Canadian Privacy Commissioner Issues Response on USA Patriot Act

The Canadian Privacy Commissioner, Jennifer Stoddart, has recently released a public response regarding the impact of the USA Patriot Act (Patriot Act) on the privacy rights of Canadians. The BC Privacy Commissioner had made a request for such a statement after launching an inquiry into growing public concern about the ability of the US government to gain access to the personal information of Canadians dealing with US companies. The Canadian Privacy Commissioner's statement discusses the legislation currently in place to protect Canadians and how Canadians' personal information can be transferred across borders. The Privacy Commissioner contends that although the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) and the Privacy Act offer some protection, Canadians need to be aware of the limitations of the legislation. The Privacy Commissioner also commented on the Patriot Act directly. The statute permits the FBI to seek a court order to compel a US company or institution to disclose documents it has about a particular issue, including those documents containing personal information, without informing the person whose personal information is to be disclosed. However, the Privacy Commissioner does not believe that this power is significantly different from the existing and long-established procedures that the US and other foreign governments have in place for collecting personal information. In the report, the Privacy Commissioner identified some situations in which it is unclear which law, Canadian or US, would govern. She also suggested that Canadian companies outsourcing the handling of personal information to a US company should inform their customers that the Patriot Act would apply to the US company engaged as the service provider. If a Canadian company wishes to avoid this possibility, says the Privacy Commissioner, it should outsource to another Canadian company. All commercial operations in Canada (with some exceptions) are governed by PIPEDA or comparable legislation, and personal information cannot be disclosed to a foreign state without consent of the individuals to whom the information applies. Under Canadian law, a Canadian subsidiary of a US corporation cannot be compelled to disclose information to the US government. The Privacy Commissioner called on Canadian citizens and corporations to be more aware of their rights and obligations under PIPEDA, and to be more attentive to how and to whom personal information is disclosed. For the full statement of the Privacy Commissioner, visit: http://www.privcom.gc.ca/media/nr-c/2004/sub_usapa_040818_e.asp. Summary by: James Kosa If you wish more information on how privacy legislation may affect your data or the data you collect, contact Amy-Lynne Williams (awilliams@dww.com) or Michael Erdle (merdle@dww.com)