Personal Information Protection Act

Personal Privacy Protection in Canada

Canada adopted the Personal Information Protection Act (PIPEDA or PIPED Act) on the 13th of April, 2000. That means they're about a decade ahead of us in terms of privacy legislation. The purpose of the PIPEDA was as much to protect Canadians (and European citizens within Canadian borders) from privacy violations as it was to help promote and foster electronic commerce (e-commerce). 

The Model Code for the Protection of Personal Information

In 1995, the CSA (Canadian Standard's Association), developed the Model Code for the Protection of Personal Information. The Personal Information and Protection Act makes many of the provisions outlined in the Model Code mandatory.

What is the Definition of Personal Information?

The definition of personal information, according to PIPEDA, is "information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization."

What Does the Personal Information Protection Act Do?

The law enforced by PIPEDA gives individuals the right to:

• Know why an organization collects, uses or discloses their personal information;
• Expect an organization to collect, use or disclose their personal information reasonably and appropriately, and not use the information for any purpose other than that to which they have consented;
• Know who in the organization is responsible for protecting their personal information;
• Expect an organization to protect their personal information by taking appropriate security measures;
• Expect the personal information an organization holds about them to be accurate, complete and up-to-date;
• Obtain access to their personal information and ask for corrections if necessary; and
• Complain about how an organization handles their personal information if they feel their privacy rights have not been respected.

The law requires organizations to:

• Obtain consent when they collect, use or disclose their personal information;
• Supply an individual with a product or a service even if they refuse consent for the collection, use or disclosure of your personal information unless that information is essential to the transaction;
• Collect information by fair and lawful means; and
• Have personal information policies that are clear, understandable and readily available.

Is a Personal Information Protection Act Coming to the U.S.?

The United States does not currently have a Personal Information Protection Act, but similar legislation exists and new privacy laws are in the works. Specifically, we currently have:

• Privacy Act of 1974 - designed to protect individuals personal information stored by federal agencies.
• Electronic Communications Privacy Act of 1986 (ECPA) - this act was created to ultimately protect consumers data while in transit. Be that via signs, signals, writing, images, sounds, data or intelligence. However, it has received criticism for failing to adequately protect communications and consumer records.
• Children's Online Privacy Protection Act of 1998 (COPPA) - the primary purpose of this act is to give parents control over what information is collected from their children online and how this is used. Website operators are required to post a privacy policy, notice of data collection, give parents a choice as to third party data disclosure, and maintain data integrity and protection, among other things.
• Children's Internet Protection Act of 2001 (CIPA) - enacted to protect children from offensive online content, particularly if accessed from school or library computers. If schools adhere to the safety policy requirements, they receive funding benefits and discounts.
• Fair and Accurate Credit Transactions Act (FACTA) of 2003 - an amendment of the Fair Credit Reporting Act - FACTA gives consumers access to their credit reports and provides provisions to help prevent identity theft. Consumers are able to place alerts on credit histories. Finally, FACTA requires secure disposal of personal information. Unfortunately, financial institutions and other companies are turning this opportunity into a profitable venture by charging for credit and privacy protection measures.

While all of these acts take steps in the right direction, their implementation and enforceability is lacking when compared to the rapid pace at which technological advances are making individual's personal information accessible to unauthorized eyes.

Want to see privacy reform catch up and be enacted before your personal data is put at risk? Make yourself heard! Comment below with your own privacy/ personal information/ identity theft experiences and fears and help us spread the word on the importance of personal information protection!