Vol. 135, No. 1 — January 3, 2001

Registration
SOR/2001-7 13 December, 2000

PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT

Regulations Specifying Publicly Available Information

P.C. 2000-1777 13 December, 2000

Her Excellency the Governor General in Council, on the recommendation of the Minister of Industry, pursuant to paragraph 26(1)(a.1) of the Personal Information Protection and Electronic Documents Act(see footnote a) hereby makes the annexed Regulations Specifying Publicly Available Information.

REGULATIONS SPECIFYING PUBLICLY AVAILABLE INFORMATION INFORMATION

1. The following information and classes of information are specified for the purposes of paragraphs 7(1)(d), (2)(c.1) and (3)(h.1) of the Personal Information Protection and Electronic Documents Act:

(a) personal information consisting of the name, address and telephone number of a subscriber that appears in a telephone directory that is available to the public, where the subscriber can refuse to have the personal information appear in the directory;

(b) personal information including the name, title, address and telephone number of an individual that appears in a professional or business directory, listing or notice, that is available to the public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the directory, listing or notice;

(c) personal information that appears in a registry collected under a statutory authority and to which a right of public access is authorized by law, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the registry;

(d) personal information that appears in a record or document of a judicial or quasi-judicial body, that is available to the public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the record or document; and

(e) personal information that appears in a publication, including a magazine, book or newspaper, in printed or electronic form, that is available to the public, where the individual has provided the information.

COMING INTO FORCE

2. These Regulations come into force on January 1, 2001.

REGULATORY IMPACT ANALYSIS STATEMENT

(This statement is not part of the Regulations.)

Description

Part 1 of the Personal Information Protection and Electronic Documents Act establishes rules to govern the collection, use and disclosure of personal information by organizations in the course of commercial activity. The legislation requires an organization, which is collecting, using or disclosing personal information, to obtain the individual's consent in most circumstances. Exceptions to this rule are found in paragraphs 7(1)(d), (2)(c.1) or (3)(h.1) of the Act which permit the collection, use and disclosure of personal information, without the knowledge or consent of the individual, if the information is publicly available and is specified by the Regulations. The purpose of this Regulation is to specify what information and classes of information is publicly available information for the purposes of paragraphs 7(1)(d), (2)(c.1) and (3)(h.1) of the Act.

The basic premise underlying this Regulation is that the collection, use and disclosure of publicly available personal information for commercial purposes should be subject to the same fair information practices as are required by the Act for all other personal information. As a rule, individuals are able to decide for themselves with whom they will share personal information and under what circumstances. However, some personal information enters into the public sphere through a variety of channels, often without the knowledge or consent of the individual. Examples include personal information that appears in telephone or other directories, public registries maintained by governments, public court records or that is published in the media. This personal information is made public for a specific and primary purpose, e.g., individuals allow their name, address and telephone number to appear in the telephone or other directories to enable others to contact them for personal reasons, to enable potential clients to reach them in their professional capacity or to enable others to verify their title, membership or professional qualifications. Some government registries such as land titles, personal property, municipal property tax rolls, are open to the public to promote longstanding public policy purposes. Public access is permitted to some court records to facilitate transparency in the justice system, while other personal information is placed in publications to publicize specific information about the individual (e.g., birth and marriage announcements).

Privacy concerns arise because more information is sometimes collected in public registries (many of which were created in an era when privacy concerns were not fully considered) than is required for the fulfilment of the primary purpose. Other concerns relate to the manner in which the information is made publicly available, e.g., whether there are any controls or limitations placed on who may collect and use it and how (increasingly access is possible to an electronic record rather than to the traditional hard copy. Internet access is more common as well.). The fact that individuals have continuing expectations of privacy for some publicly available personal information is seldom addressed. Another privacy issue is the growing use that commercial organizations make of this information for purposes that often have nothing to do with the primary purpose for which the information was made public, i.e., to contact individuals and offer them products or services. There is also an increasing tendency to collect and use publicly available information to create comprehensive personal profiles of the individual, including their consumption habits, lifestyles and personal histories for a variety of other purposes, including employment decisions. Many, if not most, of these secondary uses are presently carried out without the knowledge or consent of the individual. A final issue is that, with few rules to govern publicly available personal information, organizations have little incentive to consider obtaining consent from the individual.

The Regulation will permit one exception from fair information practices by allowing commercial organizations to collect, use and disclose certain personal information without consent. The Regulation is based on a recognition that some personal information is publicly available for a legitimate primary purpose, often with the individual's tacit agreement (e.g., the telephone directory, announcements). In these circumstances, it is reasonable to allow organizations to collect, use and disclose this information without adding the requirement to obtain consent. To require an organization to obtain consent to use this information for its primary purpose would not contribute to the protection of the individual's privacy, would add to the organization's costs and could frustrate some public policy purpose. However, it is also reasonable to insist that any purpose other than the primary one should be subject to the consent requirement. This approach is consistent with Principle 2 of Schedule 1 of the Act (clause 4.2.4) which states that a new purpose requires consent unless required by law. Using the criteria of consistency with the primary purpose or tacit consent as the basis for the Regulation of publicly available personal information strikes the appropriate balance between the individual's right of privacy and the business need for information. Organizations will remain responsible for compliance with all other requirements of the Act for this information, including the appropriate purpose requirement in subsection 5(3) and will be subject to oversight by the Privacy Commissioner of Canada and the ability of individuals to seek redress in the Federal Court of Canada.

Part 1 of the Act will be implemented in two stages. On January 1, 2001, it will apply to the personal information of the customers and employees of the federally regulated private sector, including telephone and transportation companies, broadcasters, and banks. It will also apply to organizations that sell personal information across provincial borders, e.g., companies selling or renting mailing lists. On January 1, 2004, the Act will apply to all personal information collected, used or disclosed in the course of commercial activity. Due to the phased introduction of the legislation and the fact that it is new to the private sector, it is expected that additions or amendments to the Regulation may be necessary. For this reason, the Department will continue to consider suggestions on a case by case basis in the future.

Alternatives

The legislative framework in Part 1 of the Act requires that publicly available information be specified in the Regulations. There are no alternatives to deal with the collection, use and disclosure of this information without consent.

Benefits and Costs

Benefits

The total growth of electronic commerce on the Internet is expected to increase from $195 billion (Cdn) in 1999 to $2.8 trillion (Cdn) in 2003. By developing the proper framework, Canada could capture a market share of $94 billion (Cdn) in 2003, leading to new business opportunities and job creation to the benefit of all Canadians. By enacting the Personal Information Protection and Electronic Documents Act and this Regulation, the government is putting in place one of the essential foundations of electronic commerce which will promote its acceptance and growth. The effect of the Act and Regulation will be to build trust in electronic commerce by providing individuals with assurance of protection for their personal information. The Regulation will also create a level playing field for business with clear, predictable rules for all. It will work to encourage on-line connectedness of Canadians — to each other, to business and to the federal government. Consumers and business will be able to conduct their on-line transactions with the confidence that privacy protection measures are in place and that they will be overseen by the Privacy Commissioner.

The legislation and Regulation have been designed to be light and flexible for businesses to implement. Its principles are taken from the CSA International's Model Code for the Protection of Personal Information, developed and recognized by both businesses and consumers as a standard for privacy protection. Organizations will incur some implementation costs but the benefits of increased sales through the growth of electronic commerce transactions will more than compensate.

The Regulation will have no impact on Department resources.

Consultation

Consultations leading to this legislation began in October 1994 with the establishment of the Information Highway Advisory Council, which released a discussion paper entitled "Privacy and the Canadian Information Highway". In 1998 the government issued a discussion paper entitled "The Protection of Personal Information: Building Canada's Information Economy and Society". Bill C-54 (the precursor to Bill C-6) was introduced on October 1, 1998 and received extensive hearings before the Standing Committee on Industry. The bill was subsequently re-introduced as Bill C-6 and received extensive public hearings before the Standing Senate Committee on Social Affairs, Science and Technology.

Subsequent to the Bill's receiving Royal Assent on April 13, 2000, Industry Canada had discussions with interested parties, including representatives of the insurance, credit reporting, telephone, banking, information technology, direct marketing, real estate, cable television, retail sale, as well as private investigators, internet service providers, the Canadian Chamber of Commerce and other business associations. Consumer and privacy organizations, the provincial and territorial privacy commissioners, the members of the Federal-Provincial-Territorial discussion group on privacy legislation and the Treasury Board of Canada were included in these discussions. Consultations were also undertaken with the federal Privacy Commissioner.

Following the publication of the draft Regulation in the Canada Gazette, Part I, the following comments were received (they are grouped according to the five categories of information listed in the Regulation).

Telephone Directories

One association pointed out that the exception for the telephone directory is based on the individual's ability to refuse to appear in the directory but that the refusal can only be exercised by paying for an unlisted number (this is a condition set by several of the telephone companies). They argued that this fee was an economic barrier to lower income people who may not wish to be listed but who cannot afford to exercise their right to refuse and suggested adding "without incurring any cost for such refusal". While this point may have validity from an access to services perspective, the use of fees is not specifically a protection of privacy issue.

An organization questioned whether the term "telephone directory" included information from Directory Assistance or from online telephone directories that also provide the individual with a right of refusal to appear in the directory. The intention is to include such directories in the Regulation.

Two organizations suggested adding e-mail and fax numbers to the list of permitted data elements in the Regulation. These items cannot be added because they do not appear in the white page telephone directories. An organization suggested that a telephone directory should include "internet directories" and questioned how organizations would verify that secondary directories contained only individuals who have had the opportunity to refuse to be listed. The Regulation defines "directory" in terms of a list of subscribers. Other directories, including those published on the internet, would only qualify for the exemption if they are based on a telephone subscriber directory.

Two organizations opposed the absence of a purpose limitation for telephone directories. The decision not to place a purpose limitation on the telephone directory is based on a recognition that some personal information (e.g., the telephone directory) is publicly available with the individual's tacit agreement for the purpose of enabling others to contact the individual.

A province suggested adding a second ability to opt-out of the use of telephone directory information for secondary purposes by third parties. The second opt-out is impractical in this instance, however, since it would be impossible for secondary publishers or third party users of the directory to know whether or not the individual had exercised the second opt-out.

Professional or Business Directory

An organization suggested that the category of "professional and business directory" should include "listing or notice" and should include among the permitted data elements "qualifications or certifications". Consistent with this argument, changes to the wording of the Regulation now make it clear that listings and notices are included under the category of professional or business directory. As regards the permitted data elements, the term "including" was deliberately used to ensure that items such as "qualifications or certifications" would be captured.

Two organizations raised the issue of whether "professional/business information" about an individual should be considered as personal information and noted that employee information is excluded from the definition of personal information. Employee information was excluded from the definition so as not to hamper routine data gathering (employee nominative data is necessary for day to day commerce). Distinguishing between an individual's professional or business information and their personal information is more difficult and raises policy issues. Any change to the definition of personal information will require an amendment to the Act.

An organization noted that the purpose of many professional and business directories is not explicitly stated and wondered how organizations will be able to verify the purpose when collecting the information. They suggested that, when no purpose is stated, the organization should be allowed to make a reasonable assumption about the purpose. Organizations can do so by referring to the appropriate purpose test in subsection 5(3) of the Act.

An association expressed concern that the term "including" would allow other unspecified data elements to be used without consent, that no consent is required for subsequent uses, that "professional or business directory" is not defined and could be considered to include electronic data bases which allow searches on many fields. On these points, the wording was deliberately chosen so as not to omit some of the information that might be found in a particular directory and because many professional directories require individuals to be listed. As regards the format of the directory, the use of the information is controlled via the reference to purpose and the format is thus irrelevant. The association also suggested that the purpose for "appearing" in the directory and the purpose of the original "collection" could be defined differently by publishers who could then offer the information to organizations for secondary purposes simply by stating that these secondary purposes were the reason why the information appeared in their directory. Such a scenario should not occur since the original purpose for appearing in the directory, which allows for collection, use and disclosure of the information without consent under the Regulation, carries forward to the secondary publishers who are bound by it. Individuals listed in the directory are also in a position to influence the original purpose for appearing in a professional directory because they are members of the professional association that publishes it. A similar restriction to original purpose applies to a business directory derived from a public registry (e.g., directors of corporations listed under securities disclosure legislation). In addition, all purposes remain subject to the appropriate purposes test set out in subsection 5(3) of the Act, and a secondary purpose could be challenged by an individual on that basis.

Two associations suggested that Industry Canada publish guidelines to clarify what purposes are considered to qualify for exemption and explicitly state that marketing is not related directly to the purpose of professional directories. The intention of the Regulation, however, is not to define the purpose for making information publicly available - this is the responsibility of the associations that maintain them.

Public Registries

Several commentators, including a province, suggested substituting phrases such as "permitted or authorized" in place of "required by law". In order to better reflect the actual wording of many of the statutes which create public registries, a change has been made to substitute "authorized" for "required by law". The new wording better corresponds with the statutory language of public registries, thereby ensuring consistency with the Regulation. A province also suggested substituting the phrase "in accordance with a program conducted under a statutory mandate" for "under a statutory authority". The change is viewed as unnecessary since the latter phrase includes public registries that are indirectly created by statute as programs.

A province raised the issue of providing guidance to organizations as to how to ascertain the purpose of placing information in a public registry and suggested adding "as recognized in policies, agreements, or other publicly stated mechanisms" to the phrase "relate directly to the purpose for which the information appears in the registry". Industry Canada considers this to be a legitimate point and offers the following suggestions to assist organizations in making this determination. In the first instance, the statute may state the purpose explicitly, or implicitly in its language. Alternatively, the custodian may define the purpose by a policy statement, by the terms and conditions of collection, use and disclosure set out by the custodian in contract, regulation, etc. The purpose may also be found in a description contained in publications required under freedom of information legislation which identify all government information holdings.

A number of commentators suggested substituting phrases such as "consistent with", "not incompatible with", "related to", "relate to the purpose or purposes or for a consistent purpose" for "relate directly" arguing that the latter may be interpreted too narrowly. One organization suggested substituting the expression "directly related to the purpose" with "consistent purpose" defined as a use or disclosure that the individual to whom it relates might reasonably expect. In comparison to the alternatives suggested, "directly related to the purpose" appears to provide the clearest wording to use as the test for secondary purposes. Moreover, the addition of "reasonably expect" is unnecessary as the Act already contains such a qualification in subsection 5(3).

Several commentators suggested that "purpose" should be changed to "purposes" to reflect the fact that there may be more than one purpose for making the information public. The term "purpose" includes the plural for the purposes of interpretation.

One organization questioned whether "public registry" included electronic databases. That is the intention.

One organization suggested that the proposed wording distinguishes between public access to information about an individual and public access to the entire registry and argued that the Regulation would only allow access to a particular individual's information, but would not allow bulk access to the information of all individuals in the registry. The correct interpretation of the Regulation would allow bulk access without consent provided it relates to the purpose or purposes for which the information appears in the registry.

An organization suggested Industry Canada issue guidelines concerning what are the permitted and proscribed uses of specific databases. The intention of the Regulation, however, is not to define the purpose for making information publicly available — this is the responsibility of the governments or authorities that maintain them.

Court Records

Several organizations questioned whether "court record" included the records of boards of inquiries, tribunals, and the disciplinary hearings of professional bodies. The expression "court record" has been replaced with the expression "record or documents of a judicial or quasi-judicial body" to clarify that the public records of such bodies are included for the purposes of the Regulation.

A province suggested adding "or court record data base as recognized in policies, agreements, or other publicly stated mechanisms" to the phrase "relate directly to the purpose for which the information appears in the registry" in order to provide guidance to organizations as to how to ascertain the purpose for which a record or document of a judicial or quasi-judicial body are made publicly available. It will be possible to ascertain the purpose from any specific statements by the court concerning public access to the records of the matter or which derive from the general purpose of promoting transparency and the perception of fairness in the justice system. In addition, an organization can refer to the appropriate purposes test set out in subsection 5(3) of the Act and decide whether its purpose meets that test.

One commentator suggested that the Regulation will limit access to court information but this should not occur since access without consent for the primary purpose is allowed. Another commentator suggested removing the purpose limitation from court records since there is no clear statement of the purpose for which court records are made publicly available. A third commentator suggested removing the reference to "court records" entirely since the restriction via purpose is too broad and will not be strong enough to limit secondary uses, especially as more court records are made available in electronic form. It is consistent with the Act and important to include a reference to "court records" in the Regulation. Failing to do so would leave organizations fully subject to the requirement to obtain the individual's consent for any collection use or disclosure of personal information in a court record or document, which could limit access to such records. The suggestion to waive any restriction on the commercial use of personal information in court records was supported by a commentator who applauded the effort to bring privacy considerations into a court's decisions as to what information to make publicly available. The approach taken in the regulation may encourage the courts or other authorities to take into consideration privacy concerns in making decisions about the extent of public access to particular court records (especially those to which internet access is available). In addition, an organization can refer to the appropriate purposes test set out in subsection 5(3) of the Act and decide whether its purpose meets that test.

One commentator suggested adding a sixth category of information to the Regulation — "where the court or tribunal allows the decision, judgment, or order to be made publicly available" in order to allow lawyers and publishers to make full use of precedents. The current wording of the Regulation allows this activity to occur.

Publications

Several organizations questioned why the examples of publications "a magazine, book, or newspaper" were drawn from traditional rather than electronic media and whether "publication" included internet media. To clarify this point, the words "in printed or electronic form" have been added to the term "publication".

A number of commentators stated that it may be difficult to determine from the context whether the individual has provided information to a publication. Suggestions to remedy this difficulty included giving a broad interpretation which would include, e.g., a speech, changing "where the individual has provided the information" to "where it is reasonable to infer that the individual has provided the information". This change is unnecessary since the inference can be made by appealing to the appropriate purpose test in subsection 5(3) of the Act. Questions were also raised about how an organization could be sure that the individual had provided the information for obituaries, birth and surprise party announcements. Organizations should be able to infer from the context of most announcements and notices whether or not the individual in fact provided the information. If an organization is in doubt, it should not collect the information without consent.

One organization suggested the Regulation is too restrictive and may interfere with freedom of expression, e.g., clipping services, indexes. However, these activities fall under the journalistic exclusion in the Act.

General Comments

One organization suggested adding a new category of "all publicly available information where disclosure is made to any organization for journalistic, artistic or literary purposes" to ensure that organizations are not restricted in their collections for journalistic purposes. This change is unnecessary since any collection for such purposes is excluded from the scope of the Act via paragraph 4(2)(c).

An association suggested adding "primary" to the reference to purpose in all categories except telephone directories. The change is viewed as unnecessary since this point is expressed by the language in the Regulation, i.e., "for which the information appears".

One province objected to the application of the legislation to provincially regulated organizations, and to the restrictions imposed on publicly available information by the Regulation. The Regulation is consistent with the purpose of the Act which relates to the collection, use and disclosure of personal information in the course of commercial activity.

Compliance and Enforcement

Individuals may make complaints about the practices of an organization to the Privacy Commissioner of Canada who will investigate the matter and deliver a report to the parties. The Commissioner may make recommendations to an organization concerning its practices and whether they are considered to comply with Part 1 of the Act but the Commissioner does not have the power to issue binding orders on the organization. The individual or the Privacy Commissioner, or both acting together, may take unresolved complaints to the Federal Court of Canada which has the power to order an organization to change a practice and to pay damages to the individual.

Contact

Mr. Richard Simpson
Director General
Electronic Commerce Branch
Industry Canada
300 Slater Street
Room D2090
Ottawa, Ontario
K1A 0C8
Tel.: (613) 990-4292
FAX: (613) 941-0178
E-mail: simpson.richard@ic.gc.ca

Footnote a

S.C. 2000, c. 5