Protection of Personal Information — Three approaches in Canada

It is fair to say that the very notion of personal information or personal data and their circulation became lately a topic of interest partly because of the international travels. The requests made by some governments about ID and a lot of other personal information about international travelers raised anxious questions about both privacy and civil liberties in many countries.

Matters of security and the fear of terrorism may explain, at least partly, why protection if personal data became a topic of great concern in a lot of countries after the events of September 11 / 01.

From state to state, different reasons may pave the way to the enactment of legislations which will ensure the protection of personal information. The civil society may be active in that field because people feel some anxiety about the use of their personal information. The initiative may also come from politicians or civil servants. On top of that, the requests made by international organizations may also be quite influent. That was clearly the case when the new EU member states were conducting their negotiations with Brussels.

What would be the best way to enact a truly good Act which will achieve the goal and really protect and secure personal information? Or course, the classic answer would be to launch an academic research and make a comprehensive review of the scientific literature in that field as well as of the various legislations enacted by some 70 States or so throughout the world.

These three political systems are on the same wavelength as far as the definition of personal information is concerned. You don’t have to take into account the fact they are written on a sheet of paper, or on ID cards or stocked on a computer. A personal information is, to put it quite simply, any data that may identify or lead to the identification of a person. In that respect, symbols, any kind of ID, religious beliefs, political creeds and so on are considered as personal information.

It is also possible to proceed with case studies and take lessons from one or many states which have already followed that path. In that respect, it may be quite instructive to see how and why the federal government of Canada and the provinces of Quebec and New-Brunswick decided to pass legislations in that field.

At the federal level, as well as in Quebec, the actual regime insuring the protection of personal information was set up in two different times: first, legislation was passed dealing with the public sector; and a few years later, the private sector was taken care of. In both capital cities, we have to come back to the late seventies to see the first move in that direction..

At the federal level, a few senior civil servants and some politicians were involved at the very beginning of the process that led to the first legislation dealing with the protection of personal information.

In Quebec, the move came from a minister of the government. A working group was appointed in 1980 and recommended the enactment of a legislation in the field of both access to information and protection of personal information.

In both cases, legislations insuring the protection of personal data were enacted and came into force almost at the same time, in 1982. These two Acts were drafted in order to insure that a real protection at each and every stages of the life cycle of personal information, from their collection or even the production of such data up to their final disposition.

In the public sector, personal information can be collected, kept and used only for the purposes for which they have been gathered. These data must be secured with fair and sound measures. The citizen must be granted access to his own personal information. He may even ask that his or her data be rectified, if needed.

In the private sector, the road was different, so was the result. Quebec has been the first political system in North America to enact such a legislation. One of the main factors behind that move was the adoption of the new Quebec civil code. The discussions going on in Brussels that led to the 1995 directive also played an important role. The net result was the vote, in 1993, of an Act which has to be enforced by each and everyone enterprises in the private sector.

At the federal level, thanks to a fruitful dialogue with the private sector, the Parliament enacted in 2000 a law which covers the whole of the private sector. This Act incorporates the code about the protection of personal information that has been drafted by many enterprises working with the Canadian Standards Association (CSA).

New Brunswick came late in dealing with protection of personal; information, more precisely in 2001. The Legislative Assembly voted an Act which covers only the public sector. We have to add that the federal legislation applies to all enterprises which come under the jurisdiction of Parliament of Canada.

This is a very concise summary of the legislations enacted by these three political systems. A lot of questions must be addressed, such as how are they enforced and what about their rate of success? Like everywhere else, these Acts provided for the creation of a control agency which supervises its application. In each of these three cases, the solution designed is different, according to the history of its own political institutions. In Ottawa, the Privacy Commissioner is an agent of the Parliament who has been given the powers and authority of an Ombudsman. Using his or her moral persuasion, the Commissioner makes recommendations.

Using her legal powers, the Privacy Commissioner tabled very recently in the Parliament a report about secret files kept by the RCMP. It did not take a long time before the first results of her inquiry were taken care of. The RCMP announced that many of these files would be removed because they did not comply any more with legal requirements in the field of national security.

In New Brunswick, the Ombudsman launched a similar inquiry when and because personal health information about hundreds of citizens of that Province vanished. The Ombudsman , also an agent of the Legislative Assembly, has many hats. Among other responsibilities, he is the first Custodian of the Province’s children. The recommendations he may issue carry a real force of persuasion.

In Quebec, problems or «misunderstandings» related to personal information are dealt with by the Commission d’accès à l’information. Thanks to its quasi-judicial powers, the Commission forced , just a few months ago, a private enterprise to give access to a citizen, asking for a divorce, to his own child’s personal file because he was still the legal tutor.

To sum up, protection of personal information is a process which is challenged by both the economic globalization and the faster than ever development of information technologies.

Canada, New-Brunswick and Quebec try to address these issues and cope, each in its own way, with these challenges that pop out almost every where in the word. … a new kind of both intellectual; and legal cooperation between member States of the Organisation internationale de la Francophonie.