact and has not been accessed since it was stolen,' the statement said....

Update (20060706): Over at Slashdot, those more knowledgeable than me tend to agree with my semi-informed observation: Slashdot | Forensic Analysis of the Stolen VA Database.

More fallout from Sympatico privacy upset

I reported earlier this week that some people are upset, seeing changes in the Bell Sympatico user agreement as a harbinger of wholesale monitoring of internet use by that service's users (Canadian Privacy Law Blog: Bell warns customers about privacy loss with lawful access). A bit more info is coming to the fore.

Bell has denied that this is the case. A Bell representative has weighed in on a chat hosted by the Globe & Mail:

globeandmail.com : Jack Kapica on who's watching your surfing

Hi Jack, Paolo here from Bell, I am following your online chat about yesterday's news regarding Sympatico user agreements.

Some facts that you should be aware of:

1) Reporter implies with his wire story that we are monitoring our customers - an absolute incorrect statement. Our official statement sent out last night to this reporter and several other as follows:

a. Bell Canada has a long and established history of protecting the privacy of its customers. Bell collaborates with law enforcement agencies only when presented with legitimate court-ordered warrants. To suggest that we are illegally or routinely monitoring our customers is inaccurate and false.

2) The Bell Sympatico user agreement is in no way connected to pending bill C-74 in front of the House, as suggested. This is a standard user agreement accepted by our customers.

For clarity, here is the full clause in the Sympatico User Agreement in which the reporter did not capture correctly and is referring to:

Clause 17 of the Sympatico Service Agreement reads as follows:

User Information; Other Information. Your messages may be the subject of unauthorized third party interception and review. An individual with Internet access can cause, among other things, damage, incur expenses and enter into contractual obligations while on the Internet. All such matters are your sole responsibility. Your Service Provider has no obligation to monitor the Service, any content or your use of Your Service Provider's networks. However, you agree that Your Service Provider reserves the right from time to time to monitor the Service electronically, monitor or investigate content or your use of Your Service Provider's networks, including without limitation bandwidth consumption, and to disclose any information necessary to satisfy any laws, regulations or other governmental request from any applicable jurisdiction, or as necessary to operate the Service or to protect itself or others.

You hereby acknowledge that Your Service Provider, its affiliates, agents and suppliers may retain and use any information, comments or ideas conveyed by you relating to the Service (including any products and services made available on the Service). This information may be used to provide you with better service.

Your Service Provider may send you Service related information on a regular basis via email addressed to your Sympatico parent email address. You agree to review and to familiarize yourself with all such Service related information, and Your Service Provider is not liable for any damage or detriment to you or your property resulting from your failure to do so. Your continued use of the Service following delivery of any such Service related information means that you accept and agree to comply with such information.

Paolo Pasquini, Associate Director

Bell Canada Media Relations

I write privacy policies and website terms of use agreements all the time. Like any contract, you need to be very careful with the words you use and the possible interpretations those words can bear. Even if Sympatico has no itent to start trolling users activities, that is a very poor choice of wording. With the level of paranoia out there, it was inevitable that this pargraph would be interpreted this way and would cause such an uproar.

More coverage:

• Big Brother Sympatico p2pnet.net
• Big Brother watching you surf? Globe and Mail
• Surfing the net not so private 680 News
• We're not spying: Bell SympaticoToronto Sun, Canada
• Bell Sympatico's "monitoring" announcement has privacy advocates ... itWorldCanada.com, Canada
• Bigger brother looms Calgary Sun, Canada

Canadian Commissioner investigates whether Canadian banking records were reviewed by the CIA

The Privacy Commissioner of Canada is investigating whether banking records of Canadians were reviewed by US authorities as part of their sweep of the SWIFT database (for some background: Canadian Privacy Law Blog: US reviews international financial database):

CTV.ca | CIA may have accessed Cdn. banking records:

Canada's privacy commissioner is investigating whether United States officials have improperly received the banking records of Canadians.

The Toronto Star reports the investigation is also trying to determine if the Central Intelligence Agency was given unauthorized access to the confidential files.

"This is something we're looking into," Anne-Marie Hayden, spokesperson for the privacy commissioner's office, told the newspaper.

"Any time personal information of Canadians is obtained by a foreign government in circumstances that may not provide the same privacy protections that exist in Canada, we have concerns."

On Tuesday, a human rights group filed formal complaints in 32 countries, including Canada, against a Brussels-based banking consortium for providing the U.S. with confidential information about international money transfers, the International Herald Tribune reported.

The London-based Privacy International alleges the Society for Worldwide Interbank Financial Telecommunication, or SWIFT, has violated rules in numerous jurisdictions by handing over the data....

Alberta Commissioner issues important ruling on guardians versus mature minors

The Information and Privacy Commissioner of Alberta, Frank Work, has issued an order under the province's Health Informtion Act that will likely stand as a strong precedent for PIPEDA and other privacy laws.

In this particular case, the guardian of a "mature minor" was requesting information related to her daughter. The Commissioner concluded that if the minor "understands the nature of the right or power and the consequences of exercising the right or power" in the Act, the guardian cannot exercise those powers. This test comes directly from the Act:

104(1) Any right or power conferred on an individual by this Act may be exercised …..

(b) if the individual is under 18 years of age and understands the nature of the right or power and the consequences of exercising the right or power, by the individual,

(c) if the individual is under 18 years of age but does not meet the criterion in clause (b), by the guardian of the individual.

The decision inclues a thorough review of the evolving norms and standards in Canadian law related to "mature minors".

The Commissioner's press release on the Order is below:

Commissioner issues important ruling on the authority of a guardian versus a mature minor:

June 26, 2006

Edmonton... Alberta's Information and Privacy Commissioner has ruled that a parent who requested her daughter's medical records did not have the right to exercise the daughter's rights or powers under the Health Information Act (HIA).

Frank Work made the determination during an inquiry into a request from a parent for access to certain medical records regarding her daughter. The Commissioner has ruled that in this particular case, the minor was entitled to exercise her own rights or powers under the HIA because she was able to understand the nature and consequences of exercising those rights. Such an individual is also known as a mature minor.

The HIA allows a guardian to exercise the rights or powers of a minor if the guardian can show that the minor does not understand the nature or the consequences of exercising the right or power.

In making the ruling, Commissioner Work indicated that he did not have jurisdiction to hear other issues put forward at the inquiry.

The Order is Number F2005-017 and H2005-001.

Bell warns customers about privacy loss with lawful access

Bell Canada has changed its customer service agreement for its internet customers to let them know that lawful access is likey back on the agenda. According to the Canadian Press (I haven't been able to track down a copy of the new terms of service), the new agreement purports to give Bell the right to "monitor or investigate content or your use of your service provider's networks and to disclose any information necessary to satisfy any laws, regulations or other governmental request". See: CTV.ca | Sympatico's customers warned of privacy loss.

Ontario Commissioner tables her 2005 Annual Report

Anne Cavoukian has tabled her annual report for 2005 in the Ontario Provincial Parliament. I haven't had a chance to review it in detail, but it appears to be full of interesting information.

Here is the media release:

IPC - Government spending must be open to the public: Commissioner Cavoukian says greater transparency needed:

NEWS RELEASE : June 27, 2006

Government spending must be open to the public: Commissioner Cavoukian says greater transparency needed

While considerable gains have been made, government organizations nonetheless continue to use the Freedom of Information and Protection of Privacy Act as a shield to block the release of consultants’ contracts and the financial arrangements made with suppliers of goods and services, said Information and Privacy Commissioner Ann Cavoukian.

Since early 2005, the IPC has overturned 11 decisions made by provincial or municipal organizations that refused to disclose this type of information. The requesters seeking the information had to appeal those decisions to my office to obtain the desired records, said Commissioner Cavoukian. Other requesters may have just given up, not bothering to file an appeal. “This is a complete waste of the time and resources of all parties involved,” said the Commissioner, who is urging municipal and provincial government organizations in Ontario to make a concerted effort towards ensuring that the public has full access to government spending records.

In her 2005 annual report, which she released today, Commissioner Cavoukian is asking every government office planning to hire a consultant, contractor, or service provider to immediately make it clear to them that the information they submit will most likely be made available to the public. “The default position should be that financial and all other pertinent information related to a contract will be made publicly available,” said Commissioner Cavoukian. Only in exceptional circumstances will withholding the financial terms of government contracts be justified on the basis of prejudice to one’s competitive position or privacy.

“The right of citizens to access government-held information is essential in order to hold elected and appointed officials accountable to the people they serve,” said the Commissioner. “This is particularly true for details of government expenditures and the public’s right to scrutinize how tax dollars are being spent. When government organizations use the services of individuals or companies in the private sector, the public should not lose its right to access this information.”

The need for transparency and accountability for government spending goes beyond contractual arrangements. In Order MO-1947, the Commissioner ordered the disclosure of information relating to lawsuits settled by the City of Toronto with third parties, including the number of lawsuits, dates settled and dollar amounts. The Commissioner again emphasized the importance of the disclosure of this type of information based on the taxpayers’ right to know and the need to hold both politicians and bureaucrats accountable for their actions.

In her wide-ranging 84-page annual report, Commissioner Cavoukian identifies and addresses seven other key issues. Among these, the Commissioner:

• dispells some of the common misconceptions about radio frequency identification (RFID) and addresses when privacy issues need to be considered. “ Users of RFID technologies and information systems should address the privacy and security issues early in the design stage, with a particular emphasis on data minimization,” said the Commissioner. “This means that wherever possible, efforts should be made to minimize the identifiability, observability and linkability of RFID data.” (Further to this issue, the Commissioner released new RFID Privacy Guidelines just last week. Here is a direct link to the Guidelines on the IPC’s website: www.ipc.on.ca/docs/rfidgdlines.pdf.);
• outlines a highly successful collaboration between the Ontario College of Pharmacists, the Ontario Pharmacists’ Association and the IPC. Within days of a controversy erupting in the media over the screening of womenattempting to access the emergency contraceptive pill, commonly known as Plan B, the Ontario College of Pharmacists, after working with the Commissioner and the Association, issued new guidelines for pharmacists operating in Ontario;
• examines the issue of the secure destructionof personal information, emphasizing that such information “must be permanently destroyed or erased in an irreversible manner that ensures the record cannot be reconstructed in any way, as reflected in the IPC Fact Sheet issued on secure destruction;”
• advises that the IPC is closely watching the steps being taken towards the development of an interoperable electronic health record (EHR) system in Ontario. “Governance is a key issue in the implementation of an interoperable E HR,” said Commissioner Cavoukian. “One of the questions that needs to be addressed is how will accountability for patient privacy and information security be established in the context of a record that may eventually be shared throughout the entire health care system;”
• stresses that privacy should not be used as a shield to minimize disclosure of essential information in emergency situations. “While access and privacy laws underline the importance of protecting the privacy of individuals, they also recognize that, in certain circumstances, privacy should not be an impediment to the sharing of vital – and, in some cases, life-saving – information, even in the absence of consent,” says the Commissioner;
• addresses the issue of fingerprints, photos and other personal information of people who were charged with a crime, but never convicted, being kept by police. “Many people assume that when charges are dropped, stayed, withdrawn, or a finding of ‘not guilty’ is made, the name of the accused person is automatically cleared,” said the Commissioner. “However, while these and other non-conviction dispositions may leave a person without a criminal record, police services in Ontario retain most police records in perpetuity, even where a person is found not guilty by the courts. A fair expungement process must take into account both the legitimate interest of law enforcement and the fundamental rights of innocent citizens;” and
• emphasizes the importance of building a culture of openness and transparency in all provincial and municipal government organizations. “Leadership on openness and transparency must come from the top,” said the Commissioner. “Public servants are more apt to disclose information without claiming inapplicable exemptions if they feel that their decisions will be supported by both the politicians and senior executives who lead their ministry, agency, board, commission or local government.”

The annual report also includes a detailed review of the impact of the Personal Health Information Protection Act (PHIPA) – Ontario’s first new privacy law in nearly 14 years – during its first full year.

Provincial ministries were praised by the Commissioner for a dramatic improvement in their 30-day-response compliance rate. Overall, ministries achieved an 80.1 per cent compliance rate – a significant increase from 68.7 per cent in 2004 and the highest provincial compliance rate in 17 years.

Elsewhere, the annual report includes statistical analysis of requests for information filed across Ontario in 2005 under FOI and PHIPA (34,957, the highest number ever), appeals to the IPC regarding some of the decisions government organizations made in response to FOI requests, and privacy complaints filed to the IPC under the provincial and municipal Freedom of Information and Protection of Privacy Acts, or under PHIPA.

Key IPC orders and privacy investigations are profiled, decisions rendered by the courts regarding Ontario access cases are cited, IPC educational efforts outlined, and information about the 25 publications the IPC issued in 2005 provided.

The Information and Privacy Commissioner is appointed by and reports to the Ontario Legislative Assembly, and is independent of the government of the day. The Commissioner's mandate includes overseeing the access and privacy provisions of the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act, as well as the Personal Health Information Protection Act, and helping to educate the public about access and privacy issues.

Fraudster sentenced to jail for using modified terminal to collect debit card numbers and PINs

The Halifax (Nova Scotia) Chronicle Herald is reporting today that a 22 year old man originally from Ontario has been sentenced to two years in jail in connection with a debit card scam. The individual has been convicted of fraud after he set up a kiosk in a mall in the Annapolis Valley and used a modified debit-card machine to capture card numbers and PINs. He managed to scam $33,000 until he was caught. See: The ChronicleHerald.ca: Man jailed two years for debit card scam.

I don't know about you, but I've been taking a much closer look at card readers lately.

US reviews international financial database

The New York Times reported on Friday that in the days following the September 11, 2006 attacks, the United States subponaed the entire database of SWIFT, the international inter-bank transfer settlment organization. This database would contain the records of a vast quantity of international money movements, most of them legitimate. What started as an urgent and temporary measure has since become institutionalized without any congressional approval or oversight. Searches of the database are said to be targeted with justification required, but it is but a short hop to fishing expeditions. What is also troubling is that a large quantity of these transactions have no connection whatever to the United States, but the US government is able to compel their production from a Belgian cooperative. See: Bank Data Is Sifted by U.S. in Secret to Block Terror - New York Times.