Personal Information Protection in the Face of Crime and Terror: Information Sharing by Private Enterprises for National Security and Law Enforcement Purposes
Centre for Innovation Law and Policy, Faculty of Law, University of Toronto
Office of the Privacy Commissioner, 2007 Contributions Program
Description of the Project
Canadians are concerned about the access that law enforcement and national security services may have to their personal information held by private companies. But while the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Privacy Act regulate the collection, use and disclosure of personal information by interprovincial businesses and public bodies respectively, there are little to no restrictions in either Act on disclosing personal information to public entities where national security or law enforcement is at issue. Consequently, the oversight of the information practices of law enforcement and security services does not come from the current privacy legislation, nor is it clear whether any existing or new oversight body reviewing national security information practices will draw any best practices or principles from Canada’s existing privacy legislation.
This project considers how information is shared by private entities with security services and law enforcement, by engaging in a two layered research agenda: 1) to describe the context of information sharing by private enterprises with public bodies in four major industries where potentially sensitive personal information is typically held (airlines, banks, telecommunications companies, and retailers); and 2) to consider what, if any, statutory or Charter restrictions or questions are raised by these information sharing practices. The project will consider the industry-specific concerns raised where the personal information held by private companies is of interest to security services and law enforcement (passenger data, financial transactions, online behavior, and purchase histories) and which is also potentially sensitive, especially the more it is compiled and combined with other information about an individual.
The researchers will consider: a) what personal information the industry is permitted to collect by law, how they can collect that information, and what personal information the industry is compelled or permitted to share with law enforcement and security services; b) the ways in which private enterprises in these industries compile and combine information for marketing or other purposes; c) the regulatory bodies which oversee these industries and any industry specific legislation with an impact on information sharing; and d) whether there are any technological means of enhancing consumer privacy (that is, decreasing the ability of these companies to obtain or share personal information).
Once the research papers are drafted, the CILP will invite interested stakeholders to a one day closed workshop. The invitees will include the researchers, prominent privacy academics (including the faculty research advisors), and other stakeholders. The workshop is intended to provide an opportunity for frank discussion among stakeholders regarding privacy and national security and law enforcement, as well as to move discussion from the information gathering stage of the research papers to next steps, such as consideration of legislative reform or guidelines to oversight bodies which clarify the powers, procedures and best practices for information sharing between private enterprises and national security agencies.
The Office of the Privacy Commissioner of Canada has posted a press release on its web page announcing the successful applicants under the 2007-08 Contributions Program. You may see it at:
http://www.privcom.gc.ca/media/nr-c/2007/nr-c_070627_e.asp