PIPEDA back under the microscope

The battle over Canadian privacy continues in the wake yet another review of the Personal Information Protection and Electronic Documents Act (PIPEDA). This time, however, a significant sally has been made, with Industry Canada opening up their recommendations to public opinion.

The Act has had much scrutiny over the last year or so, with the Privacy Commissioner running her own review, and a parliamentary committee running theirs. Industry Canada’s review – “Government Response to the Fourth Report of the Standing Committee on Access to Information Privacy and Ethics: Statutory Review of the Personal Information Protection and Electronic Documents Act (PIPEDA)” – was in response to the parliamentary committee’s findings, released in May.

That committee’s findings were “incredibly vague,” according to Philippa Lawson, director of the Ottawa-based Canadian Internet Policy and Public Interest Clinic, who testified on behalf of the organization before the committee. “It was very rare that there were any specific recommendations. It was like, ‘We need to take a look at this,’ and then leaving it to the government to figure out.”

Industry Canada mounted closed consultations with key stakeholders in the privacy community while preparing its response. The results were much more concrete, according to Lawson, and proposed more concrete recommendations that the public can now comment on, and which could successfully be turned into an amendment one day. She said, “This signals that the government plans to act.”

While the consultation is open to the public, Lawson thinks that key stakeholders will be the primary responders, due to the complex legal issues at stake. Said Lawson: “The answers here are not at all obvious.”

One of the key issues highlighted in the public call for input was data breach notification. Industry Canada recommended that “PIPEDA be amended to include a breach notification provision requiring organizations to report certain defined breaches of their personal information holdings to the Privacy Commissioner.”

British Columbia Freedom of Information and Privacy Association president Richard Rosenberg said that this wasn’t a particularly significant step forward. “That’s going less than half-way. Anything less than reporting it to the Privacy Commissioner wouldn’t be reporting it at all,” he said.