patriot act

Showing posts with label patriot act. Show all posts

News Release Privacy Commissioner calls for further examination of transfer of personal information about Canadians across borders

Continuing the theme of cross-border data transfers, the federal Privacy Commissioner has just issued the following press-release:

News Release

Privacy Commissioner calls for further examination of transfer of personal information about Canadians across borders

Ottawa, August 18, 2004 - The Privacy Commissioner of Canada, Jennifer Stoddart, today calls for a greater dialogue between governments, the private sector and the public about cross-border exchanges of Canadians’ personal information. The Commissioner articulated this need in the Office’s submission to the Information and Privacy Commissioner of British Columbia about the privacy implications of the USA PATRIOT Act.

The Privacy Commissioner congratulates the B.C. Information and Privacy Commissioner, David Loukidelis, for leading this important inquiry.

"The growing frequency in which personal information is shared across borders in increasingly globalized interdependent economies has important privacy implications for Canadians," said Ms. Stoddart. "We have an obligation to protect the privacy rights of Canadians. We must have a balanced and reasoned approach to personal information protection."

Canadians expect that governments and the privacy sector will collaborate to protect against mismanagement of personal information. We must collectively seek a balance balance will be struck between the requirements of national security, the need for public safety and the conditions of an open and efficient economy.

In the submission, the Privacy Commissioner recommends practical measures for citizens, companies and governments to better manage the cross-border flow of personal information. Some measures include:

Citizens can lodge a complaint with the Privacy Commissioner or provincial and territorial commissioners, depending on the organization whose conduct has raised the concern if they feel that an organization subject to privacy laws has violated their privacy rights. Under the Personal Information Protection and Electronic Documents Act (PIPEDA), please request a copy of the Office’s Individuals Guide or visit http://www.privcom.gc.ca/information/02_05_d_08_e.asp (PDF).

Private sector organizations can comply with their obligations under PIPEDA or similar provincial legislation to protect customers’ personal information and to adopt appropriate safeguards. Under PIPEDA, organizations can request a copy of the Office’s Business Guide, or visit www.privcom.gc.ca/information/guide_e.asp (PDF).

Review by the federal government of PIPEDA and the Privacy Act to ensure that the highest standards of privacy protection relating to cross-border flow of personal information are met.

Enhanced federal/provincial/territorial cooperation in privacy protection and the promotion of a multi-stakeholder dialogue (private sector, civil society and other institutional partners) on privacy issues of national significance.

Along with this release, the Commissioner has also issued a fact sheet on cross-border personal information transfers:

What Canadians Can Do to Protect Their Personal Information Transferred Across Borders

Canadians benefit from a reasonable standard of protection of their personal information. They do not want to see that protection vanish when personal information about them is transferred across borders, and they do not want to see governments or organizations in Canada transfer their information across borders if it will be put at risk of inappropriate disclosure, whether for security or for commercial purposes.

The extent to which personal information about Canadians should be made available to foreign governments is a complex issue of continuing concern. Nonetheless, Canadians can take some measures to protect their personal information from inappropriate disclosure to foreign governments:

By bringing complaints about the handling of personal information (especially outsourcing arrangements) to the Office of the Privacy Commissioner of Canada or provincial and territorial commissioners, depending on the organization whose conduct has raised the concern;

By relying on the "whistle blowing" provisions of PIPEDA if a US based affiliate of a Canadian organization seeks to reach into Canada to obtain personal information held in a Canadian database in order to comply with a US legal order. These provisions would protect the confidentiality of employees who notify the Privacy Commissioner of Canada that a company intends to transfer information abroad in violation of PIPEDA. The provisions also protect employees against retaliation by the employers, such as harassment, dismissal or demotion;

By letting organizations in Canada that collect personal information about Canadians know that there is a concern about personal information being processed outside Canada;

By taking advantage of the information rights existing under PIPEDA and provincial private sector statutes which require organizations to follow fair information practices, notably obtaining consent for information use;

By reminding companies in Canada of their legal obligation to introduce appropriate security measures to prevent their subsidiaries or affiliates in another country from secretly obtaining access to personal information held in Canada to comply with a court order made in the foreign country;

By raising their concerns about the potential for excessive disclosure of personal information to foreign governments or to foreign companies with their elected representatives; and

Generally, by being more attentive to what may be happening to their personal information when it crosses borders and to the importance of clear and enforceable international standards on information sharing in democratic countries.

What Companies Do to Protect the Personal Information of Canadians Transferred Across Borders

Companies that are subject to PIPEDA or similar provincial legislation must comply with that legislation. It is important for the management of organizations subject to such laws to understand their responsibilities under the laws — for example, the obligations in PIPEDA to ensure the security of personal information. PIPEDA requires personal information to be protected by security safeguards appropriate to the sensitivity of the information.

Corporate leaders increasingly recognize that maintaining a high level of public trust in how personal information is handled is vital to achieve customer loyalty. It is also abundantly clear to corporate leaders that personal information holdings are key business assets that need to be protected against misuse.

And, finally, the Federal Commission has released a submission to the BC Privacy Commissioner in response to his request for submissions about the USA Patriot Act. (See previous blog entries: BC Responds to USA Patriot Act, Campaign in BC to Prevent Outsourciing and Labour groups raise outsourcing privacy fears.) The Commissioner's submission is available at http://www.privcom.gc.ca/media/nr-c/2004/sub_usapa_040818_e.asp

BC Commissioner's report on outsourcing delayed

I guess this is a good sign ... there has been so much interest in the BC Information and Privacy Commissioner's call for comments on the effect of outsourcing on privacy that he has been forced push back the anticipated delivery time of his report.

Coverage here:

B.C. privacy commissioner's report into U.S. Patriot Act delayed

"VICTORIA (CP) -- B.C.'s information and privacy commissioner has delayed the release of his advisory report on how the U.S. Patriot Act could affect Canadians because of the sheer volume of responses he's gotten during his inquiry.

David Loukidelis said in a news release Tuesday the report won't be ready until mid-September. "

USA Patriot Act and outsourcing

ITAC, the Information Technology Association of Canada, has entered the fray over the privacy risks of outsourcing Canadian services to US companies. The Globe and Mail has an article on the ITAC submission to the BC Privacy Commissioner:

U.S Patriot Act a 'red herring,' ITAC says

TORONTO, Aug. 6 — The Information Technology Association of Canada has called the U.S Patriot Act a "red herring" when it comes to concerns about privacy of Canadians.

In a a submission filed with the Information and Privacy Commissioner for British Columbia, ITAC argued that outsourcing is a beneficial force for governments and their taxpayers and citizens. It also explains that the U.S. Patriot Act is not a logical vehicle to access Canadian personal information held by U.S.-linked outsourcing companies in the performance of Canadian outsourcing contracts....

Article: U.S. laws put Canadian privacy at risk

You can always count on Michael Geist to provide good commentary on privacy issues. His latest LawBytes article in the Toronto Star adds to the debate about the collision between the USA Patriot Act (among others) and Canadian privacy laws:

TheStar.com - U.S. laws put Canadian privacy at risk:
"Although it has garnered only limited attention in the rest of the country, for the past few months the British Columbia privacy and information technology communities have been embroiled in a high-stakes issue that raises difficult questions about the effectiveness of Canadian privacy law and the potential threat posed by data outsourcing to the United States. "

One thing that we shouldn't forget is that PIPEDA gives Canadian law enforcement access to Canadian personal information without consent and without notice to the individual concerned.

7(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that
accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure
is
(c) required to comply with a subpoena or warrant issued
or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;
(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that
(i) it suspects that the information relates to national security, the
defence of Canada or the conduct of international affairs,
(ii) the disclosure is requested for the purpose of enforcing any law of
Canada, a province or a foreign jurisdiction, carrying out an investigation
relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or
(iii) the disclosure is requested for the purpose of administering
any law of Canada or a province;
(c.2) made to the government institution mentioned in section 7 of the
Proceeds of Crime (Money Laundering) and Terrorist Financing Act as required by that section;
*(c.2) made to the government institution mentioned in section 7 of the
Proceeds of Crime (Money Laundering) Act as required by that section; *[Note: Paragraph 7(3)(c.2), as enacted by paragraph 97(1)(a) of chapter 17 of the Statutes of Canada, 2000, will be repealed at a later date.]
(d) made on the initiative of the organization to an investigative body, a
government institution or a part of a government institution and the
organization
(i) has reasonable grounds to believe that the information relates to a
breach of an agreement or a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be
committed, or
(ii) suspects that the information relates to national security, the defence
of Canada or the conduct of international affairs;

Labor groups raise outsourcing privacy concerns | CNET News.com

More coverage on the BC outsourcing privacy debate. This time, American CNET News.Com has a report that hightlights a submission co-written by Michael Geist, one of the leading Canadian academics on privacy and technology law:

Labor groups raise outsourcing privacy concerns | CNET News.com
A 34-page legal analysis released Monday suggests that the Canadian unions are exaggerating the impact of the Patriot Act. A section of the law enacted after the Sept. 11, 2001 terrorist attacks lets police obtain records from any company with a U.S. branch if the information is said to be "relevant" to a terrorism investigation. The request is made to a secret court that meets behind closed doors in Washington, D.C.

The report, written by Michael Geist and Milana Homsi and filed with the BC Privacy Commissioner, says that current rules granting police the power to review data are "not significantly different than that which was available in a pre-Patriot Act era through grand jury subpoenas and national security letters." (National security letters are a type of administrative subpoena that doesn't require a judge's prior approval.)

The report also says that a Canadian law called the Personal Information Protection and Electronic Documents Act authorizes companies to secretly disclose data to government officials--a definition that could include U.S. police.

Release: B.C. leads Canada in privacy protection

An earlier blog entry mentioned that BC is planning to strenthen their public sector privacy legislation to prevent access to British Columbians' data by foreign governments. (See the entry here.) The B.C. government's press release is available here: "B.C. LEADS CANADA IN PRIVACY PROTECTION". Also of interest is the BC Government's submission to the BC Privacy Commissioner's study on the impact of the USA Patriot Act on the privacy of Lotuslanders: http://www.gov.bc.ca/mser/down/submission.pdf

Article: B.C. responds to U.S. Patriot Act with privacy plan

The Vancouver Province is reporting that the BC government will be responding to concerns about the impact of the PATRIOT Act on BC by introducing legislation:

The Province: B.C. responds to U.S. Patriot Act with privacy plan:
"VICTORIA -- The B.C. government is moving to introduce tough new privacy protection laws in response to the USA Patriot Act.
Attorney General Geoff Plant and Management Services Minister Joyce Murray outlined the plan Friday to B.C.'s Information and Privacy Commissioner.
Murray says the government is taking every step to have the strongest privacy legislation in Canada.
He says the laws would make sure no sensitive personal information will be sent to the U.S. on either a temporary or permanent basis.
It limits the application of the Act by ensuring that American affiliates and B.C. service providers do not have access to information supplied by a public body.
Plant calls the move a 'made-in-B.C.' solution and hopes other provinces will follow.
The U.S. government introduced the Patriot Act after the 9/11 terrorist attacks to give more power to law agencies like the FBI. "

I'll post more info as I find it. In the meantime, you can check out information about the BC Privacy Commissioner's consultations on this matter at his website:http://www.oipcbc.org/sector_public/usa_patriot_act/patriot_act.htm.

Campaign in BC to prevent outsourcing of medical info management to US company

The BC Freedom of Information and Privacy Association has a report about a campaign launched to prevent the BC government from ousourcing the management of the BC Medical Services Plan to an American company. The fear is that once the info is in the hands of an American firm, it will be within easy reach of the FBI and others, thanks to the USA PATRIOT Act.

'Right to Privacy Campaign' launched to protect individuals' privacy by stopping Maximus deal:

A diverse and growing group of rights, health, union and other organizations has launched a province-wide campaign to demand that the BC government drop its proposed deal with the Maximus corporation because of the privacy implications of the USA PATRIOT Act.

The Right to Privacy Campaign (RPC) believes that contracting out the administrative functions of BC's Medical Services Plan and PharmaCare to the American corporation Maximus Inc. will place British Columbians' confidential health and related information within easy reach of the FBI and, through the FBI, the entire array of American government agencies.

The primary goal of the RPC is to ensure that there is 'no contracting out by the Government of BC of information or information management, such as MSP or PharmaCare, to any company subject to foreign laws that violate the privacy rights of Canadians, like the USA PATRIOT Act'...."

Unfortunately, the website of the Right to Privacy Campaign seems to be down, which I expect would have much more info.

BC privacy watchdog seeks US government, FBI input in Patriot Act

The British Columbia Privacy Commissioner has released a statementthat he will begin an inquiry into the impact of the US Patriot Act on the privacy of British Columbians. Specifically, he is concerned that US federal authorities will have access to personal information of British Columbians if a US company is used as the outsourced service provider for various public services.

Here are links to articles from Google News:

Pending inquiry, government should halt its plan to give private ...
BCGEU, Canada - 11 hours ago
The provincial government should immediately halt plans that would put private information on every British Columbians into the hands of US firms, pending a ...

BC privacy watchdog seeks US government, FBI input in Patriot Act ...
Canada East, Canada - 14 hours ago
VICTORIA (CP) - The FBI and US Attorney General John Ashcroft are being asked to contribute to a British Columbia study of the US Patriot Act. ...

Patriot Act probe begins
CBC British Columbia, Canada - 14 hours ago
VICTORIA - BC's Privacy Commissioner has launched a review of the impact of the US Patriot Act on government plans to contract out the Medical Services Plan to ...

BC privacy czar to study US Patriot Act
CTV, Canada - 12 hours ago
VICTORIA — The FBI and US Attorney General John Ashcroft are being asked to contribute to a British Columbia study of the US Patriot Act. ...

Article: U.S. Patriot Act worries Privacy Commissioner

There has been no shortage of spilled ink (or spilled electrons) on the impact of the US Patriot Act on the privacy of Americans. One aspect of the law has raised the ire of the Privacy Commissioner of British Columbia. He alleges that the law puts Canadian privacy at risk because it reaches into American companies that handle Canadian personal information, in Canada:

U.S. Patriot Act worries Privacy Commissioner:

"U.S. Patriot Act worries Privacy Commissioner

WebPosted May 11 2004 02:28 PM PDT

VICTORIA - B.C.'s Privacy Commissioner is asking the provincial government for extra money to examine the ability of U.S. authorities to access confidential information in Canada

The U.S. Patriot Act allows American law enforcement agencies to access private information held by U.S. companies.

That could include include information held by Canadian subsidiaries of U.S. companies. "

Full text here ...

File-swapping litigation raises important privacy issues

Up until recently, Canadians have been free of the sort of litigation that the American recording industry has inflicted on "file sharers" in the U.S. As many know, the first movements toward similar litigation has recently been noticed in Canada (See the Globe & Mail's article, Canadian Recording Industry hopes to inspire fear over file swapping). Some of the more recent media attention has focussed on the attempt by CRIA to discover the identities of individuals whom they have targetted:

London Free Press: Business Section - Copyright suit raises concerns

David Canton, Freelance writer 2004-03-06 03:22:53

A legal action that could potentially affect anyone who has downloaded music on the Internet was recently initiated in Canada. The plaintiffs in this civil suit are some of the biggest music record labels, represented by the Canadian Recording Industry Association (CRIA).

...

CRIA intends to go after "egregious" or high-volume file-sharers that make massive quantities of music available for free.

The defendants in these proceedings are unknown for the moment. CRIA is requesting a court order that could change that. If granted, it would require Internet service providers (ISP) to produce names and addresses of the alleged perpetrators.

Electronic Frontier Canada and the Canadian Internet Policy and Public Interest Clinic have both been allowed by the court to intervene in this matter to argue the legal issues surrounding privacy, due process, and copyright law.

CRIA has tracked computers trading in copyrighted songs using their Internet protocol (IP) addresses through the use of surveillance technology. CRIA needs to match those IP addresses with subscriber information to identify the defendants.

Five ISPs have been targeted by CRIA for the disclosure of personal information that would lead to the identification of subscribers using the Web to upload music. The court ordered an adjournment until March 12 so the parties can cross-examine each other's affidavit documents to determine the technical and legal issues in dispute.

Downloading involves taking information from another computer. Uploading is transferring data from one's own computer to another. It is generally accepted that the Copyright Act allows music downloading so long as it is for personal use. Uploading is not so clear. These issues have not yet been decided in courts.

...

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), an ISP is not permitted to disclose a subscriber's personal information without the person's knowledge and consent. One exception is a court order.

There are many issues to be considered, such as whether civil actions should be held to a higher threshold before privacy is violated than in criminal cases, and whether uploading music as done by the peer-to-peer networks is actually copyright infringement.

There is also concern about the accuracy of the information being sought. Dynamic IP addresses can be reassigned to different customers on a continual basis, making it difficult to determine which individuals upload music files.

The worry is that ISPs could be compelled to provide private information that wrongly identifies someone. One of the ISPs maintains it can not accurately match the IP addresses with alleged file-sharers.

One concern that I have, right off the bat, is that the ISPs probably collect way too much information in the first place and probably should put in place a rigorous retention policy that would delete their logs pretty darn quick. If they don't have the information desired by CRIA, they don't have to worry about it. It is not the job of the ISPs to collect and stockpile evidence for the recording industry (or any other organization). In fact, under PIPEDA they should probably not retain it:

Principle 5 -- Limiting Use, Disclosure, and Retention

Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.

The information being requested by CRIA is probably from routine logging of network activity and connections. I know of some providers who (despite advice to the contrary) keep these logs indefinitely for security and audit purposes. In most cases, this is not made known to the customers. I know that my ISP does not mention this sort of information collection in its Privacy Policy, even though the Openness Principle requires making this sort of collection known. My cellphone company doesn't say anything about signalling information, which I am sure is logged and can be traced to me.

According to what I've heard, the US PATRIOT Act allows the Department of Homeland Security to request information about borrowers from public libraries. The logical response from many librarians is to make sure they don't collect information that would be useful to the FBI. From the San Francisco Public Library:

The Library does not maintain a history of what a borrower has previously checked out once books and materials are returned on time.

In short, if you don't want to fight over disclosing it to anyone, don't collect it and, if you do, don't retain it!

Article: Privacy officials fear U.S. law's reach: FBI could gain access to personal information about Canadians, government warned

The Victoria Times Colonist and the Vancouver Sun are reporting about fears that the US PATRIOT Act might require companies to hand over Canadian data to the FBI:

Privacy officials fear U.S. law's reach: FBI could gain access to personal information about Canadians, government warned

Judith Lavoie

Victoria Times Colonist

Thursday, March 04, 2004

Provincial information and privacy offices across the country are scrambling to find ways of stopping the FBI gaining access to sensitive personal information about Canadians under a controversial new American law.

"This has the potential for being the biggest privacy issue we have ever dealt with," said Mary Carlson, director of policy and compliance for the B.C. Information and Privacy Commissioner's Office.

"It is the first we had heard of the long arm of the FBI coming across the border."

At issue is the U.S. Patriot Act, brought in after the 9-11 terrorist attacks, which allows the FBI to order organizations to turn over information. A "gag provision" then prohibits the organizations from telling anyone that the data has been released.

Legal opinions given to the B.C. Government and Service Employees' Union -- which has filed a lawsuit in an effort to stop privatization of the Medical Services Plan -- say Canadian subsidiaries of U.S. companies would be subject to the Act. Any corporation that has access to documents wanted by the FBI, even if the company does not have a legal right to those documents, could be ordered to turn them over.

That would mean the FBI could demand health and social service information about all British Columbians.

Governments are increasingly outsourcing work, often to companies with U.S. connections, but no one had figured in the far-reaching powers of the Patriot Act, said Carlson.

"If this is true, our data would be exposed in ways we have never imagined before," she said.

Carlson contacted the federal information and privacy commissioner and provincial offices and found the Patriot Act was not on their radar screens.

All the offices are now looking at the potentially serious implications, Carlson said. "We are working feverishly here trying to work out what we can do."

The two companies shortlisted to take over MSP and PharmaCare administration services are both American-based. IBM is American with a wholly-owned Canadian subsidiary and Maximus is based in Virginia.

Other recent government outsourcing includes a large chunk of BC Hydro's business services, which went to a Canadian subsidiary of Accenture, a company with its head office in Bermuda and main business office in the U.S., and government debt collection which went to a Canadian subsidiary of multi-national Electronic Data Systems.

Health Services Minister Colin Hansen said previously that the American government could not pass a law that applies to data owned by B.C. and which never leaves B.C. But, under the Patriot Act, that is in doubt.

Management Services Minister Joyce Murray, whose portfolio includes information and privacy, met with Commissioner David Loukidelis Wednesday to discuss the problem.

"We are now working in collaboration with the Attorney-General's office and Health Services to seek extra professional advice," she said.

A lawyer specializing in American law and privacy of information will look at implications of the Patriot Act and the government will work actively with other provinces and the federal government on the issue, Murray said.

"Whatever the advice is, the bottom line is that we're totally committed to ensuring that the privacy of information is protected for British Columbians," she said.

Any contracts with private companies must enshrine the absolute protection of privacy and those contracts will be monitored, she said.

Murray said she can understand why no one had picked up the importance of the U.S. law, as there have been no challenges or court cases around it.

But BCGEU president George Heyman said Hansen and Premier Gordon Campbell had obviously not done their homework in the rush to privatize and contract out.

"We could figure it out and they have a whole phalanx of lawyers and staff. I would think they could figure out the risk. It's more likely that they don't care," he said.

ACLU and California Library Association Launches Campaign to Take Action Against the Patriot Act and Restore Constitutional Rights

ACLU and California Library Association Launches Campaign to Take Action Against the Patriot Act and Restore Constitutional Rights - Most of my comments and musings here are about private sector privacy in Canada, but I just felt compelled to link to a new privacy-related ad from the US ACLU:

Don't you hate it when someone reads over your shoulder? Especially when that someone is the Justice Department.

American Civil Liberties Union : Combatting The Surveillance Industrial Complex

On August 9, 2004, the American Civil Liberties Union released a report/position paper on the enlisting of citizens and companies to report vague and undefined "suspicious activities" related to terrorism. Their position is no surprise, but overall the report is an interesting read:

American Civil Liberties Union : Combatting The Surveillance Industrial Complex:

"The Privatization of Surveillance
The U.S. security establishment is rapidly increasing its ability to monitor average Americans by hiring or compelling private-sector corporations to provide billions of customer records. The explosive growth in surveillance by government and business is creating a "Surveillance Industrial Complex" that threatens all of our privacy.

About the Report:

This report makes the case that, across a broad variety of areas, the same dynamic of the "privatization of surveillance" is underway. Different dimensions of this trend are examined in depth in four separate sections of the report:

"Recruiting Individuals." Documents how individuals are being recruited to serve as "eyes and ears" for the authorities even after Congress rejected the infamous TIPS (Terrorism Information and Prevention System) program that would have recruited workers like cable repairmen to spy on their customers.
"Recruiting Companies." Examines how companies are pressured to voluntarily provide consumer information to the government; the many ways security agencies can force companies to turn over sensitive information under federal laws such as the Patriot Act; how the government is forcing companies to participate in watchlist programs and in systems for the automatic scrutiny of individuals’ financial transactions.
"Mass Data Use, Public and Private." Focuses on the government’s use of private data on a mass scale, either through data mining programs like the MATRIX state information-sharing program, or the purchase of information from private-sector data aggregators.
"Pro-Surveillance Lobbying." Looks at the flip side of the issue: how some companies are pushing the government to adopt surveillance technologies and programs based on private-sector data."

patriot act

News Release Privacy Commissioner calls for further examination of transfer of personal information about Canadians across borders

News Release

Privacy Commissioner calls for further examination of transfer of personal information about Canadians across borders

What Canadians Can Do to Protect Their Personal Information Transferred Across Borders

What Companies Do to Protect the Personal Information of Canadians Transferred Across Borders