The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.

Search this blog

Recent Posts

On Twitter

About this page and the author

The author of this blog, David T.S. Fraser, is a Canadian privacy lawyer who practices with the firm of McInnes Cooper. He is the author of the Physicians' Privacy Manual. He has a national and international practice advising corporations and individuals on matters related to Canadian privacy laws.

For full contact information and a brief bio, please see David's profile.

Please note that I am only able to provide legal advice to clients. I am not able to provide free legal advice. Any unsolicited information sent to David Fraser cannot be considered to be solicitor-client privileged.

David Fraser's Facebook profile

Privacy Calendar



Subscribe with Bloglines

RSS Atom Feed

RSS FEED for this site

Subscribe to this Blog as a Yahoo! Group/Mailing List
Powered by

Subscribe with Bloglines
Add to Technorati Favorites!

Blogs I Follow

Small Print

The views expressed herein are solely the author's and should not be attributed to his employer or clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Nothing herein should be used as a substitute for the advice of competent counsel.

This web site is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and David T.S. Fraser. If you are seeking specific advice related to Canadian privacy law or PIPEDA, contact the author, David T.S. Fraser.

Tuesday, September 14, 2004

Privacy and knoweldge management 

One of the areas that I'm interested in, when my mind is not filled with privacy law stuff, is knowledge management. Luckily the blogging world is full of tremendous resources that not only provide useful news in the area, but also very insightful commentary. "Portals and KM", a blog written by Bill Ives, is one the best. His blog has gotten me thinking about KM in new ways, and I'm delighted that I've been able to return the favour by encouraging him to think about privacy aspects of knowledge management and portals: Portals and KM: Privacy Issues in Intranets - PIPEDA.

Privacy and knowledge management seem to reflect opposite philosophies of information management. Privacy usually suggests locking down data and limiting its circulation. KM, on the other hand, is usually based on notions of free flows of information, at least within an organization. Canadian companies are now having to think about how to integrate the two. It can be done, but involves some serious thinking and perhaps a few additional administrative steps. For example, prior work product and "best practice" documents need to be scrubbed of personally identifiable information before they are made widely available. Information about employees made available on intranets should be limited to that which is necessary from a business point of view and employees should know about what is put up there. Limiting access is also a good idea, because an HR intranet with employee data should not be available to the rank and file.

Anybody proposing to implement a portal or intranet with employee information would do well to consider privacy at the earliest stages, particularly in this age of identity theft (and when studies are saying most ID theft is an inside job). Of course, an experienced privacy lawyer can help you through this process ...

Labels: , ,

9/14/2004 09:35:00 AM  :: (2 comments)  ::  Backlinks

Here is a follow-on to your dialog. I learned the value of legal input and the need to consider the legal perspective several years ago when I was involved in a major KM implementation. We thought we had covered all the bases and were about to go live when the head of legal said that his staff would have to review all input. This process would have put a bottleneck on the effort that would have killed it. However, he had very real and legitimate concerns. For example, the firm had confidentiality agreements with customers that had to be honored. So we worked out a compromise by establishing a plocies aorund intellectual property and confidentiality, as well as putting in some techncial safeguards on content. We had the head of legal come to the first session introducing the new KM system and we created a videotape of his comments to be used in subsequent sessions. After this experience, I was sure to include the legal group as a key KM stakeholder, both in implementations I did and in presentations I did on success factors in KM.
Very good comment, Bill. Thanks. You may be interested in the "Privacy Impact Assessment" methodology that is discussed briefly in this blog post: It'll work for a portal roll-out (or other KM implementation) and makes sure that privacy aspects are considered at the very beginning, before it's too late or too costly to remedy.
Post a Comment

Links to this post:

Create a Link

This page is powered by Blogger. Isn't yours? Creative Commons License
The Canadian Privacy Law Blog is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 2.5 Canada License. lawyer blogs