Law Times

Law Times • may 31, 2010 NEWS PAGE 5 New privacy, anti-spam bills get mixed reviews PIPEDA amendments welcome, but critics worry about enforcement powers BY MICHAEL McKIERNAN Law Times privacy legislation tabled in the House of Commons this week. Th e fi ghting Internet and T wireless spam act, which came amidst a fl urry of new federal bills last week that included legislation to establish a na- tional securities regulator, was a casualty of prorogation ear- lier this year despite sailing unanimously through the low- er house on third reading. It reappeared this week with only minor tweaks to the previous version and is expected to have a largely positive reception. But privacy law experts say a new bill to amend the Per- sonal Information Protection and Electronic Documents Act needs more work. Th e bill fi nally implements the govern- ment's 2007 response to a re- view of the act and was hotly anticipated for its promise of forcing businesses to report privacy breaches in certain cir- cumstances. Th e legislation will also in- crease the number of exemp- tions to consent for the release of personal data, which aims to make life easier for businesses and government institutions. Companies would be able to release information for business transactions or missing-person investigations without notifying each individual concerned. Tony Clement, the minister of industry, talked up the new bills in a statement last week. "Canadian shoppers should feel just as confi dent in the electronic marketplace as they do at the corner store," he said. "With today's two pieces of leg- islation, we are working toward a safer and more secure online environment for both consum- ers and businesses — essential in positioning Canada as a leader in the digital economy." But John Lawford, coun- sel with the Public Interest Advocacy Centre in Ottawa, says the notifi cation clause dealing with privacy breaches falls short because it gives too much power to companies he government of Cana- da is receiving mixed re- views for anti-spam and proposed legislation to make sure that notifi cation happens." David Fewer, director of the Canadian Internet Policy and Public Interest Clinic in Ot- tawa, was very disappointed by the enforcement provisions. "It's supposed to be a stick that fi xes a market failure of compa- nies to invest in secure storage of their customers' informa- tion," he says. "I can't think of a weaker piece of security breach legislation." But Fraser says the bill may the still have 'The dark places of the Internet should stay dark corners, and Canada should not be one of them,' says David Fewer. whose data is compromised. Under the bill, organiza- tions are required to report all "material breaches" to the pri- vacy commissioner. Individu- als must receive notifi cation only when the breach poses a "real risk of signifi cant harm," a standard Lawford says is diffi - cult to meet and even harder to measure. In both instances, it's the organization itself that de- termines whether the breaches have met those thresholds. "It leaves too much wriggle room," Lawford says. "If it's a borderline case, there's still a lot of room for them to say, 'We don't want to take the hit on this' and just let it play out and hope people won't get hurt." Still, he hopes the law will spur most companies to im- prove their security anyway. "At least they can't ignore it completely as they could in the past," he says. David Fraser, who heads McInnes Cooper's privacy practice group, says the absence of penalties for non-compli- ance in reporting breaches is a weakness. He notes that while the Offi ce of the Privacy Com- missioner can audit a company based on a breach, the new legislation gives it no author- ity to force businesses to notify consumers, something other jurisdictions, including Alber- ta, allow for. "I think they've come close to striking the right balance but I'm not sure there's enough of a stick in the Been in Law Times? Want a record of it? Promote your law firm by ordering reprints of articles from the voice of the profession — Law Times! Reprints are great for: • Firm promotional material • Suitable for framing • Use on your web site $175 - $225/reprint We provide a color PDF and unlimited reproduction rights. LAW TIMES For more information or to order reprints, please e-mail Gail Cohen at: gcohen@clbmedia.ca LT0531 For a 30-day, no-risk evaluation call: 1.800.565.6967 Canada Law Book is a Division of The Cartwright Group Ltd. Prices subject to change without notice, to applicable taxes and shipping & handling. Ontario Assessment Legislation (LT 1-4x3).indd 1 www.lawtimesnews.com 5/26/10 2:24:31 PM • Training and education ORDER your copy today Perfectbound • 800 pp. • May 2010 On subscription $73 • P/C 0836140000 One time purchase $83 • P/C 0836010000 Multiple copy discounts available ISSN 1198-3612 desired eff ect, even without strong powers, as public awareness of breaches increases and organizations take precautions to minimize the chance of having an epi- sode. "If breach notifi cation is mandatory in every province, except B.C. and Quebec, then we're going to hear a lot more about these things." Planned exemptions for consent to release data have also raised concerns. Th e bill expands the ability of orga- nizations to provide personal information to police or other government institutions with the "lawful authority" to ask for them without warrants or court orders. Police had com- plained that requests for war- rants slowed down missing- person investigations and other law enforcement eff orts. But Fraser says the bill failed to clear up confusion about what exactly "lawful authority" means since some courts have ruled open police investiga- tions don't amount to it. David Fraser worries the PIPEDA changes don't do enough to enforce notification of privacy breaches. In addition, companies would no longer be able to tell people about the release of their data if the institution objects, something that worries Law- ford. "If you take that away, who's watching that there aren't abuses?" he asks. "Th at seems to me to go beyond what you need for fi nding missing per- sons and so on. I hope the leg- islators will think of some over- sight mechanism where you at least report that you have done one of these requests." In the meantime, Fewer says the privacy bill pales in compari- son with the anti-spam legisla- tion. "It's a strong piece of leg- islation and it's easy to comply with. Th ere's not piles and piles of red tape. What I like about it is it has some teeth, unlike PIPEDA. Th at gets the attention of businesses, and they'll take its provisions very seriously." Th e bill expands the mandate of the three enforcement agen- cies involved with spam, the Canadian Radio-television and Telecommunications Commis- sion, the Competition Bureau, and the privacy commissioner, and allows them to share infor- mation with their counterparts around the world. Th e CRTC can penalize vio- lators with up to $1 million in fi nes for individuals and $10 million for businesses. Th ere's also a private right of action, based on a similar provision in the United States, allowing consumers to take civil action against violators. Th e government says the legislation makes Canada a world leader in the fi ght against spam. Fewer agrees with that assessment, saying most legis- lation shies away from blanket bans on spam and spyware by leaving loopholes that spam- mers quickly learn to exploit. "Th ey don't get into the game of saying some forms of spam are fi ne. It says you own your inbox and your hard drive," he says, explaining that that the only e-mails people should receive are ones they've consented to. Everything else is spam, he argues. At the same time, Fewer isn't worried about spammers sim- ply setting up shop elsewhere in the world. "Th e dark places of the Internet should stay dark corners, and Canada should not be one of them," he says. LT Ontario Assessment Legislation 2010 This consolidation offers the most thorough collection of laws avail- able for this complex area. Legislation covered includes: • • • • • • • • regulations • • and regulations • • • • • regulation • • Rules of Civil Procedure, Rules 30, 31 and 53.08 and regulation and regulation and regulations (selected sections) and regulations (selected sections) (selected sections) and regulations (sections 305 to 389) and and regulations and the Assessment Review Board Rules of Practice and Procedure (amended November 2, 2009) (selected sections) and Consulting Editors: Jack Allen Walker, Q.C. and Andy Anstett Assessment Act Assessment Review Board Act City of Toronto Act, 2006 Condominium Act Education Act Judicial Review Procedure Act Legislation Act, 2006 Municipal Act, 2001 Municipal Freedom of Information and Protection of Municipal Affairs Act Privacy Act Municipal Property Assessment Corporation Act, 1997 Municipal Tax Assistance Act Payments in Lieu of Taxes Act Provincial Land Tax Act, 2006 Residential Tenancies Act Statutory Powers Procedure Act REPRINTS

• Cover
• Enforcement Powers
• Persuasive Resolutions
• Focus On Criminal Law