The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.

Search this blog

Recent Posts

On Twitter

About this page and the author

The author of this blog, David T.S. Fraser, is a Canadian privacy lawyer who practices with the firm of McInnes Cooper. He is the author of the Physicians' Privacy Manual. He has a national and international practice advising corporations and individuals on matters related to Canadian privacy laws.

For full contact information and a brief bio, please see David's profile.

Please note that I am only able to provide legal advice to clients. I am not able to provide free legal advice. Any unsolicited information sent to David Fraser cannot be considered to be solicitor-client privileged.

David Fraser's Facebook profile

Privacy Calendar



Subscribe with Bloglines

RSS Atom Feed

RSS FEED for this site

Subscribe to this Blog as a Yahoo! Group/Mailing List
Powered by

Subscribe with Bloglines
Add to Technorati Favorites!

Blogs I Follow

Small Print

The views expressed herein are solely the author's and should not be attributed to his employer or clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Nothing herein should be used as a substitute for the advice of competent counsel.

This web site is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and David T.S. Fraser. If you are seeking specific advice related to Canadian privacy law or PIPEDA, contact the author, David T.S. Fraser.

Monday, November 21, 2005

A modest proposal for security breach notification 

Currently, there's a significant debate raging in the United States as the Congress considers a whole range of proposals related to an organization's obligation to notify individuals if the security related to personal information is compromised. The "gold standard" is that set out in California's legislation (Civil Code Sections 1798.29 and 1798.82), which requires notification of consumers if certain kinds of unencripted personal information is disclosed. Other states have followed California's lead with varying degrees of similarity.

Many pro-privacy commentators are concerned that Congress will ultimately enact legislation, such as HR 4127, which will pre-empt state laws and will only require notification if there is a "a reasonable basis to conclude that there is a significant risk of identity theft". This threshold is too high, it is argued, and consumers will never know when their information has been released. (See: DATA bill will not effectively help deal with the very real threat of ID theft.) Other commentators are concerned that if the threshold is too low, too many notices will be sent out to consumers and the notices will eventually be ignored and be meaningless.

For the purposes of the debate, allow me to suggest a compromise:

  1. The following information shall be defined to be "Sensitive Personal Information":
    • Social security number.
    • Driver's license number.
    • State-issued identification card number.
    • Passport number.
    • Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.
    • Information related to an individual's physical or mental health.
    • Telephone number, if it is unlisted.
    • Income information.
    • Information related to an individual's pardoned criminal convictions.
    • Information related to an individual's religious, political or other personal beliefs, unless such beliefs have been publicly communicated by the individual in a context where there is no reasonable expectation of privacy.
  2. Every orgnaization shall be required to report all breaches or suspected breaches of Sensitive Personal Information (communication of such information to an unauthorized third party) to the Federal Trade Commission, along with details of the breach or suspected breach.
  3. The FTC shall develop guidelines to determine what information, if compromised, may reasonably place the individual at greater risk of fraud or other harms.
  4. The FTC shall promptly determine, with reference to the guidelines, whether the individuals should be notified. If the FTC is of the view that notification is warranted, it shall issue a binding order to the organization.
  5. A summary of all notifications made by organizations to the FTC shall be made available by the FTC on its website.

I don't think this is the magic bullet, but I expect it would satisfy the stated objectives of both sides of the debate.

Any thoughts? Comments are welcomed, either using the blog's comment feature or via e-mail.

UPDATE 20051121: Added reference to letter by privacy and consumer groups.

Labels: , , ,

Links to this post:

Create a Link

This page is powered by Blogger. Isn't yours? Creative Commons License
The Canadian Privacy Law Blog is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 2.5 Canada License. lawyer blogs