Why businesses need to ask themselves "What's the worst that can happen?"

Many businesses deal with personal information that they would not consider "sensitive" personal information. Names, addresses, delivery instructions, maybe payment information. Other than credit card data (which isn't retained, right?), most is seen to be routine, mundane transactional data.

But businesses need to constantly ask themselves what is the worst that can happen if personal information is disclosed? Or if any of their usual practices could somehow cause their customers harm of any kind. Privacy goes well beyond preventing fraud and identity theft. Personal information is powerful and what might be perfectly mundane to most may cause particular individuals real problems.

There's a story out of Texas that provides a great illustration of what can go wrong and how businesses should be thinking about their practices. A Texas resident is suing 1-800-FLOWERS for a million bucks because they sent him a card thanking him for his patronage. Nothing offensive there, right? But the thank you card was read by his soon-to-be ex-wife and it showed that the plaintiff had sent a dozen long-stemmed roses to someone else. What had been an amicable separation went sideways and she has significantly upped her demands. (See: Married Man Sues Florist for Revealing Affair: Man Sues for $1 Million After Wife Discovers He Bought Flowers for His Girlfriend.)

You may think he is a cheating weasel who deserves everything he gets. But, assuming the article is correct, was it really his florist's job to drop a dime on him? Simply put, no it isn't.

Some time ago, a cellular phone carrier in Ontario provided a customer's billing records to his wife because she said she was doing the monthly bills and couldn't understand some of the charges. He was having an affair and the bills told the tale. (National Post, 27 September 2003.)

I've heard of a clinic in Nova Scotia that called to ask a question about scheduling a patient's vasectomy and, when the patient wasn't home, asked his wife. No harm done in that case, but what if the spouse didn't know about the man's plans? What if it wasn't his wife who answered, but a friend, housekeeper, etc?

A while ago, the Alberta Privacy Commissioner "named and shamed" a pharmacist for disclosing a patient's prescriptions to the patient's spouse. The question related to tax records, but it did disclose psychiatric prescriptions.

What does all of this mean? Many of these disclosures are made in good faith with no intention to harm anyone. On the contrary, most are made to be helpful. But for some customers/patients, these disclosures can have disastrous consequences. Every business that collects, uses or discloses personal information has to be mindful of this.

Federal Privacy Commissioner releases privacy breach guidelines

The Federal Privacy Commissioner has just released privacy breach guidelines, which are similar to guidelines produced by the Ontario and British Columbia commissioners. Here is the press release, with links to the guidelines:

News Release: Privacy Commissioner releases privacy breach guidelines (August 1, 2007) - Privacy Commissioner of Canada

Privacy Commissioner releases privacy breach guidelines

Ottawa, August 1, 2007 – New guidelines will help organizations take the right steps after a privacy breach, including notifying people at risk of harm after their information has been stolen, lost or mistakenly disclosed, says the Privacy Commissioner of Canada, Jennifer Stoddart.

The guidelines outline some of the key steps in responding to a breach, such as containing the breach, evaluating the risks associated with it, notifying the people affected and preventing future breaches.

“It’s clear that most businesses take seriously their responsibilities under Canada’s private-sector privacy law. I want to thank the industry groups, civil societies groups and privacy commissioners' offices that helped my office in developing these,” Commissioner Stoddart says.

The Office of the Privacy Commissioner (OPC) has become increasingly concerned about privacy breaches and breach notification following some major data breaches in recent months. Earlier this year, Commissioner Stoddart urged the federal government to amend the Personal Information Protection and Electronic Documents Act (PIPEDA) to make it mandatory for businesses to notify people when their personal information has been breached.

“Our new voluntary guidelines do not take away from the need for breach notification legislation,” the Commissioner says. “I would once again urge the Minister of Industry and his cabinet colleagues to help better protect Canadians by making breach notification a legal requirement for businesses.” The guidelines call on businesses to notify people that their personal information has been compromised in cases where the breach raises a risk of harm. For example, there may be a risk of identity theft or fraud in cases where sensitive personal information has been lost or stolen.

Organizations are also encouraged to inform the appropriate privacy commissioner(s) of a privacy breach. (In British Columbia, Alberta and Quebec, provincially regulated businesses should speak to their provincial privacy commissioners. In Ontario, breaches involving personal health information must be reported to the provincial commissioner.)

The OPC is currently investigating two high-profile privacy breach cases involving large amounts of personal information.

In one case, the Canadian Imperial Bank of Commerce reported to the OPC the disappearance of a hard drive containing the personal information and financial data of close to half a million clients of its subsidiary, Talvest Mutual Funds.

The other investigation, being conducted jointly with the Information and Privacy Commissioner of Alberta, is looking at a breach at TJX Companies Inc., which affected thousands of Canadians who shopped at TJX’s Winners and HomeSense stores.

The new guidelines as well as a privacy breach checklist and a list of organizations which participated in the consultation process to develop the guidelines are available on the OPC website, http://www.privcom.gc.ca/.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy and the protection of personal information rights of Canadians.

Former privacy commissioner named as Ontario's conflict of interest commissioner

Ontario's first Information and Privacy Commissioner, Sidney Linden, has been named as Ontario's Conflict of Interest Commissioner: CANOE -- CNEWS - Canada: New Ont. conflict of interest commissioner named.

Oshawa second-hand store bylaw invades privacy

Earlier this week, the Ontario Court of Appeal, in Cash Converters Canada Inc. v. Oshawa (City) (July 4, 2007) (an appeal from Cash Converters Canada Inc. v. Oshawa (City), 2006 CanLII 3469 (ON S.C.)), overturned a City of Oshawa Bylaw that required sellers of second hand goods to collect detailed personal information about those who sell second hand goods to the stores. The bylaw was inconsistent with the Municipal Freedom of Information and Protection of Privacy Act.

Here's what the Toronto Star had to say about it:

TheStar.com - News - Oshawa second-hand store bylaw invades privacy: Court

Tracey Tyler

LEGAL AFFAIRS REPORTER

The Ontario Court of Appeal has struck down sections of a controversial Oshawa bylaw that require second-hand dealers to collect detailed personal information from people who sell them goods and transmit the data to police.

The bylaw conflicts with provincial privacy legislation, which requires the collection and retention of personal information to be strictly controlled, the court ruled Wedneday, The 3-0 decision could influence challenges to similar bylaws in other parts of the country, including Alberta and British Columbia.

“This decision comes at a time when cities are gaining broader law-making powers,” said David Sterns, a lawyer representing the Oshawa franchise of Cash Converters Canada Inc., a second-hand store that challenged the bylaw.

“The court has sent a strong signal that all forms of information gathering and surveillance by municipalities are subject to the public’s overriding right to privacy.”

Under the Oshawa bylaw, passed by the city in 2004 as part of a new licensing system for second-hand dealers, stores were required to record the name, address, sex, date of birth, phone number and height of their vendors, who also had to produce three pieces of identification, such as a driver’s licence, birth certificate or passport.

“This information is then transmitted and stored in a police data base and available for use and transmissions by the police without any restriction and without any judicial oversight,” said Justice Kathryn Feldman said, writing on behalf of Associate Chief Justice Dennis O’Connor and Justice Paul Rouleau.

Store owners were required to send reports to police at least daily, in some cases at the time of purchase. The city argued the bylaw was meant to protect consumers from purchasing stolen goods.

But the municipality offered no evidence of a growing problem involving the sale of stolen goods to second-hand dealers, said Feldman.

Nor is there evidence that unscrupulous people are more likely to be deterred by the electronic collection and transmission of personal information, she said.

In 2003, Cash Converters purchased more than 28,000 used items from people in 2003. About 30 of those were seized by police in connection with criminal investigations.

It’s unknown whether any were confirmed as stolen, the court said.

The bylaw did not apply to pawn shops, which are provincially regulated.

See, also, James Daw's column: TheStar.com - columnists - New ruling stands up for privacy.

Adoptees challenge disclosure legislation

Ontario's new Adoption Information Disclosure Act is being challenged in the courts and it looks like those arguing in favour of privacy are facing an uphill battle:

TheStar.com - News - Adoptees challenge disclosure legislation

"I'm not ready to buy those three words: right to privacy," said Justice Edward Belobaba, who noted earlier that the lawyers mounting the constitutional challenge on behalf of three adoptees and a birth parent "have the tougher job."

MySpace posting good enough for cross-examination

In case you were wondering, you really shouldn't expect that anything you post on your MySpace page will be kept private. If you are in the middle of litigation alleging that you're disabled, don't post pictures of your skiing vacation.

This recent case from earlier this month in Ontario is, I think, the first Canadian case to mention MySpace. The defendants attempted to use info from the plaintiff's MySpace page as a basis for further discoveries.

Weber v. Dyck, 2007 CanLII 22348 (ON S.C.)

PDF Format

Date: 2007-06-12

Docket: 05-CV-4343CM

2007

Weber v. Dyck

Ontario Master

Master L.A.M. Pope

Judgment: June 12, 2007

Docket: 05-CV-4343CM

Master L.A.M. Pope:

1 This action was scheduled for trial at a settlement conference held on December 1, 2006. The trial is number one on the trial list to commence the week of June 18, 2007. The defendants seek leave to bring this motion and for production from the plaintiff of information and documents pursuant to Rule 48.04(1). The information and documents relate to three activities of the plaintiff that took place subsequent to the plaintiff's examination for discovery on October 13, 2005.

2 The relief sought subparagraphs 1 (iv) and (v) of the Moving Party's Record are no longer in issue for the purposes of this motion.

3 This action arises out of a motor vehicle accident that took place on February 11, 2003 in which the plaintiff alleges that she sustained serious and permanent injuries to her left wrist and to her body, as well as emotional and psychic trauma. The action is governed by the Bill 59 insurance regime and as such the plaintiff has the onus to establish that her injuries meet the "threshold"; that is, that she has sustained a permanent serious impairment of an important physical, mental or psychological function within the meaning of section 267.5(5) of the Insurance Act in order for her to be entitled to damages.

4 At that time of her examination for discovery on October 13, 2005, the plaintiff was enrolled in year one of the Masters of Business Administration (Co-op) program ("MBA") at the University of Windsor. She testified at her examination that she earned part-time income by teaching piano and playing piano at weddings and other functions, what her plans were for employment after graduation and her vacation plans.

5 The following is the defendants' evidence that gave rise to this motion. The defendants learned that the plaintiff had a MySpace web page wherein she posted photographs of herself and announced certain information about herself. The undated photographs are of the plaintiff, for example, involved in what can be described as a somewhat physical activity in the Swiss Alps, in Paris, playing piano and at her graduation. The information exchange on the web page indicates that the plaintiff resides in Toronto and has a "new job." Further investigation revealed that the plaintiff worked as a Brand & Marketing Analyst for Level 5 Strategic Brand Advisors, that she recently completed her MBA specializing in marketing and international strategy and that she earned an ARCT (Associate of Royal Conservatory Teachers) designation. By letter dated March 30, 2007, the defendants requested production from the plaintiff of certain documents and information arising out of the information on the MySpace web page. Having received no response to that letter, Mr. Dycha wrote again to Mr. Leschied by letter dated May 2, 2007 and in that letter, Mr. Dycha added to his request for production additional documents and information.

Should leave be granted pursuant to Rule 48.04(1)?

6 The defendants seek leave to bring this motion for production pursuant to Rule 48.04(1) which provides that the consequence of a party setting an action down for trial or a party consenting to an action being placed on a trial list (as is the case here), is that the party shall not initiate or continue any motion or form of discovery without leave of the court. (emphasis added).

7 As this case is subject to the civil case management rules of Rule 77, it was placed on the trial list at the settlement conference held on December 1, 2006. There is no evidence that either party did not consent to the action being placed on the trial list. In my view, the consequences of placing a case managed action on a trial list are more serious than with a non-case managed case. This is evidenced by comparing the provisions of Rule 48.07 with subrules 77.14(2) and (4). The latter rules require a certification by the plaintiff that all examinations, production of documents and motions arising out of examinations and production of documents have been completed before the settlement conference date. Essentially, the parties who consent to an action being placed on the trial list declare that they are ready for trial. Subrules 77.14(2) and (4) support the purpose of the civil case management rules of reducing unnecessary cost and delay, facilitating early and fair settlements and bringing proceedings expeditiously to a just determination while allowing sufficient time for the conduct of the proceeding. In this case, the parties consented to the case being placed on the trial list with two exceptions as requested by the defendants and as ordered by Justice Nolan; firstly that the plaintiff deliver her x-rays by December 15, 2006, and secondly that the case be assigned an alternate trial date in the event the defendants did not have their expert reports by the June 18, 2007 trial list. The x-rays were delivered by the date ordered.

8 In order for the plaintiff to succeed in obtaining the right to further production of information and documents after a case has been placed on a trial list, they must first meet the requirements of Rule 48.04(1). The test for granting leave was aptly described by E.M. Macdonald J. in Hill v. Ortho Pharmaceutical (Canada) Ltd., [1992] 11 C.P.C. (3d) 236 (Ont. Gen. Div.) at 239, as follows:

The authorities make it clear that setting a matter down for trial is not a mere technicality of procedure. Before it can be vacated to permit any further discovery or other interlocutory proceedings, there must be a substantial or unexpected change in circumstances such that a refusal to make an order under s. 48.04(1) would be manifestly unjust.(emphasis added)

9 Plaintiff's counsel argues that the defendants were aware at the time of the mediation on July 26, 2006 and at settlement conference on December 1, 2006, that the plaintiff had graduated and therefore they should have brought this motion before agreeing to place the matter on the trial list. They further argue that given that the defendants consented to placing this matter on the trial list with the knowledge of the plaintiff's graduation, they should not be granted leave.

10 Firstly, there is no evidence before me of the above-noted allegations of the plaintiff. Secondly, it appears that Mr. Leschied provided Mr. Dycha with a copy of the plaintiff's transcript by letter dated December 20, 2006, several weeks following the settlement conference, (when the matter was placed on the trial list.) Moreover, the only evidence before me is that the defendants learned that the plaintiff had graduated on or about December 20, 2006, and that she had obtained a job and moved to Toronto when they discovered her MySpace web page. Therefore, it is my view that not only has the plaintiff had a substantial change in circumstances since this mater was placed on the trial list relating to her educational status, there has been a substantial change relating to her career, employment status and her place of residence. Albeit not all of these changes could be considered unexpected given her educational status at the time of her examinations for discovery, the test for leave does not require that the change in circumstances be substantial and unexpected. Therefore, I find that because there has been a substantial change in circumstances of the plaintiff since placing this matter on the trial list, it would be manifestly unjust in these circumstances not to grant leave for the defendants to bring this motion.

Rule 48.04(2)(b)(i) exception

11 The defendants submit that this motion falls within the exception set out in subrules 48.04(2)(b)(i). That rule provides that notwithstanding this matter being placed on the trial list, the plaintiff has a continuing obligation, pursuant to Rule 30.07, to disclose further relevant documents that come into her possession after serving an affidavit of documents or discovers that the affidavit is inaccurate or incomplete. If the plaintiff fails to make production of relevant documents she will be subject to the consequences set out in Rule 30.08. Rule 1.03 provides that a "document" includes data and information in electronic form.

12 The exception allowed in Rule 48.04(2)(b)(i) relates to subsequently discovered documents. The reason for this exception was explained by Master Dash in White v. Winfair Management Ltd., (2006) 16 C.P.C. (6th) (S.C.J.) at 48 as follows:

If a document is discovered and produced by the defendant after the plaintiff has completed his oral and documentary discovery and set the action down, it would constitute an unexpected change in circumstance that could mandate leave for further discovery thereon.

13 The defendants have requested the following documents:

1. a copy of the plaintiff's file from any employment placement agencies;

2. a copy of the plaintiff's current employment file and contact information relative to her immediate supervisor and individual in charge of Human Resources;

3. all photographs and video recordings from trips.

14 The defendants clarified that they were only seeking these documents for the last year and a half.

15 The first two documents set out above were not in the plaintiff's possession at the time of her examination for discovery on October 13, 2005 because they would have been created as a result of her graduating in the summer of 2006 and her subsequent job search. I am inclined to order production of these documents given the change in circumstances in the plaintiff's employment status and the fact that her income and job responsibilities are relevant to the threshold issue and the assessment of damages. Furthermore, there is no evidence before me that the defendants were aware that the plaintiff had graduated and/or had obtained a job at the time of the settlement conference on December 1, 2006. In fact, the plaintiff's evidence is that she did not provide the defendants with a copy of her transcript until December 20, 2006, following the settlement conference, as evidenced by Mr. Lescheid's letter of that date.

16 Regarding the third request above, clearly the photographs and video recordings requested were not in the plaintiff's possession at her examination for discovery such that the defendants could have requested them. The defendants urge me to grant the order based on the reasoning of the Master in the British Columbia case of Watt v. Meier , 2005 CarswellBC 3302 (S.C.) wherein it was the Master's opinion that in the hypothetical case where the main issue were a broken leg, where the plaintiff was claiming a significant disability and the defendant wanting to challenge the extent of the disability, then it would seem inherently possible that photographs from a vacation, where you may find somebody swimming or playing beach volleyball or all sorts of activities traditional on holidays, might be highly relevant to the question of the degree of a broken leg disability. I agree with the Master's reasoning; however, based on the reasons for my decision which follow, I have distinguished the Master's hypothetical case.

17 The defendants also rely on another case from the British Columbia Supreme Court of Tupper (Guardian ad litem of) v. Holding, [2003] B.C.J. No. 216wherein the plaintiff was ordered to produce vacation photographs. In that case the plaintiff sought damages for loss of her ability to enjoy life. The court stated that the documents sought include photographs of the plaintiff on vacation, posing or sitting with friends on the beach, and in front of various tourist sites; that is, they show her enjoying life. The court held that it was reasonable to conclude that the vacation photographs may assist the defendant in its defence of the plaintiff's claim. In both this case, as well as the Watt case, the motions were brought before the actions were set down for trial; therefore, the test for leave was not an issue before those courts.

18 I decline to order production of the photographs and video recordings for several reasons. Firstly, the parties consented to this action being placed on the trial list; therefore, they were deemed to admit that they were ready for trial. Secondly and more importantly, the defendants did not request production of the plaintiff's photographs and video recordings of her trip to Vancouver which she took the year before the examination. I fail to understand how the defendants would be entitled to photographs and video recordings of trips the plaintiff took after her examination for discovery when they did not see the relevancy in seeking production of photographs and video recordings of her pre-examination trips. The change in circumstances of the plaintiff relate to her career and employment status and has no relationship to her ability to travel which she testified to the fact that her injuries do not impact on her ability to travel. Lastly, the defendants have several images of the plaintiff from her MySpace web page with which they can cross examine the plaintiff at trial. This appears to be a form of further discovery to which the defendant is not entitled.

Rule 48.04(2)(b)(iv) exception

19 The defendants submit that this motion falls within the exception set out in subrule 48.04(2)(b)(iv). That rule provides that subrule (1) does not relieve a party from any obligation imposed by Rule 31.09 to correct answers given at an examination for discovery notwithstanding that the case was placed on the trial list. They further submit that in addition to the threshold issue at trial, another issue will be to what extent, if any, the plaintiff's avocational pursuits have been affected by her alleged injuries.

20 The information sought by the defendants is as follows:

1. a list of places the plaintiff sought employment;

2. details of the plaintiff's piano performances and piano lessons including sufficient details to identify and locate the persons for whom the plaintiff performed, along with the amounts received in compensation for services;

3. details of the plaintiff's travels for recreation or otherwise including particulars engaged in during her travels.

21 The defendants clarified that they were only seeking the above information for the last year and a half.

22 The questions and answers at issue are as follows:

Re: Career goals

154. Q. What's your ultimate ambition in terms of a career?

A. I'd like to get into international marketing, work for an international firm.

155. Q. Well, what do you mean by "international marketing"?

A. Global brand strategy.

156. Q. Okay. I'm going to guess that in order to do that you're going to have to potentially move from the city?

A. Yes.

157. Q. And do you have any objection to doing that?

A. No.

Re: Travel since the accident

377. Q. And have you had to travel anywhere since the accident for recreation or otherwise?

A. yes. I've travelled --

378. Q. (Interposing) Where have you been?

A. -- last September. I went to Vancouver last September.

Re: Piano

45. Q. Right, and the material that we've been given indicates that you also like to play piano. You teach piano --

A. (Interposing) I teach piano part-time.

387. Q. And you've got, you're still teaching the kids, right?

A. Correct.

388. Q. And how many hours?

A. Between 12 and 15. It's three, three evenings a week.

23 There is no evidence before me to suggest that these answers were not correct or were incomplete when given and that any time thereafter they became incorrect. Certainly certain aspects of the plaintiff's life have changed since her examination but that alone does not mean that her answers were incorrect or incomplete when made on October 13, 2005.

24 In particular, regarding the request for a list of the places the plaintiff sought employment, it is my view that notwithstanding the fact that there has been a substantial change in circumstances, this information is not relevant to any of the issues in this action therefore it is not to be produced. Regarding the requests for production of information about the plaintiff's piano performances, piano lessons and trips, I refuse to grant these orders because it can hardly be said that the defendants are now entitled to this information when they failed to ask for the same information for the period of time prior to the examination for discovery. To order production of this information would constitute a further form of discovery to which the defendant is not entitled.

Costs

25 Both parties filed Cost Outlines, however neither of them were complete in failing to specify the partial indemnity rate and actual rate or any of the points listed which are to be made in support of the costs sought. Both counsel attached a billing statement; however, a billing statement is not a substitute for setting out the partial indemnity and actual rates. These rates are some of the considerations in determining the cost order and without them an appropriate amount for costs cannot be determined. The Court cannot be expected to extrapolate the hourly rates from the billing statement and then calculate the partial indemnity rates. As the Costs Outlines were essentially useless for the purpose intended by the Rules, and given that the defendants were successful, at least in part, with their motion, costs are fixed at $750.00 payable by the plaintiff and the defendants forthwith.

Order

26 There shall be an order as follows:

1. The plaintiff shall produce the following within 7 days;

a) a copy of the plaintiff's file from any employment placement agencies; and

b) a copy of the plaintiff's current employment file and contact information relative to her immediate supervisor and individual in charge of Human Resources;

2. Costs to the defendants fixed in the amount of $750.00 payable forthwith.

END OF DOCUMENT

No-fly list has an apparently smooth takeoff

With the no-fly list coming online in the last twenty-four hours, I haven't heard of any instances of people being excluded from flying on the first day. It will be interesting to see how it all shakes out.

I spoke with Chris Lambie of the Chronicle Herald yesterday morning and he spent part of the afternoon at the airport seeing how it went on. Here's his article:

Smooth lift-off for no-fly list - TheChronicleHerald.ca

Airline passengers seemed keen on heightened security

By CHRIS LAMBIE Staff Reporter

The federal no-fly list caused no problems Monday at Halifax Stanfield International Airport.

Passengers seemed keen on the idea of a list meant to screen out anyone who poses a potential threat to aviation security.

"As long as my name’s not on it, I’m happy," Mike Moir said as he waited for a flight back to Ontario.

"If the people are bad, I don’t want them on my plane."

The 67-year-old Hamilton, Ont., man was in Nova Scotia to work as an official for last weekend’s national canoe team trials on Lake Banook in Dartmouth.

The only dilemma he can see with the scheme to flag potentially dangerous flyers is if an innocent person has the same name as someone on the list.

"How many Smiths are there in the world?" Mr. Moir said. "If they just pick everybody with the same name, it could be a problem."

Still, he thinks the list is a necessity.

"With all the terrorism going on in this world nowadays, it’s a good measure."

Dawson Wentzell and his wife, Bethany, were waiting with their toy poodle, Bailey, to board a plane for Edmonton.

The list could prompt lawsuits against the federal government if people lose money because they couldn’t board flights due to name mix-ups, Ms. Wentzell said.

"If someone is delayed from work and this is the reason why, someone is going to get sued," she said.

They didn’t even think about the new security measure before checking in for their flight to Nova Scotia.

"We got up at 5 a.m. and believe me my mind wasn’t on lists," she said.

The couple from Daniel’s Harbour, N.L., wasn’t on the no-fly list and neither was their dog.

"God help us if he was," Ms. Wentzell said. "We’d really be in trouble then."

The no-fly list didn’t cause any problems at the facility, said airport spokesman Peter Spurway.

"If you didn’t know it was on, you wouldn’t know it was on," he said. "It has not made a single impact on our operations today or the operations of our partners in the airline business. I checked around a couple of times and it’s just been chugging along."

But David Fraser, a privacy lawyer in Halifax, won’t be surprised to hear from clients who suddenly discover their names are on the no-fly list.

"We’re likely to hear people are going to have some difficulty in Canada simply because of the way that these sorts of lists have to be structured in order to catch or include in them people with non-English or French names that have to be transliterated or made into English equivalents, and some of them can be common names," Mr. Fraser said. "So there’s probably a fair amount of wiggle room in the way that they match against peoples’ names."

The Specified Persons List, announced last fall, includes the name, birth date and gender of anyone who might pose an immediate threat to aviation security. Airlines that fly into and out of Canada must check the names of their passengers against the list.

"There’s really the opportunity that a whole bunch of people who aren’t actually on the list, just people who have similar names and similar birthdates and other identifying characteristics (as those) on the list," Mr. Fraser said.

"I think that there’s a good chance that people will be not allowed to fly based on that sort of confusion."

Travellers only find out their name is on the list when they try to check in and get a boarding card.

"Vacation plans can be ruined," Mr. Fraser said. "There’s no real accountability at that end for the real sort of negative impact that inclusion on this list might have."

Ottawa has refused to release the number of people on the list.

"There’s always a very delicate balance when you’re dealing with national security issues, Mr. Fraser said. "It’s a delicate balance between openness and necessary secrecy. I think the whole process needs to be done in sunlight.

"Everything related to the process of the inclusion criteria and how it’s actually applied and recourse that individuals might have to get off the list really needs to be completely open and transparent and subject to significant scrutiny.

"We are talking about a potential infringement on an individual’s constitutional right to travel within Canada and also the right to leave Canada. It’s right there in the charter that you have those rights. And many of those rights, in a country as large as Canada, can only be exercised by air travel."

Imam Jamal Badawi, professor emeritus of religious studies at Saint Mary’s University, said Muslims, including himself, often have problems flying in the United States, where a similar list is already in place.

"I’ve heard of many horror stories where a child, for example, five years old, they say, ‘No, his name matches the potential terrorist to look for,’ and still they have to go through the clearance (process)," Mr. Badawi said.

The Canadian Council on American-Islamic Relations has called on Ottawa to scrap the no-fly list until it fixes fundamental flaws in the program.

"Some people suspect that the lists made here in Canada may not totally be homegrown," Mr. Badawi said. "It’s quite possible also that, because of the co-operation between the intelligence agencies in both countries, that some of the names on the watch list in the U.S. might end up here on our lists in Canada."

That could make some Canadian Muslims reluctant to fly, he said.

"It’s part of the very unfortunate trend in the post 9-11 era that, in the name of security, there is a great deal of encroachment on privacy, a great deal of encroachment on civil liberties," Mr. Badawi said.

He doubts the list will make flying safer.

"Anybody intent on wrongdoing, they probably will find some other way of carrying out their plans," Mr. Badawi said. "But even if there is some slight improvement in security, what is the price? The worst scenario, really, is that democratic countries would move toward totalitarian regimes in the name of security."

Federal Commissioner releases annual PIPEDA report

Hot on the heels of the Ontario report yesterday, the Federal Privacy Commissioner has released her annual report on PIPEDA. It really should be a must read for anyone interested in PIPEDA, as it discusses many of the notable cases of the last year and some of the issues in the Office of the Privacy Commissioner of Canada. For example, the average resolution time from initial complaint to final finding has moved to sixteen months, five more months than in 2005.

Here's the media release with links to the report.

News Release: Privacy Commissioner calls for stronger data protection: Tabling of Privacy Commissioner of Canada's 2006 Annual Report on the Personal Information Protection and Electronic Documents Act (May 31, 2007)

Privacy Commissioner calls for stronger data protection: Tabling of Privacy Commissioner of Canada's 2006 Annual Report on the Personal Information Protection and Electronic Documents Act

Ottawa, May 31, 2007 — There has never been a greater need to take data protection seriously as new data breaches reinforce concerns about both security issues and trans-border data flows, according to the Privacy Commissioner of Canada, Jennifer Stoddart. Her 2006 Annual Report on the Personal Information Protection and Electronic Documents Act (PIPEDA) was tabled today in Parliament.

High-profile data breaches among a few well-known banking and retail organizations during 2006 reinforce the very serious nature of privacy breaches and the need to better protect personal information held by private sector companies.

Despite these cases, complaints against some of the major sectors covered by PIPEDA since 2001 (financial institutions, insurance companies and the transportation sector) have declined slightly. This is in contrast, however, to those industries which have been subject to PIPEDA only since 2004, such as the retail and accommodation sectors. These sectors have been the subject of substantially more complaints than in previous years. Overall, there were 424 complaints in 2006, compared with 400 in 2005.

“We are pleased to see fewer complaints related to sectors more familiar with PIPEDA; I believe it stems from a stronger understanding of the Act. It would appear that compliance is improving with time and we look forward to seeing this trend continue,” says Commissioner Stoddart.

“Sectors with less experience with PIPEDA have more work to do. As they gain a better understanding of what the law requires, we expect to see a decrease in complaints involving them,” she says.

“Research we are releasing today shows a majority of businesses covered by the Act appreciate their role in protecting consumer information, although there are still too many firms that need to take their role more seriously.”

That research, a survey of Canadian businesses on a number of issues relating to privacy, was conducted by Ekos Research Associates earlier this year. The results raise important questions about whether some businesses are doing enough to fulfill their PIPEDA obligations.

The survey found:

• While the majority of businesses that collect personal customer information have fully implemented PIPEDA provisions (67 per cent), there are a small but not insignificant number that are only in the process of implementing (16 per cent) and others that are not in the process of doing so (15 per cent).
  
• Only a third of all businesses report having staff that has been trained about their responsibilities under Canada’s privacy laws.
  
• Less than one in five has sought clarification of their role, although this is also much higher among larger businesses.
  

“Almost half of the businesses studied tend to rate their company’s awareness of its responsibilities under the privacy laws favourably. However, a similar number report either low or moderate awareness. PIPEDA and its provincial counterparts regulate commercial activity in Canada. All businesses that handle personal information need a good understanding of what the law requires,” says Commissioner Stoddart. “Businesses must realize the importance of living up to the law’s privacy protection principles and the consequences of failing to do so.

“I am particularly concerned to see that only a third of businesses have provided privacy training for staff. Good training is absolutely essential to prevent privacy breaches.”

Going forward, these companies will need to take steps to ensure greater compliance with the Act. Canadians expect private sector organizations to safeguard their personal information, particularly given the proliferation of identity theft.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy and the protection of personal information rights of Canadians.

In the fall of 2007, the Office of the Privacy Commissioner will be hosting the who’s who of the privacy world at the 29th International Conference of Data Protection and Privacy Commissioners in Montreal. Details are available at http://www.privacyconference2007.gc.ca/.

To view the reports:

• Annual Report to Parliament 2006 – Report on the Personal Information Protection and Electronic Documents Act (Adobe format)
  
• Backgrounder: Findings of a 2007 poll commissioned by the Office of the Privacy Commissioner of Canada
  
• 2007 EKOS Research Associates survey: Canadian Businesses and Privacy-Related Issues

Ontario Commissioner releases annual report for '06

Yesterday, Anne Cavoukian released the 2006 annual report for the Office of the Information and Privacy Commissioner of Ontario. It's a pretty slick report and chock full of interesting info.

Ontario and B.C. Privacy Commissioners issue joint message: personal health information can be disclosed in emergencies and other urgent circumstances

This just crossed the wires and is likely of interest to those who followed the earlier discussions about using privacy legislation as an excuse for inaction.

CNW Group OFFICE OF THE INFORMATION AND PRIVACY COMMISSIONER/ONTARIO Ontario and B.C. Privacy Commissioners issue joint message: personal health information can be disclosed in emergencies and other urgent circumstances

Ontario and B.C. Privacy Commissioners issue joint message: personal health information can be disclosed in emergencies and other urgent circumstances

TORONTO, May 9 /CNW/ - In light of recent events, such as the tragic suicide of Nadia Kajouji, a student at Carlton University, and the Virginia Tech massacre of 2007, the Information and Privacy Commissioner of Ontario, Dr. Ann Cavoukian, and the Information and Privacy Commissioner of British Columbia, David Loukidelis, are reaching out to educational institutions, students, parents, mental health counsellors and healthcare workers in both provinces: personal health information may, in fact, be disclosed in emergencies and other urgent circumstances. The two Commissioners want to ensure that people realize that privacy laws are not to blame because they do permit disclosure.

The Commissioners want to send the clear message that privacy laws do not prevent counsellors or healthcare providers from contacting a person's family if there are real concerns that they may seriously hurt themselves. "When there is a significant risk of serious bodily harm, such as suicide, privacy laws in Ontario clearly permit the disclosure of personal information without consent, regardless of age. In such situations, schools may contact parents or others if there are reasonable grounds to believe that it is necessary to do so," says Commissioner Cavoukian. Commissioner Loukidelis adds that, "If there are compelling circumstances affecting health or safety, or if an individual is ill, B.C.'s privacy laws allow disclosure to next of kin and others, including school officials and health care providers. Individual cases can be fuzzy, but if someone uses common sense and in good faith discloses information, my office is not going to come down on them. Privacy is important, but preserving life is more important."

In Ontario, the Personal Health Information Protection Act (PHIPA) allows health care providers, such as mental health counsellors, to disclose personal health information when necessary to eliminate or reduce a significant risk of serious bodily harm. This would include disclosure to a physician or parent if there are reasonable grounds to believe it is necessary to do so. In fact, PHIPA specifically allows for this kind of disclosure in emergency or urgent situations. Commissioner Cavoukian clarified this in a Fact Sheet she issued in 2005 entitled, Disclosure of Information Permitted in Emergency or other Urgent Circumstances, available at http://www.ipc.on.ca/.

In British Columbia, Commissioner Loukidelis underscored, the public sector Freedom of Information and Protection of Privacy Act allows universities, schools, hospitals and other public institutions to disclose personal information where someone's health or safety is at risk. He also noted that the private sector Personal Information Protection Act contains similar authority to disclose personal information for health and safety reasons.

Both Commissioners are today announcing their joint project to issue a new publication aimed at clarifying the role that privacy laws play when workers are trying to decide whether they can disclose personal health information. Commissioner Cavoukian said of the joint project, "Our goal is to ensure that educational institutions understand the legislative framework in advance of problems occurring. We are looking forward to working further with the educational community - stay tuned."

Commissioners Cavoukian and Loukidelis are urging those responsible for the health and safety of others to educate themselves about how the privacy laws covering them apply to their work and familiarize themselves with the provisions allowing them to disclose personal health information in emergency situations. Commissioner Loukidelis says, "I know that frontline decisions have to be made quickly and sometimes the facts may not be as clear as you'd like. But there's no doubt that privacy laws support disclosures to protect health and safety." Commissioner Cavoukian agrees that privacy laws are not at fault. "To infer that privacy laws were responsible for someone's death is to completely misunderstand the role that privacy laws are designed to play. The tragedy here lies if you take a default position of non-disclosure and inaction," says Commissioner Cavoukian. She also adds that, "However, Commissioner Loukidelis and I both recognize that the decision to notify someone's family without their consent can be extremely difficult, requiring very sound judgment. We are also clear that notification cannot be done on a routine basis and that students need to feel reassured that their privacy will be protected when they seek counselling or other health care services."

If you handle personal information, you'd better know the exceptions in privacy laws

If you handle personal information and only read one privacy law article, this one should be it:

Far too often, bureaucrats, cops and others use poorly understood privacy laws as a justification for inaction. Maybe it's just that they don't fully understand the myriad rules and the multiplicity of exceptions.

Privacy laws are complicated and are not well understood, even by people whose day-to-day operations are affected by them. But they are generally sensible and coherent. And -- believe it or not -- they are laced with common sense.

I've had the opportunity to look at every privacy law in Canada and I don't think I've seen one that does not have a public interest override. A public body, in the public sector context, can disclose personal information without consent if it is in the public interest to do so. There are often other exceptions from the general rule that requires consent.

Some may recall the aftermath of the south Asian tsunami where the federal government said they couldn't name victims or survivors because of the Privacy Act. The Privacy Commissioner and others were pretty quick to point out s. 8 of the Privacy Act, which allows the government to disclose personal information where it is in the public interest:

8(2) Subject to any other Act of Parliament, personal information under the control of a government institution may be disclosed

...

(m) for any purpose where, in the opinion of the head of the institution,

(i) the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or

(ii) disclosure would clearly benefit the individual to whom the information relates.

(I wrote about it on this blog at the time: Editorial urges that naming Canadian tsunami victims is in the public interest & Fallout from naming/not naming Canadian victims)

I was recently reminded of this in a discussion about the failure of the police in Merritt BC to identify a suspect on the lam after a family was found murdered. Police blamed privacy laws. (RCMP grilled for delay in alerting town over suspect) The National Post Editorial Board called them out on the misstep:

The Post editorial board on the Allan Schoenborn case: The RCMP's high-profile failure - Full Comment

...Two days later, Ms. Clarke returned from errands to find her children murdered, and their father vanished along with his dog. The RCMP, confronted with a gruesome spectacle that may have resulted from their failed efforts to get Schoenborn under lock and key, took nearly a full day to announce to the public in Merritt that he was the prime suspect in the killings. Their excuse? "Due to privacy concerns," said RCMP Staff Sergeant Scott Tod, "we had to make sure that we had information that this was the suspect before we released his name."

"Privacy" is a popular item these days in the lexicon of justice, as it is used by the Mounties. No act of ineptitude in communicating with the public can possibly escape its reassuring cover, even though every privacy law or code written down anywhere in the last 50 years contains public-interest exemptions.

Most recently, a University in Ontario has been called to account for not notifying the parents of a mentally ill student who subsequently committed suicide. Privacy laws were pointed to as preventing such action. Anne Cavoukian and her counterparts have reminded universities that these laws are easy scapegoats, but without exception contain provisions that allow privacy rights to be overridden in certain circumstances.

Universities grapple with providing health services, protecting privacy

...University officials say they followed procedures and couldn't tell Kajouji's parents about her mental health because of the province's privacy law. They also indicated universities that don't respect the privacy of their students' health information risk driving students away from the very services designed to help them.

Ontario's privacy commissioner, Ann Cavoukian, and several of her counterparts in other provinces, say universities need to have a clearer understanding of what privacy laws allow and they cautioned that too often privacy laws are the automatic target of blame when controversy arises.

Cavoukian's office provided a fact sheet several years ago to universities explaining the law allows them to disclose personal health information in "compelling circumstances" and if they believe on reasonable grounds it would eliminate or reduce the risk of bodily harm.

Determining whether a situation warrants disclosure is a judgment call, Cavoukian said in an interview, though the law affords protection to the decision-maker as long as he or she acted in good faith.

"If you are a health-care practitioner or a university professional and you have information relating to a student that is considering suicide and you fear for that person and want to reduce the risk of suicide, absolutely you are allowed to release that information," she said. "It's not an easy decision but it is one that is permitted under our privacy laws and I'm sick and tired of people saying that it's the privacy laws that prevented the counsellors from contacting the girl's parents. That's incorrect," she said.

... Suzanne Blanchard, vice-president for student support services, said in an e-mail message the university has specific procedures to deal with students who are in "imminent danger of doing harm to themselves or others."

"Carleton University has reviewed its actions in the aftermath of Nadia's tragic death. We believe that we followed all proper procedures and provided all the support services we could for Nadia," she said. "Carleton University is always diligent in its compliance with Ontario's privacy laws and we believe that we acted, and continue to act, in accordance with those laws."

Cavoukian said some universities take their obligations under the privacy law seriously, but there is still a lot of confusion. She plans to convene a meeting with the Council of Ontario Universities in an attempt to clarify any lingering questions.

Saskatchewan's privacy commissioner agreed there is a "significant need for more education" about the flexibility that is built into privacy laws.

"Sometimes you have people who don't want to do the wrong thing and so therefore you get a kind of paralysis and they don't share information even when the law allows them to and it's appropriate to do so," said Gary Dickson.

Dickson said Kajouji's death, while tragic, provides incentive for universities to ensure they are prepared to deal with students' mental health issues and with situations where informing the parents is up for debate. "Decisions will have to be made and then there have to be people with the appropriate training and judgment who can then make that discretionary decision," he said.

Frank Work, Alberta's privacy commissioner, said it has to be kept in mind Kajouji was an adult and the university may have felt her situation was under control. All the law asks is that a standard of reasonableness be applied, said Work.

"I think it's true in just about every privacy law, the standard is always reasonableness, not perfection," he said.

People will disagree on whether Carleton made the right decision, but one thing the privacy commissioners all agree on is the decision needs to be given due consideration.

"The worst case scenario is if it's just neglect. They saw the bus coming and they didn't yell: 'Get out of the way.' We don't know here. Hopefully in this case they made a judgment call," said Work.

Ontario's commissioner similarly said university officials have to take the time to make the difficult determination and should not rely on privacy laws as the default reason for not disclosing personal information.

"I would urge people to resist the knee-jerk reaction of automatically blaming privacy laws," Cavoukian said.

Here is the moral of this story: Whenever common sense or humanity seem to bump up against privacy laws, take a close look at the law and its exceptions. You will probably find that the drafters have designed the laws to accommodate common sense and humanity.

Supreme Court of Canada throws out evidence of drugs obtained by fly-by sniff

In a decision released today, the Supreme Court of Canada has upheld a decision that excluded evidence obtained in a sweep of an Ontario school by sniffer dogs. In this case, the police were invited by a school principal to walk a sniffer dog through the building to enforce the "zero tolerance" policy for drugs. When the dog reacted to an unattended backpack, the police opened it and found drugs. At trial, the accused argued that the search was unconstitutional and the evidence should be excluded. The trial judge agreed and the Supreme Court of Canada has upheld that decision.

In the result, police can only use sniffer dogs and open backpacks if they have a reasonable suspicion is demonstrated. Any holding otherwise would enable the police to effectively see through backpacks, into their contents. The Court concluded that teenagers have a reasonable expectation of privacy in closed backpacks.

A positive reaction from a sniffer dog, the Court concluded, is not sufficiently reliable to indicate the actual presence of drugs. Sniffers detect smells that indicate that drugs may be present, may have been present or that the backpack has been exposed to drugs, or "the dog is simply wrong". As the Court noted, "in the sniffer dog business, there are many variables."

Here's the headnote:

Supreme Court of Canada - Decisions - R. v. A.M.

Per McLachlin C.J. and Binnie J.: The police possess common law authority to use sniffer dogs in appropriate circumstances. If the police in this case had been called to investigate the potential presence of guns or explosives at the school using dogs trained for that purpose, the public interest in dealing quickly and efficiently with such a threat to public safety would have been greater and more urgent than routine crime prevention. [7] [37]

The dog sniff amounts to a search within s. 8 of the Charter. The information provided when the dog is trained to alert to the presence of controlled drugs permits inferences about the precise contents of the source that are of interest to the police. The subject matter of the sniff is not public air space. It is the concealed contents of the backpack. As with briefcases, purses and suitcases, backpacks are the repository of much that is personal, particularly for people who lead itinerant lifestyles during the day as in the case of students and travellers. Teenagers may have little expectation of privacy from the searching eyes and fingers of their parents, but they expect the contents of their backpacks not to be open to the random and speculative scrutiny of the police. This expectation is a reasonable one that society should support. The guilty secret of the contents of the accused’s backpack was specific and meaningful information, intended to be private, and concealed in an enclosed space in which the accused had a continuing expectation of privacy. By use of the dog, the policeman could “see” through the concealing fabric of the backpack. [8] [62‑63] [66‑67]

Although a warrantless sniffer‑dog search is available where reasonable suspicion is demonstrated, the sniffer‑dog search of the students’ belongings in this case violated their Charter rights under s. 8. The dog‑sniff search was unreasonably undertaken because there was no proper justification. The youth court judge found that the police lacked any grounds for reasonable suspicion and the Crown has shown no error in the youth court judge’s finding of fact. [91]

While the sniffer‑dog search may have been seen by the police as an efficient use of their resources, and by the principal of the school as an efficient way to advance a zero‑tolerance policy, these objectives were achieved at the expense of the privacy interest (and constitutional rights) of every student in the school. The Charter weighs other values, including privacy, against an appetite for police efficiency. Because of their role in the lives of students, backpacks objectively command a measure of privacy, and since the accused did not testify, the question of whether he had a subjective expectation of privacy in his backpack must be inferred from the circumstances. [15] [62‑63]

In the context of a routine criminal investigation, the police are entitled to use sniffer dogs based on a “reasonable suspicion”. If there are no grounds of reasonable suspicion, the use of the sniffer dogs will violate the s. 8 reasonableness standard. Where there are grounds of reasonable suspicion, the police should not have to take their suspicions to a judicial official for prior authorization to use the dogs in an area where the police are already lawfully present. All “searches” do not have the same invasive and disruptive quality and prior judicial authorization is not a universal condition precedent to any and all police actions characterized as “searches” given that the touchstone of s. 8 is reasonableness. Account must be taken in s. 8 matters of all the relevant circumstances including the minimal intrusion, contraband‑specific nature and high accuracy rate of a fly‑by sniff. The warrantless search is, of course, presumptively unreasonable. If the sniff is conducted on the basis of reasonable suspicion and discloses the presence of illegal drugs on the person or in a backpack or other place of concealment, the police may confirm the accuracy of that information with a physical search, again without prior judicial authorization. But all such searches by the dogs or the police are subject to after‑the‑fact judicial review if it is alleged (as here) that no grounds of reasonable suspicion existed, or that the search was otherwise unreasonably undertaken. [12‑14]

Permitting the police to act on a standard of reasonable suspicion within the framework of s. 8 will allow inappropriate conduct by the dog or the police to be dealt with on the basis that although the lawful authority to use the sniffer dog does exist, the search in the particular case was executed unreasonably, and thereby constituted a Charter breach, on the basis of which the evidence obtained may be excluded. The importance of proper tests and records of particular dogs will be an important element in establishing the reasonableness of a particular sniffer‑dog search. From the police perspective, a dog that fails to detect half of the narcotics present is still better than no detection at all. However from the perspective of the general population, a dog that falsely alerts half of the time raises serious concerns about the invasion of the privacy of innocent people. An important concern for the court is therefore the number of any such false positives. It is important not to treat the capacity and accuracy of sniffer dogs as interchangeable. Dogs are not mechanical or chemical devices. Moreover, the sniff does not disclose the presence of drugs. It discloses the presence of an odour that indicates either the drugs are present or may have been present but are no longer present, or that the dog is simply wrong. In the sniffer‑dog business, there are many variables. [82] [84‑85] [87‑88]

In sniffer‑dog situations, the police are generally required to take quick action guided by on‑the‑spot observations. In circumstances where this generally occurs, it is not feasible to subject the “sniffer dog’s” sniff to prior judicial authorization. Both the subject and his suspicious belongings would be long gone before the paperwork could be done. In the particular context of sniffer dogs, there is sufficient protection for the public in the prior requirement of reasonable suspicion and after‑the‑fact judicial review to satisfy the “reasonableness” requirement of s. 8. [90]

The trade‑off for permitting the police to deploy their dogs on a “reasonable suspicion” standard without a warrant is that if this procedure is abused and sniffer‑dog searches proceed without reasonable suspicion based on objective facts, the consequence could well tip the balance against the admission of the evidence if it is established under s. 24(2) of the Charter that, having regard to all the circumstances, the admission of it in the proceedings would bring the administration of justice into disrepute. Youth court judges have a greater awareness than appellate judges do of the effect that admission or exclusion of the evidence would have on the reputation of the administration of justice in the community with which they deal on a daily basis. Here, the youth court judge excluded the evidence. His exclusion of the evidence should not be interfered with. [14] [90] [98]

The irony of privacy enhancing technologies

I reported last month that the Information and Privacy Commissioner has issued a report on the proposal to dramatically increase video surveillance on public transit in Toronto. (Canadian Privacy Law Blog: Ontario Commissioner releases detailed report on TTC surveillance cameras)

InterGovWorld.com has an extensive article on the Commissioner's suggestion that reversible faceblurring technology may make the system more palatable. I spoke with the author, Rosie Lombardi, at length on the topic who has done a good job of summing up my take on the topic:

More privacy-boosting technology begets more video surveillance

... A point that's often overlooked is that privacy legislation is ultimately about feelings, says David TS Fraser, a privacy lawyer at Halifax-based law firm McInnes Cooper. "Although the legislation is written in a way that talks about personally identifiable information and identity theft, it's ultimately designed to protect people's sensibilities about unwanted intrusions," he says.

PET technology may not be enough to address those sensibilities unless the rules governing the use of surveillance are stated. "While the technology may do a good job of limiting the actual intrusions, I'm not sure it does much to address people's feelings about being watched. Unless the policies and procedures around surveillance are clearly communicated, it won't diminish that visceral feeling of unease about being spied upon."

Fear of the unknown is at the core. "If you see a cop at a corner, you can tell from his uniform who he is, what he's looking at, and if you've aroused his suspicions," he says. "But a camera is completely faceless. You don't know who's watching and how the information captured is used - will it wind up on late-night television?"

He notes a significant number of videos in these shows displaying people caught in embarrassing situations come out of Britain, where an extensive network of cameras in public places is rousing a public backlash. Cavoukian noted in her report that U.K. camera operators have caught entertaining themselves by zooming in on attractive women. "If you're going to outsource surveillance to a bunch of badly-paid guys locked in dark rooms, they're going to see more bums than bombs," agrees Fraser.

He concedes that automating the enforcement of policies and procedures around surveillance with PET technology rather than relying on fallible human operators to refrain from misusing the information offers some comfort. But he warns this may have the unintended effect of increasing video surveillance. "Unfortunately, this stuff makes it more acceptable to put video cameras all over the place, and by making it better and safer with less intrusive technology, it may ironically lead to more surveillance."

Incident: Ontario patient files found in dumpster

The Ontario Information and Privacy Commissioner is investigating after old medical records were found in a dumpster behind a coffee shop by a retiree. The affected patients will have to be notified as the information is subject to PHIPA, which contains Canada's only mandatory breach notification. See: TheSpec.com - Local - St. Joe's patient files found in dumpster.

Boy awaits bone-marrow transplant

This has nothing to do with privacy, but I'm trying to get the word out as widely as I can.

Many in Atlantic Canada may recall hearing about Zachery Hall in the newspapers and on the regional television news some time ago. Zachery was a little boy who suffered from the disease Adrenoleukodystrophy (ALD) [http://en.wikipedia.org/wiki/Adrenoleukodystrophy]. It is a very rare disease in which the body's myelin is progressively destroyed by a mechanism that is not well understood. (Myelin is the insulation for our body's nerve cells.) The disease causes progressive deterioration of the nervous system, leading to failure to develop, seizures, loss of coordination, then blindness, deafness, dementia and ultimately death.

Members of the community were very generous to support Zachery's family while he was undergoing treatment. Our support also helped him to go to Disneyland with his family while he was still able to enjoy it. Zachery Hall died in 2006 at age 10.

Zachery's little brother, Bretton, has been diagnosed with the same horrendous disease. They have been able to identify it at a much earlier stage than Zachery's and are hopeful that earlier treatment may be able to provide him with a longer life with greater quality of life.

Bretton's family is not well off to begin with. He will be receiving very long and expensive treatments in Ontario. We hope to be able to assist the family with their expenses in this.

Bretton's aunt and I have set up a trust account at ScotiaBank to assist the family. We hope to be able to help with his treatments, assist with his quality of life and to help the family in what is a devastatingly difficult time. The community has been very generous in the past and I'm hopeful that we may be able to help this family in our community. If you are able to make a donation, please let us know. You can send a cheque to either of us, payable to “Jo Anne Conrod and David Fraser in Trust”, or you can make a deposit at any Scotiabank Branch (Name: Jo-Anne Conrod & David T. Fraser (In Trust for Bretton Kinslow) / Act#: 700030255629 / Transit#: 70003).

David Fraser

c/o McInnes Cooper

1300-1969 Upper Water Street

PO Box 730

Halifax, NS B3J 2V1

Jo-Ann Conrod

c/o St. Matthew’s United Church

1479 Barrington Street

Halifax, NS B3J 1Z2

Donations are gratefully received through the account shown above, or via PayPal.

---

From today's Halifax Daily News:

Halifax, The Daily News: News Boy awaits bone-marrow transplant

Not unlike other boys his age, six-year-old Bretton Kinslow spent a good chunk of time before bed last night jumping off the couch, trying out new wrestling moves and practising tricks on his skateboard.

Unlike other boys his age, Bretton and his family are standing by at their Hatchet Lake home for a call from Sick Kids Hospital in Toronto with the news that there's a stem-cell match for the grade primary student.

On Nov. 8, Bretton was diagnosed with the same genetic disease that killed his brother Zachery Hall just last year at the age of 10.

Adrenoleukodystrophy or ALD - a rare disease that was depicted in the 1992 film Lorenzo's Oil - causes damage to the myelin sheath that insulates the nerve cells in the brain.

Severely affected

The most common type of ALD is linked to the x-chromosome and, with only one x-chromosome, men are more severely affected.

Young boys are the most common victims of the disease, which causes progressive deterioration of the nervous system leading to loss of co-ordination, blindness, deafness, dementia and, ultimately, death.

By the time doctors realized what was wrong with Zach, his mother Lisa Kinslow said, it was too late.

But after he became sick, the IWK kept a close eye on Bretton.

"They monitored Bretton every six months," Kinslow said.

At the last six-month checkup, it was confirmed Bretton had developed ALD.

He's now on the list for a bone- marrow transplant, which is conducted using the stem cells from an umbilical cord.

With the transplant, every cell in Bretton's body will be renewed, hopefully staving off the deterioration of his nervous system.

"He won't even have the same blood type anymore," Kinslow said.

While Bretton bounced himself off the couch, showing off for the photographer, Kinslow and her husband Mark explained there are no guarantees the transplant will save Bretton, but he has a better chance than his older brother, who was diagnosed too late.

"With Zach, it was different; we knew the outcome," she said.

"With this one, we're fighting for it."

Some understanding

Kinslow said Bretton has some understanding of what's going on.

He knows he's going to Toronto for the doctors to make him better; he knows he'll have to take a lot of medication; and because of chemo-therapy before the transplant, he knows he'll probably lose his hair.

"I don't want to be bald," he said at one point last night, grinning and rubbing his head.

Kinslow admitted it's been a rough go for the family.

She's trying to keep it together for Bretton and trying not to let his illness become the focus.

"We spend every day with him, we play with him, we talk with him," she said.

"There's nothing that he wants to do that we don't try."

Bretton's aunt, Jo-Anne Conrod, and family lawyer David Fraser with McInnes Cooper have set up a trust fund for Bretton and his family to help get them through their time in Toronto and future challenges.

Donations can be deposited at any Scotiabank branch under the name Jo-Anne Conrod and David T. Fraser (In Trust for Bretton Kinslow/Acct. # 700030255629/ Transit #70003)

Warrantless disclosure in the news

The trial of an accused trader in child pornography has brought the question of warrantless disclosure of ISP subscriber information to the national media's attention. It is understood to be the first time a superior court will consider whether basic subscriber information disclosed by an ISP without a warrant violates the Charter. The decision on this question is expected tomorrow. Stay tuned ...

The National Post, the Globe & Mail and the Toronto Sun discuss the issue:

The Globe & Mail - Wednesday, April 09

A precedent on Internet privacy in the making

Christie Blatchford

An Ontario Superior Court judge may rule as early as tomorrow in a precedent-setting Internet privacy case that could significantly set back how police conduct probes into online child pornography.

At issue is basic "subscriber information" from an Internet service provider, or ISP, which in this particular case was obtained under search warrant by Toronto police in an investigation that ultimately saw Robert Norman Smith, a Toronto actor once featured in popular Alexander Keith's beer commercials, charged with two counts of possessing child pornography and one of making it available.

Mr. Smith, 41, has pleaded not guilty.

But because the decision will be a first for superior courts in Canada, and because such decisions are binding upon the lower courts, the ruling will have broad impact.

Usually, police are able to obtain subscriber information - this is the customer's name and address - from Internet providers with what's called a simple "law enforcement request" made under the federal Personal Information Protection and Electronic Documents Act, commonly called PIPEDA.

While this legislation, which was phased in over several years beginning in 2000, sharply restricts the use and dissemination of personal information in commercial contexts, it also explicitly allows for the disclosure of customer name-and-address information to police.

But in this case, the provider, Bell Canada, refused to hand over the subscriber information, so the police resorted to getting it with a judicially approved search warrant.

On the first full day of trial yesterday before Superior Court Justice Robert Clark, Mr. Smith's lawyer, Cindy Wasser, argued that "people must have the expectation of privacy in their Internet use and they must have the right to challenge" search warrants that force ISPs to hand over their names and addresses to police.

"You can't just say this case is about child pornography," Ms. Wasser told the judge. "It's about the Internet and how we all use it and our expectation of privacy."

She is seeking legal standing for Mr. Smith to challenge the warrant; only if successful will she actually be able to challenge the validity of the warrant itself.

But if Judge Clark agrees that Mr. Smith had a reasonable expectation of privacy and grants him standing, it would mean police forces across the country, who daily obtain subscriber information under PIPEDA requests, would have to revert to the old, labour-intensive system of seeking search warrants every time they want customer information from ISPs.

Additionally, search warrants are problematic for police probing Internet crimes simply because they are more time-consuming.

Crown prosecutor Allison Dellandrea argued that because every Internet user automatically "broadcasts his IP [Internet protocol] address to potentially millions of people" every time he signs on, and because ISPs typically warn users in service agreements that their identities may be disclosed, there can be no expectation of privacy.

Furthermore, Ms. Dellandrea said that just because a commercial enterprise, such as Bell or another ISP, or even the drafters of PIPEDA, deem a block of information to be "private" doesn't mean it is private in a Charter-protected sense.

"That's quite different from what the Constitution says is privacy deserving of protection," she said.

Section 8 of the Canadian Charter of Rights and Freedoms protects people from unreasonable search and seizure, but defines privacy as "a biographical core of personal information" that tends to reveal "intimate details of the lifestyle and personal choices of the individual." Only then is the Charter protection engaged.

What was disclosed by Bell Canada to police in Mr. Smith's case was simply his name and address, information that is often readily available online or from phone books.

But Ms. Wasser argued that in combination with what the police already had learned from their investigation about his alleged use of child pornography, that minimal information was neither as benign nor innocuous as it seemed.

She urged the judge to consider not only what information the police received, but how they used it.

The Toronto investigation began in the fall of 2005, with police developing a system of searching that allowed them to view IP addresses of people sharing or making available certain child-pornography files.

Using a publicly available database, investigators were then able to determine which providers owned the IP addresses.

On Nov. 22, under one search warrant, they got the name and address information from Bell that led them to Mr. Smith, and in February the next year, under another warrant, they conducted a search of his north Toronto home.

At the time of his arrest that day, police alleged they found on his computer more than 1,000 electronic files, including movies and pictures, of children as young as 1 engaged in sexual activity.

Judge Clark said he may have a decision by tomorrow, but that the case will go ahead regardless.

From the National Post:

Television beer pitchman at centre of pornography, privacy battle

Shannon Kari, National Post

Published: Wednesday, April 09, 2008

The trial of a former television pitchman could be a precedent-setting case in deciding the privacy rights of Internet subscribers who are the subject of a criminal investigation.

Robert Smith is on trial in Ontario Superior Court on one charge of possession of child pornography and one charge of making child pornography available.

The actor was featured in commercials for Alexander Keith's beer as a character with a thick Scottish accent, until his arrest in February 2006.

Toronto police arrested Mr. Smith after an investigation into distribution of child pornography on Internet-based file sharing networks.

After discovering a specific Internet protocol address and learning it belonged to a Bell Canada customer, police executed a search warrant to obtain the subscriber information from the Internet Service Provider (ISP).

Mr. Smith is arguing there were not reasonable grounds for the first warrant to be issued or for a second one to be executed at his home.

The Crown responded that Mr. Smith has no right to challenge the warrant executed against Bell because there are no privacy rights in Internet subscriber information.

In a 2005 civil case about the downloading of music from file-sharing networks, the Federal Court of Appeal found there were privacy rights in this data and they could not be disclosed without a court order.

The prosecution of Mr. Smith is believed to be the first time a Superior Court in Canada has been asked to decide whether police are required to obtain a search warrant to get subscriber information in a criminal case and whether a defendant can challenge the warrant.

Some Internet providers voluntarily disclose this information to police in child pornography cases, but not in other criminal investigations.

A provincial court judge in Ontario ruled earlier this year that there are privacy rights in subscriber information, which includes the name, address, account and e-mail address of a customer (the Crown has appealed this ruling).

Crown attorney Allison Dellandrea argued yesterday it is simply "customer information" that police are seeking. "It doesn't matter what police do with it," said Ms. Dellandrea.

When police have subscriber information and an IP address, they can find "deeply personal" data related to an individual's Internet use and it should be possible to challenge whether the warrant was obtained lawfully, argued defence lawyer Cindy Wasser.

"You can't just say this case is about child pornography. This case is about the Internet, how we use it and the expectation of privacy," said Ms. Wasser.

From the Toronto Sun:

TorontoSun.com - Toronto And GTA- Actor disputes warrant in porn case

The Toronto comic actor who once portrayed the fanatical Scot in the Alexander Keith's beer commercials has launched an unprecedented constitutional challenge of the search warrant that led to his child porn charges.

Lawyer Cindy Wasser, who represents actor Robert Norman Smith, argued yesterday that her client's privacy rights were violated when his Internet service provider, Bell Canada, gave his name and address to Toronto Police when they presented a search warrant.

Internet users have an expectation of privacy and they don't have to list their names or addresses, Wasser said.

It is be -lieved to be the first Ontario Superior Court challenge of a warrant in which a service provider gave a subscriber's name and address.

Justice Robert Clark may give a ruling as early as tomorrow in the judge-alone trial.

The judge appeared to disagree with Wasser, saying, "The nature of the information is pivotal here. You're not discovering biographical information. You're getting the most minimal information, the person's identity and address."

Clark said he was balancing the accused's privacy rights versus "effective law enforcement."

Crown attorney Allison Dellandrea said the information provided "isn't deserving of constitutional protection."

Smith, 42, was charged with two counts of possession of child pornography and one count of making available child pornography after police searched his home computer two years ago.

He lost his job as soon as he was charged and the popular ads were pulled off the air.

CIPPIC releases working papers on ID theft

The Canadian Internet Policy and Public Interest Clinic has released a number of very interesting working papers on the topic of identity theft. Check 'em out:

CIPPIC News « CIPPIC

CIPPIC has issued the first batch of a series of working papers on identity theft. The papers released today include Introduction and Background, Techniques of Identity Theft, and Legislative Approaches to Identity Theft (all PDF). Additional papers examining identity theft caselaw, law enforcement, and policy approaches, as well as a Bibliography on identity theft, will be forthcoming. These working papers reflect research conducted during 2006 with funding from the Ontario Research Network for Electronic Commerce (ORNEC).

Canadian Legislation

U.S. Legislation

Australian, French, and U.K. Legislation

Thanks to Library Boy for the link.

Atlantic Canadian RCMP say search warrants are a time consuming hurdle

The Royal Canadian Mounted Police in Atlantic Canada are complaining that the two major internet service providers in the region are requiring that police get a warrant before handing over customer information. The ISPs are of the view (correctly in my opinion) that the Personal Information Protection and Electronic Documents Act prevents them from disclosing subscriber information without a warrant.

CBC: Search warrants for child porn too slow, say RCMP

Child pornography investigations in Atlantic Canada are being held up by internet service providers who require search warrants before providing customer information, say RCMP.

In some parts of Canada, internet service providers will hand over information such as the name, address and phone number of a customer being investigated by police.

Const. Blair Ross, who works on child pornography cases on P.E.I., told CBC News Tuesday RCMP are short-staffed already, and getting a search warrant can take days or even weeks.

"As it stands here now in Atlantic Canada, the internet providers will not provide that unless we obtain judicial authorization, in other words, a warrant," said Ross.

"So before we even begin to investigate we have that hurdle to jump over, which is time consuming."

Protecting customer privacy

But the region's two main internet companies say they are concerned about customer privacy, and particularly legislation they are required to operate under. Both Aliant and Eastlink say if someone is in imminent danger the company will provide its customers' information right away, but most of the time police must have a warrant. Eastlink spokeswoman Paula Sibley said her company is aware some other Canadian ISPs require only a letter of request from police.

"We're not necessarily opposed to seeing things move in that direction," said Sibley.

"However, with the existing legislation that's in place, and also privacy legislation that we have to operate under, we've chosen to continue to ask for a warrant." Ross said RCMP could spend more time finding people involved with child pornography if ISPs provided information more quickly.

Then there's also the issue of the Canadian Charter of Rights and Freedoms, which at least in a recent case from Ontario, prevents law enforcement from using the information if it was obtained without a warrant. (See yesterday's post: Canadian Privacy Law Blog: Ontario Court considers warrantless requests for subscriber information.)

From my understanding of how child exploitation and child pornography investigations are usually carried out, the first contact with a suspected offender yields more than enough information to get a warrant. In R. v. Kwok (referred to in Ontario Court considers warrantless requests for subscriber information), the defendant sent the police officer photos that were clearly child pornography. There was no suggestion that the defendant was currently abusing a child, so no exigent circumstances existed. Had a warrant been sought, I have no doubt it would have been issued in that case. That information would probably have been enough to secure the ultimate conviction of the offender.

I have a serious concern with the following statement:

"So before we even begin to investigate we have that hurdle to jump over, which is time consuming."

To begin with, the Charter is not a "hurdle". It's there for a reason and that reason isn't to make life more convenient for agents of the state to get into people's personal information. And secondly, this suggests the police are looking for personal information before they begin an investigation. I appreciate the importance of investigations of this type, but it seems they should always have reasonable grounds to believe an offence has taken place and that the information they are seeking will lead to the identity of the offender before seeking personal information. The alternative is an unacceptable fishing expedition.

Note: The above are my own opinions and not those of any organization I may be associated with or represent.

Ontario Court considers warrantless requests for subscriber information

There's been a lot of debate over whether PIPEDA permits a commercial entity, such as an ISP, to provide certain identifying information to law enforcement without a warrant. Most of the debate centers around section 7(3)(c.1) of PIPEDA, which reads:

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that
accompanies that clause, an organization may disclose personal information
without the knowledge or consent of the individual only if the disclosure
is ...

(c.1) made to a government institution or part of a
government institution that has made a request for the information, identified
its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the
defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering
any law of Canada or a province;

Some are of the view that "lawful authority" means a lawful investigation and that an organization is able to disclose certain information without consent under PIPEDA. Some take the erroneous view that PIPEDA actually authorizes the disclosure, which is not the case at all. This error is compounded by law enforcement who refer to "PIPEDA letters" demanding information from internet service providers in connection with child exploitation investigations.

The Ontario Court of Justice, in an unpublished decision that I understand is under appeal, recently considered the impact of a request by law enforcement for ISP subscriber information. In R. v. Kwok, police officers went online and convinced an unidentified person to provide child pornography to the undercover officer. Using usual techniques, the cops determined the IP address of the suspect and sent a letter to the ISP requesting the billing information associated with the account. The officer testified that he had not read PIPEDA, but understood from an e-mail from the RCMP Commissioner that PIPEDA authorizes such disclosures and these letters should be used to facilitate access to information. Prior to PIPEDA, the officer testified, they routinely sought warrants for this sort of information. The letter used in this case, not surprisingly, cited PIPEDA. The ISP provided the information and an arrest was subsequently made.

The defendant made an application to have the evidence thrown out as it was unlawfully obtained and the Court agreed. The Court held that even if PIPEDA permits access to this information by law enforcement, it is contrary to the Charter for the police to obtain it in this manner.

From Paragraph 35 of the decision:

"The subscriber, in this case, in my view, and based on my reading of the authorities, has an expectation of privacy in respect of this personal information [name and address]. The investigation of these types of crimes is essential and important, but there must always be the proper balancing of the procedures used by the police and the right of citizens to be free from unreasonable search and seizure. Shortcuts, such as set out in s. 7(3)(c) of PIPEDA in the circumstances of this case must be used with great caution, given the notions of freedom and democracy we come to expect in our community. In my view, the police should have procured a warrant to obtain the subscriber information, that is the name and address of the Applicant, in this case, as I have found the name and address is information from which intimate personal details of lifestyle and choices can be obtained. I therefore find there has been a s. 8 violation."

The copy of the decision that I've obtained (R. v. Kwok) is marked "draft" and I haven't been able to find it online. I understand it is under appeal and hopefully the Court of Appeal can clarify what s. 7(3)(c) actually means and whether companies can provide the police with customer information without a warrant. I also hope that the Court will clarify that PIPEDA does not give anyone -- agents of the state in particular -- increased access to personal information, but the reverse.

Note: I've blogged about this topic on a number of occasions. For some background, see http://www.privacylawyer.ca/blog/labels/warrants.html.