The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.
The author of this blog, David T.S. Fraser, is a Canadian privacy lawyer who practices with the firm of McInnes Cooper. He is the author of the Physicians' Privacy Manual. He has a national and international practice advising corporations and individuals on matters related to Canadian privacy laws.
For full contact information and a brief bio, please see David's profile.
The views expressed herein are solely the author's and should not be attributed to his employer or clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Nothing herein should be used as a substitute for the advice of competent counsel.
This web site is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and David T.S. Fraser. If you are seeking specific advice related to Canadian privacy law or PIPEDA, contact the author, David T.S. Fraser.
Friday, December 09, 2005
Kristina Lovejoy at Newsfactor is calling for omnibus privacy legislation for the US. What's interesting is that what she proposes looks a lot like the CSA Model Code that's built into PIPEDA:
NewsFactor Network - Enterprise - Beyond the Patchwork of Privacy Regulations:
...Because terms like privacy, confidentiality, and security often create confusion, the label 'information protection' was coined to encompass the range of mechanisms that guide collection, use, and disclosure of information. An information-protection regulation is one that enforces the right of privacy by dictating, among other things, requirements for maintaining the confidentiality, integrity, and availability of protected data.
In general, a strong information-protection plan would require the following:
1. Establishing ownership and accountability within the organization for confidentiality, integrity, and availability.
2. Identifying the reasons for obtaining private information from an end user and making those reasons available.
3. Establishing mechanisms for gaining consent of the end user before collecting private information.
4. Limiting collection of private information only to that information you need for business purposes.
5. Limiting use and disclosure only for the purposes for which you have gained consent, and limiting retention of information to a period specified by law or by user consent.
6. Ensuring that information collected is accurate.
7. Implementing administrative, technical, and physical controls around information to ensure its confidentiality, integrity, and availability.
8. Creating a culture of openness so that if the confidentiality, integrity, or availability of the information is breached in a significant way, the user is notified.
9. Providing the end user with documented escalation policy and process.
In the U.S., information-protection mandates have generally had impact only in certain market segments, such as the Health Insurance Portability and Accountability Act (HIPAA) in healthcare industry and the Gramm-Leach-Bliley Act (GLBA) in the banking sector.
Will there be increased pressure to regulate other industries? Yes. Will there be impetus for creating an Omnibus Information Protection regulation? Definitely.
The Canadian Privacy Law Blog is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 2.5 Canada License.