| |||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||
 |
| ||||||||||||||||||||||||||||||||||||
 |
|||||||||||||||||||||||||||||||||||||
|
Vol. 137, No. 45 — November 8, 2003 Regulations Amending the Regulations Specifying Investigative BodiesStatutory Authority Personal Information Protection and Electronic Documents Act Sponsoring Department Department of Industry REGULATORY IMPACT Description Part 1 of the Personal Information Protection and Electronic Documents Act establishes rules to govern the collection, use and disclosure of personal information by organizations in the course of commercial activity. The legislation requires an organization, which discloses personal information, to obtain the individual's consent in most circumstances. An exception to this rule is found in paragraphs 7(3)(d) and (h.2) of Part 1 of the Act, which permit the disclosure of personal information to and by a private investigative body, without the knowledge or consent of the individual, if the investigative body is specified by the Regulations. The purpose of this amendment to the Regulations is to name additional investigative bodies for the purposes of paragraphs 7(3)(d) or (h.2) of Part 1 of the Act. Many investigations into frauds and breaches of agreement are conducted by private sector organizations, either acting as or making use of independent, non-governmental investigative bodies. Should the investigation reveal grounds for suspecting that a fraud has been committed or a law contravened, the organization may then turn the findings over to a police or other law enforcement agency for further action or (as in the case of professional regulatory bodies such as the law societies and the colleges) it may take appropriate disciplinary action pursuant to its own statutory authority. Paragraph 7(3)(d) allows an organization to disclose personal information, without the consent of the individual, to a private investigative body in order to instigate or facilitate an investigation. Paragraph 7(3) (h.2) allows an investigative body to disclose personal information to another private organization, including the client organization on whose behalf it is conducting the investigation. The disclosures are circumscribed as they must be related to investigations of a breach of an agreement or a contravention of the law and be reasonable. Paragraph 7(3) (h.2) completes the exception provided in paragraph 7(1)(b) for collection without consent for the purposes of the prevention of fraud by extending it to disclosure. Collection alone would be of limited use to those combatting fraud and other breaches of agreement, unless the information could be disclosed to the parties that need the information. However, without paragraph 7(3) (h.2), the flow of information could only go in one direction, from the organization to the investigative body. The investigative body would be unable to disclose the results of its investigation back to its client or other interested parties without consent. The ability to exchange personal information without consent for investigative purposes between or among private organizations is the only exception granted to these organizations by the Regulations. Organizations and investigative bodies which exchange personal information will remain responsible for compliance with all other requirements of the Act for this information, and will be subject to oversight by the Privacy Commissioner of Canada and the ability of individuals to seek redress in the Federal Court of Canada. More particularly, the general requirement that the Act imposes on all organizations to obtain consent before disclosing personal information is not altered by virtue of granting an organization status as an investigative body. Organizations with investigative body status would be able to disclose personal information in their investigations without the consent of the individual only in those exceptional circumstances in which obtaining consent is impossible, impractical or undesirable because it would frustrate the conduct of the investigation. During the initial preparation of these Regulations, Industry Canada developed a set of criteria that would be used in the assessment of candidates for investigative bodies. These criteria were intended to cover privacy concerns associated with allowing organizations to disclose personal information without consent for investigative purposes. All of the criteria would not necessarily be applicable to each investigative body. The criteria include the following: — The specific contraventions of law or breaches of agreements against which the investigative activities are directed; — The specific personal data elements which are disclosed by other organizations to the body; the specific personal data elements which flow back to the organizations from the body; the uses and disclosures made of the information by the body; whether audit trails are maintained; the length of time the information is kept; the security standards and practices in place for retention and disposal of the information; — Whether the operational structure of the body or process is fully documented and formalized and the authority, responsibility and accountability centres are identified; — Whether there are specific legal regime, licensing requirement, regulation or oversight mechanisms to which it is subjected and whether sanctions or penalties for non-compliance exist; — The privacy protection policies and procedures, such as a privacy code, followed by the body. The extent to which the policies and procedures comply with Part 1 of the Act; — The extent to which the investigative body is independent from the association of members or client organizations that it serves; — The extent to which all alternative methods of complying with the Act, such as contract or consent, have been exhausted; — The amount of information provided to individuals about the existence and operation of the body and about how to make a complaint or seek redress. Part 1 of the Act is being implemented in two stages. On January 1, 2001, it applied to the personal information of the customers and employees of the federally regulated private sector, including telephone and transportation companies, broadcasters, and banks. It also applied to organizations that sell personal information across provincial borders, e.g. companies selling or renting mailing lists. On January 1, 2004, the Act will apply to all personal information collected, used or disclosed in the course of commercial activity. Due to the phased introduction of the legislation and the fact that it is new to the private sector, it was expected that additions to the list of investigative bodies in the Regulations would be necessary. For this reason, the Department has indicated that it would continue to consider applications on a case-by-case basis in the future. Industry Canada has now completed its review of new applications from two different sorts of organizations. The first group of applicants are various professional regulatory bodies with a statutory authority to investigate professional misconduct on the part of their members. These include law societies, health colleges, the College of Social Workers and Social Service Workers as well as the provincial disciplinary bodies of the Certified General Accountants of Canada. The second group includes various private sector organizations that conduct investigations into fraud and breaches of agreement. These include Teranet Services Inc., the Credit Union Office of Crime Prevention and Investigation, certified general accountants, private investigators, and independent insurance adjusters. On the basis of the documentation submitted, describing their operation and investigative activities, Industry Canada has concluded that the Regulations should be amended by adding the organizations listed. Copies of their submissions may be obtained by contacting Industry Canada or by visiting the Electronic Commerce Web site at http://e-com.ic.gc.ca/english/privacy/index. html. Alternatives The legislative framework in Part 1 of the Act requires that an investigative body, for the purposes of paragraphs 7(3)(d) or (h.2) of the Act, be specified by the Regulations. There are no alternatives to deal with the collection, use and disclosure of this information without consent. Benefits and Costs According to industry estimates, property-related fraud cost the associated Canadian financial services industry upwards of $300 million in 2001, credit card fraud cost Canadian issuers of major credit cards $230 million in 2001, while insurance fraud cost the property and casualty insurance industry $1.3 billion annually. The costs of fraud are paid for by the public through increased premiums and the personal inconvenience caused by identity theft and the correction of credit rating errors. The Regulations will benefit the public by assisting organizations in combatting fraud as well as by providing a mandated standard of protection for the personal information that is obtained by the organizations engaged in private investigations. The professional disciplinary bodies, such as the law societies and colleges, investigate the conduct of their members to prevent incompetent, unethical, and unauthorized practices, which is to the general benefit of all persons who make use of their professional services. Costs The Regulations should not impose significant additional costs on the organizations to which it applies as it merely permits the continuation of existing information-sharing relationships between organizations and the specified investigative bodies. The Regulations will have no impact on Department resources. Consultation The public comments received following the prepublication of the Regulations in the Canada Gazette, Part I, in 2000, gave broad support for the goal of facilitating the ability of the private sector to combat fraud by specifying certain organizations as investigative bodies. Following the listing of the Insurance Crime Prevention Bureau and the Bank Crime Prevention and Investigation Office of the Canadian Bankers Association, Industry Canada has not received any complaints or expressions of concern regarding the operation of these organizations or of the Regulations themselves. Subsequent to the coming into force of the Act on January 1, 2001, Industry Canada has engaged in extensive discussions with the applicants concerning their investigative activities and the need for an amendment to the Regulations to add them to the list of investigative bodies. Consultations with the Office of the Privacy Commissioner have also taken place. To facilitate public comments concerning the proposed amendment to the Regulations, Industry Canada notified the privacy advocacy community and interested privacy organizations in advance of prepublication in the Canada Gazette, Part I. Information was also made available on the Industry Canada Web site (http://e-com.ic.gc.ca/english/privacy/index.html). Compliance and Enforcement Individuals may make complaints about the practices of an organization to the Privacy Commissioner of Canada who will investigate the matter and deliver a report to the parties. The Commissioner may make recommendations to an organization concerning its practices and whether they are considered to comply with Part 1 of the Act, but the Commissioner does not have the power to issue binding orders on the organization. The individual or the Privacy Commissioner, or both acting together, may take unresolved complaints to the Federal Court of Canada, which has the power to order an organization to change a practice and to pay damages to the individual. It is intended that these Regulations will come into force on January 1, 2004, which is the date on which the Act will apply to all personal information collected, used, or disclosed in the course of commercial activity. Mr. Richard Simpson, Director General, Electronic Commerce Branch, Industry Canada, 300 Slater Street, Room D2090, Ottawa, Ontario K1A 0P8, (613) 990-4292 (Telephone), (613) 941-0178 (Facsimile), simpson.richard@ic.gc.ca (Electronic mail). Notice is hereby given that the Governor in Council, pursuant to paragraph 26(1)(a.01) of the Personal Information Protection and Electronic Documents Act, proposes to make the annexed Regulations Amending the Regulations Specifying Investigative Bodies. Interested persons may make representations with respect to the proposed Regulations within fifteen days after the date of publication of this notice. All such representations must cite the Canada Gazette, Part I, and the date of publication of this notice, and be addressed to Richard Simpson, Director General, Electronic Commerce Branch, Industry Canada, 300 Slater Street, Room D2090, Ottawa, Ontario K1A 0C8. Ottawa, November 6, 2003
EILEEN BOYD
REGULATIONS AMENDING THE REGULATIONS SPECIFYING INVESTIGATIVE BODIES AMENDMENT 1. Section 1 of the Regulations Specifying Investigative Bodies (see footnote 1) is amended by striking out the word "and" at the end of paragraph (a) and by adding the following after paragraph (b): (c) the College of Audiologists and Speech-Language Pathologists of Ontario; (d) the College of Chiropodists of Ontario; (e) the College of Chiropractors of Ontario; (f) the College of Dental Hygienists of Ontario; (g) the College of Dental Technologists of Ontario; (h) the College of Denturists of Ontario; (i) the College of Dietitians of Ontario; (j) the College of Massage Therapists of Ontario; (k) the College of Medical Laboratory Technologists of Ontario; (l) the College of Medical Radiation Technologists of Ontario; (m) the College of Midwives of Ontario; (n) the College of Nurses of Ontario; (o) the College of Occupational Therapists of Ontario; (p) the College of Opticians of Ontario; (q) the College of Optometrists of Ontario; (r) the Ontario College of Pharmacists; (s) the College of Physicians and Surgeons of Ontario; (t) the College of Physiotherapists of Ontario; (u) the College of Psychologists of Ontario; (v) the College of Respiratory Therapists of Ontario; (w) a corporation or other body
(ii) that is a member in good standing of a professional association that represents the interests of private investigators or detectives and that has such a privacy code; (x) a corporation or other body
(ii) that is a member in good standing of a professional association that represents the interests of insurance or claims adjusters and that has such a privacy code; (y) the Certified General Accountants Association of Alberta; (z) the Certified General Accountants Association of British Columbia; (z.1) the Certified General Accountants Association of Manitoba; (z.2) the Certified General Accountants Association of New Brunswick; (z.3) the Certified General Accountants Association of Nova Scotia; (z.4) the Certified General Accountants Association of Newfoundland and Labrador; (z.5) the Certified General Accountants Association of Ontario; (z.6) the Certified General Accountants Association of Prince Edward Island; (z.7) the Certified General Accountants Association of Saskatchewan; (z.8) the Certified General Accountants Association of Northwest Territories-Nunavut; (z.9) the Certified General Accountants Association of Yukon; (z.10) the Credit Union Office of Crime Prevention and Investigation of the Credit Union Central of Canada; (z.11) the Law Society of Alberta; (z.12) the Law Society of Manitoba; (z.13) the Law Society of the Northwest Territories; (z.14) the Law Society of New Brunswick; (z.15) the Law Society of Newfoundland; (z.16) the Law Society of Saskatchewan; (z.17) the Law Society of Upper Canada; (z.18) the Law Society of Yukon; (z.19) l'Ordre des comptables généraux licenciés du Québec; (z.20) the Nova Scotia Barristers' Society; (z.21) the Ontario College of Social Workers and Social Service Workers; (z.22) the Royal College of Dental Surgeons of Ontario; and (z.23) Teranet Services Inc. COMING INTO FORCE 2. These Regulations come into force on the day on which they are registered. [45-1-o] SOR/2001-6 |
||||||||||||||||||||||||
|
NOTICE:
|
|||||||||||||||||||||||||
