&
The National Post
Thursday, April 22, 1999
(Opinion)

Ottawa's privacy protection spells business obstruction

by Richard C. Owens

Saying it will promote electronic commerce while protecting Canadians' privacy, the federal government has tabled sweeping restrictions on the use and collection of personal information through Bill C-54, the Personal Information Protection and Electronic Documents Act. If passed and enforced, this law will impede transactions and lower asset values across the country.

Bill C-54, which recently concluded hearings before the House of Commons Industry Committee, covers virtually all private-sector collection of personal information, restricting its use, collection, and disclosure -- whether recorded in any form or merely oral -- without the individual's knowledge or consent. It expressly applies to employees, customers, and potential customers.

The bill's far-reaching provisions could prevent businesses with any customer or employee data from selling all or any part of a business in confidence, since customer and employee records could not be transferred without the knowledge and consent of them all. This applies even to businesses sold as going concerns, where no new people would get access to the collected personal information. The restrictions will cripple businesses' ability to outsource data processing or make normal-course disclosure related to a business sale or financing. Disclosures made to collect a "debt" are permitted; disclosures made to enforce service, sale, confidentiality, or any other kind of obligation are not. Why?

Related corporations also could not disclose information among themselves, preventing new affiliated corporations from forming for reasons of tax planning, operations, or in response to other forms of regulation. This would be true even though the same employees and systems often will handle the data for sister corporations anyway.

As messy as all this sounds, it gets worse. The bill applies to all information a business possesses, regardless of when it was obtained, delaying transactions until every subject in the data can be found -- assuming that were possible -- and everyone's consent obtained. Giving consumers long product warranties, with the attendant requirements for record-keeping, becomes a serious liability.

Accompanying this list of known problems is a list of imponderables involving enormous implications for businesses' reporting structures and information technology systems. How will businesses obtain consent for uses of information obtained in the past where such uses have evolved over time? Will outsourced data processors be subject to the bill? Will individual merchants need to comply in accepting credit cards, or filling out sales slips? The bill also gives extensive oversight powers to the federal privacy commissioner, a position that was not originally intended to exercise powers of investigation and quasi-judicial oversight. What was in the minds of the drafters?

Recent hearings before the Industry Committee amended the bill for the worse, leaving intact its fundamental problems while adding new ones -- such as bringing oral information within the bill's ambit and circularly defining "commercial activity" as "any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character".

Not only is the bill a clumsy intrusion into business dealings, this two-part legislation is clumsy in and of itself. One part provides a statutory framework, the other a partial, voluntary privacy code that is in some respects inconsistent with it. The bill creates a twilight zone between obligatory portions of the privacy code, which are expressed as "shall", and less obligatory portions, which are expressed as "should". A business that does not obey the "shoulds" can be subject to a legal complaint. The significance of the distinction is unclear, and it probably fails to accomplish any intended goal. As if these problems were not enough, Bill C-54 usurps provincial powers; it is so aggressive constitutionally that it is bound to be challenged.

Privacy appears to loom large as a public concern, but few businesses abuse private data. For instance, in the financial services sector, a lightning rod for many concerns, privacy abuse has been negligible. The Task Force on the Future of the Financial Services Sector, which investigated privacy, found no real worries for abuse. Although it recommended legislation, it did so strictly on the potential for future harm. This may have been overkill: The voluntary protection of privacy has worked well in the financial services industry, among others. In addition, the settled principles of privacy protection already govern financial services and some other businesses that collect customer data, and they do so without imposing undue costs. Recent developments, such as IBM requiring privacy codes for all Web sites on which it advertises, show how the free market is finding solutions to privacy issues.

The impetus for privacy laws -- electronic commerce -- may also be their undoing. Commerce in the borderless world of cyberspace is not a national issue. Enforcement of Canadian privacy regulation will be extremely difficult. If Bill C-54 could somehow be enforced, it could create a competitive disadvantage rather than making Canada an attractive regime for electronic commerce, as Industry Canada supposes. Ironically, focus groups show that telling Canadians their privacy is being protected makes them worry more than saying nothing. After all, businesses have been collecting personal information since the dawn of commerce.

Bill C-54 followed public opinion polls indicating Canadians have privacy concerns. A government that would release such an ill-constructed piece of work to score political points is legislating irresponsibly. Ottawa talked about introducing such a bill a long time before it did so. But in the end, it looks as if it were thrown together the night before, all the while ignoring detailed recommendations on the form such legislation should take. By all means, protect our privacy. But we should start over and do it right.

Richard C. Owens is a partner with Smith Lyons, an international law firm based in Toronto, and an adjunct professor at the University of Toronto faculty of law.


Copyright © 1999 by The National Post. All Rights Reserved. Reprinted with permission.