New Canadian Government Policy on Data Mining

The Canadian government has released a new policy regarding its ability to track the activity of users visiting government web sites. The policy regulates the use of “personal information”, as defined under the Canadian Privacy Act , by government institutions in “web analytics”, that is, the collection, analysis, measurement and reporting of data about web traffic and user visits for purposes of understanding and optimizing web usage. Among other restrictions, the policy prohibits the use of personal information for profiling individuals, it requires a maximum retention period for collected personal information of 18 months, and it requires that any personal information disclosed or transmitted to third parties be de-personalized and rendered anonymous. One concern over the new policy is that it does not apply to any social media sites which, although established by government institutions, are hosted by third-party service providers such as Twitter. While the new standards themselves may not be applicable, the government is still restricted in its use of personal information that is collected in these situations since under the Privacy Act: “no personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.” The policy came into effect on January 31, 2013; however, government institutions that disclose or transmit person information to third party service providers have until June 30, 2014, to ensure its contracts with these third parties have been updated to reflect the new standards. For more commentary, visit: http://tinyurl.com/cwus8w9; and http://tinyurl.com/bsbwzcn Summary by: Thomas Wong