CANADA
By Terry McQuay, CIPP, CIPP/C
Canadian Privacy Overseers Unite
Many IAPP members may not realize that Canada has 13 Information and Privacy Commissioners/ Ombudsmen (see list below) and that they work together to address privacy issues in Canada. An example of this teamwork is the February 5, 2008 joint resolution regarding enhanced driver's licences (EDL) which outlines the steps that need to be taken to ensure the privacy and security of any Canadian's personal information accessed as part of EDL programs.
The Government of British Columbia and the Government of Canada have entered into a memorandum of understanding respecting the issuance of an EDL to be used by Canadian citizens seeking to enter the United States. The Government of Ontario has indicated its interest in a similar program. No EDL project should proceed on a permanent basis unless the personal information of participating drivers remains in Canada. There must be meaningful and independent oversight of how the U.S. Customs and Border Patrol (a unit of the U.S. Department of Homeland Security) receives and uses the personal information of Canadians.
The Commissioners also continue to be concerned by the potential threat to privacy embodied by RFID technology, which may:
- permit the surreptitious location tracking of individuals carrying an EDL; and,
- not encrypt or otherwise protect the unique identifying number assigned to the holder of the EDL, and would not protect any other personal information stored on the RFID.
Canada's privacy guardians call on the Government of Canada and participating provinces and territories to take steps to ensure the security of personal information stored on the RFID tags embedded in enhanced driver's licences by ensuring that:
- robust privacy and security are built into all aspects of EDL projects, including by conducting thorough privacy impact assessments and threat risk assessments at the outset;
- their EDL programs comply with applicable local privacy legislation; and,
- they consult early and meaningfully with their privacy commissioner or other responsible privacy oversight official on all aspects of any contemplated EDL program.
Federal-Provincial-Territorial Information and Privacy Commissioners and Ombudsmen:
Canada
Office of Jennifer Stoddart, Privacy Commissioner of Canada
Alberta
Office of Frank Work, Information and Privacy Commissioner
British Columbia
Office of David Loukidelis, Information and Privacy Commissioner Phone
Manitoba
Office of Irene A. Hamilton, Ombudsman
New Brunswick
Office of Bernard Richard, Ombudsman
Newfoundland and Labrador
Office of Philip J. Wall, Information and Privacy Commissioner
Northwest Territories and Nunavut
Office of Elaine Keenan-Bengts, Information and Privacy Commissioner
Nova Scotia
Office of Dulcie McCallum, Freedom of Information and Protection of Privacy Review Officer
Ontario
Office of Ann Cavoukian, Information and Privacy Commissioner
Prince Edward Island
Office of Karen A. Rose, Information and Privacy Commissioner
Québec
Office of Jacques Saint-Laurent, President, Commission d'accès à l'information
Saskatchewan
Office of R. Gary Dickson, Information and Privacy Commissioner Phone
Yukon
Office of Tracy-Anne McPhee, Ombudsman and Information and Privacy Commissioner
For a complete listing of Privacy Laws in Canada visit www.nymity.com/NymityMapofPrivacyLaws-2007.pdf.pdf
Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers Web-based privacy support to help organizations control their privacy risks. Learn more at www.nymity.com.
Comments
If you want to comment on this post, you need to login.