Canadian Privacy Act

Nos. writes "Yesterday, I happened upon an Act that came into effect in Canada on January 1, 2004. The Personal Information Protection and Electronic Documents Act protects almost every bit of personal information not publicly available. For example, your name, race, date of birth, income, etc. are protected where your address and telephone number are not (these are generally available in the telephone book). Some of the more interesting parts of the faq include such wonderful things as: '[businesses must] supply you with a product or a service even if you refuse consent for the collection, use or disclosure of your personal information unless the information is essential to the transaction'. Definitely a step in the right direction."

Comments

What the law says and what's done in practice ...

[he-sk]

are two different things. Ie, here in Germany we have very tough laws with regard to your personal information and how it must be handled by businesses and the government. It's called "Datenschutz" and the CCC (Chaos Computer Club, you know: Blinkenlights) is a big lobbiest for Datenschutz.

Unfortunately the laws and procedures are broken every day, simply because it's so easy to do. It's very rare that somebody publicly complains when personal privacy is jeopardized and even when somebody cries foul, the public doesn't care.

It IS absolutely retroactive

[nilstar]

I actually had to sign one of these statements at work & deal with this whenever I see the doctor/dentist/etc.

It seems that information already collected must be dealt with according to the act. Just because you collected it last year, doesn't mean you don't need consent to use it this year. Actually, my Dentist made me sign a form for them to share/get information with outside labratories.

Re:It IS absolutely retroactive

[Kwil]

Actually, he can't refuse you service based on your refusal to supply information that isn't directly related to the transaction.

However, being a dentist, the transaction may well require an address to send a bill to.

If you're willing to pay at the desk, in cash, you can tell him no, and suggest that if he refuses based on that, you will contact the government of Canada for a PIPEDA infraction.

Re:Not retroactive?

[vmacneil]

There is another act called the Privacy Act that circumscribes the behaviour of government. That act was passed in 1980. You can find it here... http://laws.justice.gc.ca/en/p-21/93543.html

Re:Toothless?

[Dixie_Flatline]

It's illegal to REQUIRE a SIN (Social Insurance Number) in Canada if you aren't the government, an employer, or are somehow related to taxation. My bank can ask me for a SIN because they need to report the amount of income I made on interest. A credit card company CAN NOT ask for my SIN. If I refuse to provide it, and they refuse their service, I can file a complaint against the company. The SIN number is not meant as a unique identifier for anyone other than the government.

If someone asks for it, read the fine print. It's usually optional. If it's not optional, make sure you phone the company and ask why it's required, and make sure they know that you know that it's not necessary for them to have it. DON'T GIVE IT OUT. It's not necessary to have your SIN for companies to do a credit check on you here.

Re:Fake data

[WormholeFiend]

G1Q 1Q9

translation: (I have) (an) (ass(, (a) (new) (ass)

note that in French, the adjective (new) comes after the noun (ass), and I switched them for non-French slashdotters

Re:Car Dealerships...

[jeffkjo1]

There are other ways to get said information. Consumer Reports prints recalls in their magazine every month, for example.

Re: GoC does take privacy seriously

[Anonymous Coward]

Your SIN is private, right? HEH. Nope. Now it's linked in government databases to everything. As someone who once had complete and total access to several sensitive (welfare client info) government databases - and was challenged appropriately by only ONE of dozens of sysadmins - I don't trust the government to protect a pile of dog feces.

The personal details of all Canadian residents (not just citizens) are automatically classified as "Protected" and any department or agency worth their salt actually do take this sort of stuff seriously.

Any case of abuse (of people's personal data) does tend to result in being fired, period.

The federal government (outside CCRA) does avoid using SIN as much as possible because any document with that on it, has to be classified "Protected".
HRDC uses a fair bit, but as little as possible in what I've seen.

I've seen federal government forms that ask for only the last digit of your year of birth, in an attempt to prevent age decriminitation (if they don't know your actual age, they can't be accused of decriminiating based upon it) in the hiring process.

Honestly I have to say the Canadian federal government takes privacy seriously, it's an important Canadian value. Sure, some people see it as a hassle and more paperwork, but overall the vast majority do value the public's privacy and security.

BTW, do you know if there was an auditing on that database? Not all privacy enforcement is pro-active, to prevent being overly burdensome, but can flag and catch abusers. That technique is heavily used in medical privacy, and the medical files of celeberties.

Re:Serious

[orthogonal]

It makes no sense for a business not to sell you something because you refuse to provide personal information. If I were a business owner, I'd sell my products to anybody that was willing to offer cash. I see businesses all the time refusing to sell to some segment of the population, and I find that truly bizarre.

Yeah, it is truly bizarre -- if the business is making money off the product.

Sometimes, the business is making -- or plans to make -- the majority of its money off selling your name or your "eyeballs" (viewership).

Some MBA has convinced ShopShack that the real money is in selling its customers to other businesses, and MBAstard realizes that you just want to make the purchase and get on with your life. So a policy is made that the shop won't sell without getting your information, wagering that, having waited in the check-out line, rather than go to the trouble to buy elsewhere, you'll just do as you're told like a good little consumer.

The only effective response to this is to make the cost of doing this as high as possible for the business by

• Arguing the point at the point of sale, and refusing to relinquish your position in line. This will win you the ire of the customers behind you in line, but if you're lucky, it'll also convince some of them that going to that store isn't worth having to deal with trouble-makers like you standing on principle;
• and then making a fuss that pulls in the store manger, wasting his time too, and explaining to him precisely why his times being wasted without his in fact making a sale or getting the information;
• followed up by a call to the store's corporate headquarters explaining that you'll be happy to share your information as soon as whomever you're talking to shares his and the company's president's home phone number too.

It's not easy, and it's not convenient, but if you want to keep your privacy, you need to make it uncomfortable and costly for those who want to take it from you. make it costly enough, and the stores will stop doing this crap.

Here's an example

[Vip]

Here's what they are trying to stop.

Parking lot complaints

825 complaints in 18 months in one city against one company. The data was sold by the government to the parking company.

Vip