PIPEDA and elections or leadership campaigns

M.J. Murphy (aka BigCityLib) asks whether Liberal Party leadership candidates Dion, Dryden and Brison violated PIPEDA by providing confidential party membership lists to the Globe & Mail, as reported by CTV (BigCityLib Strikes Back: Did Dion, Dryden, and Brison Violate Federal Law?). It's an interesting question, but one that is likely answered in the negative.

Of course, this isn't legal advice to anyone. Rather, it's just a discussion of the issues engaged by this report.

The reason is that PIPEDA likely does not apply to the core activities of political parties. Section 4 sets out where PIPEDA does and does not apply:

Application

4. (1) This Part applies to every organization in respect of personal information that

(a) the organization collects, uses or discloses in the course of commercial activities; or

(b) is about an employee of the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.

Limit

(2) This Part does not apply to

(a) any government institution to which the Privacy Act applies;

(b) any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose; or

(c) any organization in respect of personal information that the organization collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose.

It is likely a stretch to suggest that federal politics - all cynicism aside - is a "commercial activity", at least to the extent that it would trigger the federal government's general trade and commerce powers upon which PIPEDA relies for its jurisdiction.

Regarding the "disclosure" to the Globe to conduct an opinion poll, most practitioners in this area would say that it is not technically a disclosure. If the poll was being conducted on behalf of the candidate, the polling organization would be the agent for the candidate. (Unless the most recent finding from the Privacy Commissioner would deem their conduct to be a commercial activity in and of itself.) If the use by the Globe was for journalistic purposes, they're off the hook thanks to 4(2)(c).

This is not to suggest that the candiates are blameless. There's been some suggestion that providing the data to the Globe may have violated the conditions of confidentiality imposed by the Liberal party. If that's the case, there may be other remedies, but they wouldn't be within PIPEDA.

AOL members sue over release of search data

No surprise here. AOL's relase of members' search data has led to litigation: PC World - AOL Members Sue Over Search Data Release.

Precedent: The New Rules of Law and Style

There's a new legal blog in town, and it's unlike any of the other Canadian legal blogs out there. Precedent: The New Rules of Law and Style is hard to pigeon-hole, but is about law, life, style and other interesting stuff. I'll leave it to the site's author, Melissa Kluger, to describe it:

I’ve been a lawyer in Toronto now for four years. Over this time, a lot of law magazines, newspapers and newsletters have crossed my desk. Even though these are publications for lawyers, I never feel like they are really talking to me. They always feel a little old, a little earnest and, well, a little boring. I want a publication that is fun, smart and stylish — that understands what it’s like to be a young lawyer, asks tough questions about the profession, and strives to entertain and enlighten me. And so I’m setting off to make one. A Precedent, if you will. A magazine that gets lawyers and knows what they want.

Check it out ...

Presentation: Privacy and Health Information

I was invited to speak today at the Atlantic Health Information Systems (AHIS) annual conference at White Point Beach Resort. The topic - surprise! - was privacy and health information systems. The presentation was an overview of the overlapping laws that govern health information in Nova Scotia and the rest of Atlantic Canada. I promised that I'd make the presentation available on my blog, so here it is: AHIS2006.html.

Trust ye, TRUSTe?

Wired's blog 27B Stroke 6 points to a recent report that suggests TRUSTe approved sites may not be entirely trustworthy. Using McAfee's SiteAdvisor data, Harvard researcher Ben Edelman has found that TRUSTe's sites are more likely than most to spam you and deliver adware and spyware. Not surprisingly, TRUSTe doesn't agree with the findings.

Alberta Commissioner faults MD Management for laptop theft

The Office of the Information and Privacy Commissioner of Alberta has released its investigation report into the missing laptop case (for some background, see: Canadian Privacy Law Blog: Alberta commissioner launches investigation into stolen laptop). In the wake of the theft of a laptop from an employee of MD Management (a subsidiary of the Canadian Medical Association), the Commissioner's office concluded that the organization violated the Personal Information Protection Act by not adequately securing the information of 8,000 customers. See the report here: Investigation Report P2006-IR-005.

Three senior officers leave HP in wake of spying scandal

According to the New York Times, three senior officers of Hewlett Packard are leaving the company in the wake of the recent leak investigation that many think went too far. Leaving personnel include Chairwoman Patricia Dunn, Senior Counsel and Manager of Global Investigations. See: Chairwoman Leaves Hewlett in Spying Furor - New York Times.

If you have one of the US census bureau's hundreds of missing laptops ...

Please return it.

CNN.com - Census Bureau loses hundreds of laptops - Sep 21, 2006:

"WASHINGTON (AP) -- The Commerce Department has lost 1,137 laptop computers since 2001, most of them assigned to the Census Bureau, officials said Thursday night."

ChoicePoint victims uncompensated despite $5M fund

The Associated Press is reporting that months after a $5 million settlement assembled a pool of funds to compensate people for the ChoicePoint breach, nobody has seen a penny. "It's under review." See: AP: FTC yet to pay ChoicePoint victims - Yahoo! News.

US AG calls for ISP data retention on behalf of law enforcement

Once again, the US Attorney General is calling for a law requiring internet service providers to collect and keep logs for law enforcement purposes:

USATODAY.com - Gonzales calls for law to require Internet companies to preserve customer data:

... 'We respect civil liberties but we have to harmonize this so we can get more information,' he said.

The subject has prompted some alarm among Internet service provider executives and civil liberties groups after the Justice Department took Google to court earlier this year to force it to turn over information on customer searches. Civil liberties groups also have sued Verizon and other telephone companies, alleging they are working with the government to provide information without search warrants on subscriber calling records.

Justice Department officials have said that any proposal would not call for the content of communications to be preserved and would keep the information in the companies' hands. The data could be obtained by the government through a subpoena or other lawful process....