Incorporating privacy outcomes: Teaching an old dog new tricks

Proceedings - 6th Annual Conference on Privacy, Security and Trust, PST 2008

Volumn , Issue , 2008, Pages 232-239

  Brown, Ed ^a   Kosa, Tracy Ann ^b  

^a MEMORIAL UNIVERSITY OF NEWFOUNDLAND   (Canada)

^b GOVERNMENT OF ONTARIO   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

BUSINESS PROCESS; IMPACT ASSESSMENTS; PERSONAL INFORMATION MANAGEMENT; PRIVACY REQUIREMENTS; PROCESS REQUIREMENTS; SERVICE DELIVERY; TECHNICAL CONTENT;

LAWS AND LEGISLATION; TELECOMMUNICATION SERVICES;

INFORMATION MANAGEMENT;

EID: 67650095518     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/PST.2008.27     Document Type: Conference Paper

References (114)

1. "The Right to Privacy". Harvard Law Review. Volume 193, 1890.
2. William Prosser, "Privacy" (1960) 48 California Law Review 383 1960, at p. 389.
3. st Century" online: http://www.anu.edu.au/people/Roger. Clarke/DV/PP21C.html#S copeDP. Clarke notes: "The first laws that expressly protected information privacy were passed in Europe in the early 1970s. The West German Land of Hesse passed its Datenschutzgesetz (Data Protection Act) in 1970, and that term quickly came to be used in virtually all discussions. Sweden's Data Act of 1973 was the first such legislation at national level. A succession of Continental countries followed, including Germany in 1977 and France in 1978."
4. Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data (Council of Europe Convention 108) online: http://www.coe.int/treaty/EN/cadreprincipal.htm,
5. and the Guidelines on the Protection of Privacy and Transborder Flows of Personal Data released 23 September 1980. Canada signed on June 1984. online: http://www.oecd.org/document/18/0,2340,en-2649-34255-1815186-1-1-1-1,00. html.
6. See http://europa.eu.int/comm/internal-market/privacy/law-en.htm.
7. Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5
8. Raab and Bennett concede that "privacy as a goal has often been transmuted into data protection." See Charles D. Raab and Colin J. Bennett, "Taking the Measure of Privacy: Can Data Protection Be Evaluated?" (1996) 62 Int'l. Rev. Admin. Sci.535 at 537 [Raab and Bennett].
9. Daniel Solove, A Taxonomy of Privacy, 154 U. Penn Law Review 477, January 2006.
10. R v. Duarte [1990] 1 S.C.R. 30. Dickson C.J. for the majority states: "Privacy may be defined as the right of the individual to determine when, how, and to what extent he or she will release personal information."
11. Alberta: Freedom of Information and Protection of Privacy Act, R.S.A. 2000, c. F. 25;
12. British Columbia: Freedom of Information and Protection of Privacy Act R.S.B.C. 1996, c. 16;
13. Federal: Privacy Act, R.S.C., c.P-21. ;
14. Manitoba: The Freedom of Information and Protection of Privacy Act C.C.S.M. c. F175;
15. New Brunswick: Protection of Personal Information Act S.N.B. 1998, c. P19.1;
16. Newfoundland and Labrador: Access to Information and Protection of Privacy Act S.N.L. 2002, can-1.1;
17. Northwest Territories: Access to Information and Protection of Privacy Act, S.N.W.T. 1994, c. 20 ;
18. Nova Scotia: Freedom of Information and Protection of Privacy Act, R.S.N.S. 1993, c. 5;
19. Nunavut: Access to Information and Protection of Privacy Act, S.N.W.T. 1994, c. 20, as duplicated for Nunavut by s. 29 of the Nunavut Act, S.C. 1993, c. 28;
20. Ontario: Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F31;
21. Ontario: Municipal Freedom of Information and Protection of Privacy Act R.S.O. 1990, c. M56;
22. Prince Edward Island: Freedom of Information and Protection of Privacy Act R.S.P.E.I. 1998, c. F-15.01;
23. Quebec: An Act respecting Access to documents held by public bodies and the Protection of personal information, R.S.Q. c. A-21;
24. Saskatchewan: Freedom of Information and Protection of Privacy Act, S.S. 1990-91, c. F-22.01;
25. Saskatchewan: Local Authority Freedom of Information and Protection of Privacy Act, S.S. 1990-91, c. L-27.1;
26. Yukon: Access to Information and Protection of Privacy Act, R.S.Y. 2002, c. 1.
27. Alberta FIPA s. 33, s. 34, BC FIPPA s. 27, Manitoba FIPPA s. 36, s. 37;
28. NB PPIA Principle 2, Principle 4;
29. NWT AIPPA s. 40-41;
30. NS FOIPOP s. 24;
31. Nunavut AIPPA s. 40-41;
32. PEI FIPPA s. 31-32;
33. Yukon AIPPA s. 29-30;
34. Ontario FIPPA s. 38-39;
35. Ontario MFIPPA s. 28-29;
36. Saskatchewan FIPPA s. 26;
37. Saskatchewan LAFIPPA s. 24-25;
38. Québec s. 64-65;
39. Privacy Act s. 4-5.
40. Alberta FIPA s. 38;
41. BC FIPPA s. 30;
42. Manitoba FIPPA s. 41;
43. NB PPIA;
44. NWT AIPPA s. 42;
45. NS FOIPOP s. 24(2);
46. Nunavut AIPPA s. 42;
47. PEI FIPPA s. 35;
48. Yukon AIPPA s. 33
49. Ontario: Personal Health Information Protection Act, 2004, S.O. 2004, c. 3;
50. Alberta: Health Information Act, R.S.A. 2000, c. H-5;
51. Manitoba: Personal Health Information Act, S.M. 1997, c. 51;
52. Saskatchewan: Health Information Protection Act, S.S. 1999, c. H-0.021.
53. This includes Alberta: Personal Information Protection Act, S.A. 2003, c.P-6.5. ;
54. British Columbia: Personal Information Protection Act, S.B.C. 203, c. 63 ;
55. Quebec: An Act Respecting the Protection of Personal Information in the Private Sector, R.S.Q., c. P-39.1.;
56. and in provinces without substantially similar legislation, the Federal: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5.
57. PIPEDA Principle 4.7;
58. AB PIPA s. 34;
59. BC PIPA s. 34.
60. See note 11
61. ON PHIPA s. 3;
62. SK HIPA s. 2(t);
63. MB PHIA s. 1(1);
64. AB HIA s. 1(1)(f).
65. The notion of "custody and control" is built into the definition of "health information custodian" in ON PHIPA s. 3 and "trustee" in SK HIPA s. 2(t). Although not built into the definitions, the AB HIA also uses the language of "custody and control" as for example in s. 7 and s. 8. MB PHIA is distinct in using the language of "maintenance" in s. 1(1) rather than custody or control.
66. For example, ON PHIPA Regulation 329/04. Section 6(3) requires IT service providers to take steps to assure custodians of the privacy and security of the services provided.
67. Treasury Board of Canada Secretariat, Privacy Impact Assessment: Policies and Publications. Available online at http://www.tbs-sct.gc.ca/ pubs-pol/ciopubs/pia-pefr/siglist-e.asp.
68. Information regarding PIAs related to legislative privacy oversight include the federal Privacy Commissioner: (http://www.privcom.gc.ca/);
69. Treasury Board (http://www.tbssct. gc.ca /tbsimScripts/topic-sujet-list- e.asp?ID=121),
70. Justice Canada, Industry Canada; http://www.privcom.gc.ca/information/ index-e.asp.
71. Federal Information Commissioner: (http://www.infocom.gc.ca/menue.asp);
72. Treasury Board (http://www.tbssct.gc.ca/pubs-pol/gospubs/tbm-121/siglist- e.asp),
73. Justice Canada, Industry Canada; http://www.infocom.gc.ca/media/default- e.asp.
74. British Columbia:(http://www.oipcbc.org/);
75. IM/IT Privacy and Legislation Branch (http://www.mser.gov.bc.ca/ privacyaccess/);
76. http://www.oipcbc.org/resources.htm
77. Alberta:(http://www.oipc.ab.ca/home/),
78. Information Management, Access and Privacy Division (http://foip.gov.ab. ca/)
79. Alberta Health and Wellness (http://www.health.gov.ab.ca/about/Minister- legislation.html);
80. http://www.oipc.ab.ca/publications/.
81. Saskatchewan: (http://www.oipc.sk.ca/);
82. Saskatchewan Justice (http://www.saskjustice.gov.sk.ca/foi/default.shtml) ;
83. http://www.oipc.sk.ca/resources.htm.
84. Manitoba: (http://ombudsman.mb.ca/access.htm);
85. Manitoba Health (http://www.gov.mb.ca/health/phia/index.html) Access and Privacy Services of the Government Records Office at the Archives of Manitoba.
86. (http://www.gov.mb.ca/chc/fippa/index.html);
87. http://ombudsman.mb.ca/resources.htm.
88. Ontario: (http://www.ipc.on.ca/);
89. MGS, Access and Privacy Office (http://www.accessandprivacy.gov.on.ca/ english/);
90. http://www.ipc.on.ca/index.asp?navid=8.
91. Quebec: (http://www.cai.gouv.qc.ca/index-en.html);
92. Ministère des relations avec les citoyens et de l'immigration. Nova Scotia:(http://www.foipop.ns.ca/);
93. Department of Justice (http://www.gov.ns.ca/just/);
94. http://www.gov.ns.ca/foiro/pub-admin.html.
95. Newfoundland and Labrador: (http://www.oipc.gov.nl.ca/) ;
96. Department of Justice (http://www.justice.gov.nl.ca/just/);
97. http://www.oipc.gov.nl.ca/resources.htm.
98. New Brunswick: (http://www.gnb.ca/0073/indexe.asp).
99. Prince Edward Island: (http://www.assembly.pe.ca/index.php3?number= 1013943);
100. Attorney General (http://www.gov.pe.ca/foipp/index.php3).
101. Yukon: (http://www.ombudsman.yk.ca/infoprivacy/info-index.html);
102. AT IPP Office (http://www.atipp.gov.yk.ca/).
103. Northwest Territories: (http://www.assembly.gov.nt.ca/OfficeOftheClerk/ StatutoryOfficers.html);
104. Department of Justice (http://www.justice.gov.nt.ca/ATIPP/atipp.htm).
105. Nunavut: (http://www.gov.nu.ca/Nunavut/atip/);
106. Department of Executive and Intergovernmental Affairs; http://www.infoprivacy.nu.ca/en/faq.
107. See Ontario's Personal Health Information Protection Act, 2004 (PHIPA), Regulation 329/04, as amended 537/06, section 6. Available online at http://www.elaws.gov.on.ca/DBLaws/Regs/English/040329-e.htm.
108. Audit Report of the Privacy Commissioner of Canada: Assessing the Privacy Impacts of Programs, Plans, and Policies, October 2007, available from http://www.privcom.gc.ca/information/pub/arvr/pia-200710-e.asp
109. A Guide to Preparing Treasury Board Submissions, page 74, available from http://www.tbssct. gc.ca/pubs-pol/opepubs/TBM-162/gptbs-gppct-e.pdf.
110. Distinctions discussed here are based on a number of PIA resource related documents, including Canadian Health Infoway Privacy Impact Assessment resources, available online at http://knowledge.infoway-inforoute.ca. Treasury Board of Canada Secretariat, Privacy Impact Assessment: Policies and Publications. Available online at http://www.tbssct.gc.ca/pubs-pol/ciopubs/ pia-pefr/siglist-e.asp.
111. Canadian Institute for Health Information, Privacy Toolkit, October 2003. Available online at http://secure.cihi.ca/cihiweb/en/downloads/ privacy-toolkit-binder-2003-e.pdf.
112. Privacy Impact Assessment Guidelines: A Framework to Manage Privacy Risks, Treasury Board Secretariat Policy Document, available online at: http://www.tbssct. gc.ca/pubs-pol/ciopubs/pia-pefr/paipg-pefrld2-e.asp#3
113. Saskatchewan HIPA s. 6, 7, Ontario PHIPA s. 18, s. 19.
114. Alberta HIA s. 34.