The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.
The author of this blog, David T.S. Fraser, is a Canadian privacy lawyer who practices with the firm of McInnes Cooper. He is the author of the Physicians' Privacy Manual. He has a national and international practice advising corporations and individuals on matters related to Canadian privacy laws.
For full contact information and a brief bio, please see David's profile.
The views expressed herein are solely the author's and should not be attributed to his employer or clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Nothing herein should be used as a substitute for the advice of competent counsel.
This web site is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and David T.S. Fraser. If you are seeking specific advice related to Canadian privacy law or PIPEDA, contact the author, David T.S. Fraser.
Sunday, March 06, 2005
When giving presentations to companies on managing privacy risks, I often describe customer databases as akin to underground storage tanks. If something goes wrong with them, the results can be absolutely disastrous. If you really need the data and its value outweighs the risks, you can keep it in the ground but make sure it is taken care of. If you don't need the information, rid of it. Customer data is either an asset or a liability. If it ain't an asset, at best it is a potential liability. If something goes wrong, it is a huge liability. A couple of drips from your underground tank will taint your property. One leak of customer data can taint your company.
Until PIPEDA came along, there was no law in Canada that restricted what information a company could collect and how long it could be maintained. (PIPEDA says you can only retain information as long as is reasonably necessary for the purposes for which it was collected, which also assumes that it was collected with the knowledge and consent of the individual.) Many businesses routinely keep customer data they don't use, thinking that it may be useful some day. Some businesses kept it because it is cheaper to buy bigger hard drives than to think about how long to keep it. My local video store, I am sure, could tell you what I rented years ago. Why did they keep it? No idea. I never got a call saying "we noticed that you rented Terminator I in 1989 and Terminator II in 1994, and thought you'd like to know that we now have Terminator III." They had no reason to keep the info, but probably did in any event. Keeping that info lying around can put customers at risk and can ruin your customers' chances of becoming a member of the Supreme Court (see EPIC Video Privacy Protection Act Page).
A headline writer at the Washington Post, via Yahoo! News, refers to ChoicePoint's databases as having become a "powder keg" (Yahoo! News - ChoicePoint Data Cache Became a Powder Keg). I'd say that it didn't become a powder keg, it always was one. Blasting powder is obviously useful, but it needs to be protected and maintained. Handle with extreme care. And you shouldn't be keeping it in the shed unless you need it. ChoicePoint obviously thought they needed it (afterall, their business was built on that database), but hindsight says it wasn't adequately protected and it ultimately blew up.
The Canadian Privacy Law Blog is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 2.5 Canada License.