Federal Privacy Commissioner George Radwanski is at it again. In his never ending quest to protect the privacy of all Canadians — something he is thankfully particularly good at — he has set his sights on a new provincial law, Bill 38, the Personal Information Protection Act. He recently sent a letter to Minister Sandy Santori outlining a series of criticisms against the bill. The Vancouver Sun picked up his criticisms and essentially parroted them in their editorial of June 3, 2003.
But being human, sometimes even George gets it wrong or at least substantially wrong. And regrettably, given that the language of the Sun’s editorial is substantially similar to Mr. Radwanski’s letter to the Minister, the Sun’s editors are guilty of the same mistakes.
We at the BC Civil Liberties Association consider ourselves as much privacy advocates as Mr. Radwanski. Let us tell you why we think Bill 38 is good for British Columbians’ privacy.
But first a note about why any of this matters. Canadians have come to realize that protecting their own privacy is fundamental to maintaining their personal freedom. Every time you do business with a company, purchase particular drugs, make a donation to your favourite charity or sign on to work for an organization, others want to know all about you — your spending habits, your drug habits — legal or illicit. Any darn habit you have. Because this information is very valuable. Most often, there are perfectly legitimate reasons for collecting and using personal data but occasionally there are dubious ones. We need privacy protection in the private sector.
Bill 38 is a made-in-B.C. response to the federal government’s own privacy legislation which the feds will apply to all businesses as of January 1, 2004 if a province does not have “substantially similar legislation” in place. The object of both laws is to protect individuals’ privacy by requiring organizations to follow fair information practices regarding the collection, use and disclosure of personal information. The federal act itself was a response to the European Community’s 1995 Data Protection Directive which prohibited companies in member EC states from doing business with non-member companies unless there was equivalent privacy protections in the local law. So the sales pitch for private sector privacy laws has been a winner: privacy — good for business, good for freedom.
So how has Mr. Radwanski and the Sun erred? The most significant of errors is their assertion that the B.C. law won’t protect employee privacy as much as the fed law does because it does away with a requirement for consent.
It is important to first point out that without a provincial law there simply will be no privacy protections for provincial employees at all. The federal government knows that it has no constitutional jurisdiction to regulate provincial workplaces and so it hasn’t tried to protect them. True, consent is generally a critical privacy protection. But as a means for protecting privacy in the workplace, consent is illusory. No one takes seriously that employees should be able to withhold consent from legitimate requests by employers to process their data. And yet, true consent — fully informed and freely given — would mean just that. And a half hearted consent requirement — where employers could simply circumvent it by making consent a condition of employment (sign here to agree to be subjected to intrusive drug testing if you want this job) — is no protection at all.
Though Bill 38 has no consent provision it does have a full reasonableness test, something George Radwanski has applied under the federal law. Employers must also give notice to employees before they process employee data, a protection Mr. Radwanski mistakenly misses or ignores in his criticisms. So if an employee objects to a proposed collection, use or disclosure of his or her personal information, they are able to complain to the B.C. Information and Privacy Commissioner. The Commissioner will then have to assess what is reasonable in the circumstances and has the authority to make an order to ensure compliance with the law. By the way, Mr. Radwanski can only make recommendations.
Mr. Radwanski has also criticized Bill 38 as allowing a huge carve out for personal information that has already been collected since the law would not apply to this information. However, the reasonableness test that applies throughout the law would kick in to constrain organizations from an unreasonable use or disclosure of personal data already collected. To be sure, it would be wise for the legislature to clarify this language before the law is passed — though not fatal if they failed to make changes. One option is to follow the recommendations of the B.C. Freedom of Information and Privacy Association (who have given Bill 38 a B+ grade) to amend the law by requiring organizations to obtain consent for future use or disclosure of information already collected within in one year of the law being in force. But even without this change, reasonableness will rule.
The provincial government embarked on extensive consultations to craft Bill 38. The B.C. Civil Liberties Association participated vigorously in the discussions with the government as did many other businesses and organizations including FIPA. What we got from these discussions — Bill 38 — is not perfect legislation from a privacy advocates perspective. For example, Mr. Radwanski’s criticism about the expanded definition of “investigation”, which is exempted from the basic rules about needing consent to process personal information, mirrors the BCCLA’s criticism. We’d like to see that changed before the law is finalized.
But does this flaw make the law substantially dissimilar to the extent that the federal Cabinet, not Mr. Radwanski, would fail to approve it? We doubt it, for legal and political reasons. And for principled ones too.
If we are just plain wrong about all of this and if Mr. Radwanski’s concerns do have any real bite to them, one has to wonder why the Sun’s editors would not simply recommend making changes to the law before it is passes third reading. If there is a real concern about maximizing privacy protections in B.C. then we clearly need a B.C. law. Even as ardent a privacy advocate as Mr. Radwanski would agree.
