‘Too long a step’: CATA responds to Ontario’s draft privacy legislation

Ontario’s government has completed a comment round on its draft privacy legislation. The CATA Alliance , a high-tech trade association, released its response at the end of March. The following is an edited version.Consent The draft Privacy of Personal Information Act, 2002 (PPIA) calls for express consent as the standard in Ontario, essentially ignoring implied consent. PIPEDA, the CSA Model Code for Protection of Personal Information and the European Union’s Data Protection Directive all accept implied consent except where sensitive information is concerned. We urge that MCBS adopt the same approach, to avoid placing Ontario businesses at a competitive disadvantage. Businesses elsewhere will benefit if Ontario imposes consent requirements that differ from the standard, widely accepted internationally, which prevails in other provinces and countries. Custody and Control The draft PPIA makes every organization responsible for personal information in its "custody or control". The provision will create serious problems in the light of current business practices. Businesses, including many small ones, contract out many of their functions. Examples include data storage, computer backup, Web hosting, and order fulfilment, all involving third party custody of customers’ information. The custodians handle data on behalf of others, but they have no control over it. It is unreasonable to require the custodians to seek consent from people who are not their customers. Ontario should conform to PIPEDA and the EU Data Protection Directive, which have no such provision. Mergers and Acquisitions The draft Act requires that an acquiror "will carry on substantially the same business" as the company it is acquiring. We believe this provision to be unreasonable for a number of reasons. Businesses often acquire others because they believe that they can employ their assets more effectively. Business models change with their markets, often quickly. It is not always easy to define what "substantially the same business" means when comparing two companies. It is our belief that the concluding clause of subsection 33.(1)(g)(3), "will make use of the information for substantially the same purposes", will fully protect the personal information. Complexity The draft PPIA is extremely complex and difficult to understand. Minister Sterling has indicated that the bill will be reorganized to separate general personal from health information. This will be a major step forward, but we remain concerned that the Act will still be very complicated, and difficult for citizens and small business people without access to legal counsel to understand. MCBS must keep this factor in mind as it redrafts the Act. Conclusion Electronic commerce will not achieve its potential unless consumers are satisfied that their personal information is protected. The draft Privacy of Personal Information Act is a step in the right direction, although CATAAlliance’s members believe it is too long a step. Ontario citizens will be well protected by a law which is less aggressive in its consent provisions, and is more compatible with similar laws in other jurisdictions. Read the full version at http://www.cata.ca/cata/advocacy/other/privacyact.cfm

‘Too long a step’: CATA responds to Ontario’s draft privacy legislation

News | 04/19/2002 4:00 am EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us