Canadian Government Must Adopt More Stringent Safeguards for Personal Information, Says Treasury Board

Earlier this year, the federal government proposed draft guidelines (E-TIPS®, Vol 3, No 18, February 10, 2005) intended to safeguard against the unauthorized disclosure of personal information by service providers subject to the laws of foreign jurisdictions. Now released under the title "Taking Privacy into Account Prior to Making Contracting Decisions" (Guidelines), the draft Guidelines suggest that federal departments need to adopt more stringent measures to protect personal information in their custody and control. The Guidelines encourage federal departments to gauge the possible risk of unauthorized disclosure associated with each potential contract in light of the sensitivity of the personal information, the expectations of individuals to whom the information relates, and potential injury to an individual's "career, reputation, financial position, safety, health or well-being" in the event of a breach. Further, the Guidelines suggest that, wherever possible, federal databases containing sensitive personal information should be located in, and only accessible from within Canada; and, that federal departments should consider severing the flow of personal information to foreign-linked service providers presented with any production order contrary to Canadian privacy law. Drafted by the federal Treasury Board, the Guidelines respond to recommendations by the federal Privacy Commissioner for the Government to re-examine the circumstances under which it allows personal information about Canadians to be processed outside Canada and a study, by her provincial counterpart in British Columbia, on the potential impact of the USA PATRIOT Act on personal information outsourced to US-linked companies by governments in Canada (E-TIPS®, Vol 3, No 11, November 10, 2004). The Treasury Board also led a working group to draft special clauses to be used in future business proposal requests and contracts with external service providers. The clauses are meant to enhance and clarify data custody and control issues, confidentiality requirements and conditions on use and disclosure. For the full text of the Guidelines, see: http://tbguidelines.notlong.com For news article on federal government strategy, see: http://cnews.canoe.ca/CNEWS/Canada/2005/12/11/1348514-cp.html For an article on the BC government's response to long-arm provisions of USA PATRIOT Act, visit: http://dww.local/articles/bcpatriot_amendments.htm The Office of the Privacy Commissioner of Canada's Submission on the Implications of the USA PATRIOT Act can be found at: http://privcompatriot.notlong.com BC Information & Privacy Commissioner's Report on the USA PATRIOT Act: http://makeashorterlink.com/?B22553DB9 Summary by: Jason Young