Privacy implications of the USA Patriot Act.

• Author: Stoddart, Jennifer

The United States Congress passed the USA Patriot Act soon after the September 11, 2001 terrorist attacks. It gives new investigative powers to law enforcement agencies in the US. Section 215 of the Act allows a special court to secretly issue an order requiring "the production of any tangible things" to the FBI. This can include an individual's personal information. Anyone served with such a secret order is prohibited from disclosing to anyone else that the order exists or has been complied with. When Canadian privacy commissioners met in May 2004 in Victoria, BC, a general consensus emerged that exchange of personal information across borders was becoming increasingly significant in the context of continental economic integration. The British Columbia Information and Privacy Commissioner released his advisory report on the privacy implications of the USA Patriot Act on October 29, 2004. More than 500 representations were received about this issue including the following submission from the Privacy Commissioner of Canada.

**********

We live in a virtual world where the global transmission of information is becoming most seamless. The operations of governments and corporations are profoundly transformed by the emergence of e-government and e-commerce. Electronic collection, use, sharing and storage of personal information is at the hub of this transformation which modifies not only the way organizations carry out their daily business but also, more fundamentally, the manner by which they communicate with citizens, consumers, clients and stakeholders.

The concerns raised about the impact of the USA Patriot Act on the privacy of personal information about Canadians are really part of a much broader issue--the extent to which Canada and other countries share personal information about their citizens with each other, and the extent to which information that has been transferred abroad for commercial purposes may be accessible to foreign governments. The enactment of the USA Patriot Act may simply have served as the catalyst that brought these issues to the fore. In Canada, citizens increasingly recognize the vital importance of personal information management for good government and sound corporate practices.

The issue of transfers of personal information across borders goes to the heart of national sovereignty as well as to Canadian identity. As a society, we must think more broadly about the mix of policy instruments that will provide an adequate level of protection of personal information as required by the Personal Information Protection and Electronic Documents Act (PIPEDA), the Privacy Act and equivalent provincial and territorial statutes. This reflection is necessary if Canada is to maintain its leadership in privacy protection.

Governments across Canada have introduced many measures in recent decades to protect the personal information of Canadians. Most significantly, they have developed laws regulating the collection, use and disclosure of personal information by governments and private sector organizations.

At the federal level, the Privacy Act, which came into force in 1983, regulates the collection use and disclosure of personal information in the public sector by about 150 federal institutions. All provinces and territories have similar public sector legislation.

Canada has gone one step further by setting privacy standards for information handling in the commercial private sector. Beginning in stages since 2001, the Personal Information Protection and Electronic Documents Act has regulated the handling of personal information in the private sector across the country. Several provinces have enacted similar privacy standards. PIPEDA brings Canada law into line with privacy standards for personal information developed by the European Union, and means that our standards for the protection of personal information, when used by a commercial organization, are among the most stringent in the world. PIPEDA establishes a progressive framework, based on the highest international standards, against which to assess personal information management practices of the public and private sectors in Canada. It provides a framework for benchmarking best practices and encourages organizations that collect and process personal information to emulate those practices.

The Office of the Privacy Commissioner has repeatedly argued over the years that there is no inherent contradiction between the protection of privacy and the promotion of national security and public safety. Others have expressed similar views. Some suggest that a new public policy hybrid needs to emerge--a model that would have Canadians collectively set the terms and conditions by which sensitive personal information (financial, health and judicial, for example) would be shared across organizational and national boundaries. Decision-makers and policy analysts will not be the only ones concerned. Parliamentarians, civil servants, business and union leaders, civil society advocates and service providers also need to be engaged in an informed public dialogue on how to prevent further erosions of privacy.

No one seriously questions that governments and private sector organizations must collect, use and disclose personal information to do business, run programs and ensure adequate public security. However, Canadians are increasingly concerned about the extent to which their governments claim to require personal information about individuals to fight crime and protect national security. Canadians are also concerned about how and when personal information about them is shared with foreign governments and agencies, including police and security agencies. Their concern centers on the balance between law enforcement and public security on the one hand, and respect for fundamental human rights such as privacy on the other.

The transfer of personal information across borders is a fact of contemporary governance--a product of "globalized" economies, interdependent private and public sectors and increased international cooperation on criminal justice and public security issues. The flow of personal information transcends national and organizational boundaries. It is important for Canadians to understand these flows of information. When is personal information about them transferred outside Canada, to whom, and for what purposes? What rules govern the handling of such information when it has been transferred abroad? Various rules may apply, depending on whether information is held by a government agency or by the private sector, in Canada or abroad, by a Canadian stand alone organization or by an organization whose parent may be in the United States or another foreign country. When and how can personal information held in Canada about Canadians nonetheless be made available to foreign governments? How can Canadians participate in determining the nature of these flows?

This submission highlights some of the most important questions about the transfer of personal information across borders, the application of the federal Privacy Act and PIPEDA and, finally, what Canadians can do about protecting their personal information in this environment.

How is Personal Information about Canadians Transferred Across Borders?

In our world of globalized economies and increasingly interdependent policy environments, personal information is regularly exchanged across borders. Here we explain the many ways in which personal information about Canadians may be transferred outside Canada's borders in many ways including:

1. By organizations in Canada transferring to organizations in foreign countries

   "Globalization" has resulted in much more sharing of information held by companies in Canada, including personal information, across borders. This is a fact of contemporary life. Canada's largest single trading partner is the United States (accounting for approximately 85 per cent of the value of Canada's export trade), so it is little surprise that much personal information about...