The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.
The author of this blog, David T.S. Fraser, is a Canadian privacy lawyer who practices with the firm of McInnes Cooper. He is the author of the Physicians' Privacy Manual. He has a national and international practice advising corporations and individuals on matters related to Canadian privacy laws.
For full contact information and a brief bio, please see David's profile.
The views expressed herein are solely the author's and should not be attributed to his employer or clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Nothing herein should be used as a substitute for the advice of competent counsel.
This web site is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and David T.S. Fraser. If you are seeking specific advice related to Canadian privacy law or PIPEDA, contact the author, David T.S. Fraser.
Tuesday, October 12, 2004
National Privacy Services has launched a month privacy newsletter to keep clients and others updated on privacy issues. It is designed to be a practical resource for businesses. You can subscribe by clicking the link on NPSi's website (http://www.privlaw.com).
The first edition of Privacy News contains the following article that I wrote:
Privacy Note: Privacy Risks of Electronic Communication
The same communication technologies that have revolutionized our workplaces, made workers more efficient and have freed us from our desks also pose particular privacy risks that need to be carefully considered to minimize the risk of accidental disclosure of personal information.
Virtually every privacy code and statute requires that custodians protect personal information against accidental disclosure. This obligation exists at every stage: from collection through storage to ultimate disposal. Virtually every means of communication comes with the risk that the information transmitted may be intercepted or misaddressed.
This risk is significantly heightened, however, with more recent and modern means of telecommunications. Letters can always be misaddressed, but the risk is relatively low if envelopes are individually hand-addressed, one at a time. Faxes and electronic mail take that risk to a whole new level. If a conventional phone number is misdialed, this fact immediately comes to the attention of the calling party. The call can be quickly and politely ended before any information is disclosed. A misdialed fax, on the other hand, will often be completely undetected to the sending party, particularly if another fax machine is reached at the other end of the line, producing a transmission report that simply states the fax was successfully sent. Electronic mail has very similar issues, as anybody who has accidentally clicked on "reply to all" can easily attest. In addition, auto complete features of some email systems may mean that a message may be sent to the first person matching a particular name in your address book, even if they were not the intended recipient. For example, an email meant for Sue Smith may be sent to Ann Smith if the sender is not paying sufficient attention. In addition, electronic mail messages are less secure than postcards because they routinely pass through the computer systems of complete strangers on their way to the final destination. An email message between neighbours using different internet service providers may actually leave the country before finally being routed to the proper inbox.
Health care organizations have always needed to be concerned about this in light of their ethical and professional obligations of confidentiality. New privacy laws, however, bring this issue to the fore once again. Most private sector health care providers now have a legal obligation to protect that information against disclosure and a person whose information is disclosed may be able to seek damages for the leak. In addition, some privacy laws require the custodian of that information to let the individual know that their information was accidentally disclosed. A recent example from the American media involved a hospital that accidentally sent patient records by fax to the newsroom of the local newspaper. Under Canadian laws, that media outlet is unrestricted in what it can do with that information once it has it in its custody. The hospital will consider itself lucky if a report describing its mistake only ends up on the front page of the paper.
A recent finding from the Office of the Federal Privacy Commissioner admonished an employer for allowing medical information about employees to be received at a central fax machine in their HR department. Incoming and outgoing faxes must be additionally secured, particularly when they send or receive sensitive personal information.
So what is an organization to do to secure the transmission of personal information against accidental disclosure? The following checklist provides some guidance:
- Consent to communicate by email should be obtained from the individuals in question, because email communications might be received by unintended parties. Workplace email systems may be routinely monitored by the employer and some people may give others access to their email box, for example to a secretary or a colleague if the individual is on vacation. Home email addresses may be used by a number of members of the same household, posing the risk that a sensitive message may be received by a number of members of that household.
- Email communications should be encrypted wherever possible.
- The "auto complete" feature of email systems should be disabled, requiring the full name of an individual recipient before a message is sent.
- Regularly called fax numbers should be programmed into the auto dial feature of fax machines. In the Health care setting, separate fax machines should be used: one for patient information and a second for other communications. Only vetted health care providers should be entered on the speed-dial feature of the patient information fax machine.
- Clear consent from patients or customers should be obtained before email or fax is used to communicate sensitive personal information.
- Facsimile cover pages should suggest that any unintended recipients contact the sender as soon as possible so that any harm done from the accidental disclosure can be mitigated as much as possible.
For more information on how to secure your organization, and your communications, against accidental disclosures of personal information, please contact National Privacy Services at 1-877-PRIVLAW.
The Canadian Privacy Law Blog is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 2.5 Canada License.