| |||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||
 |
| ||||||||||||||||||||||||||||||||||||
 |
|||||||||||||||||||||||||||||||||||||
|
Vol. 138, No. 8 — April 21, 2004 Registration PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT Regulations Amending the Regulations Specifying Investigative BodiesP.C. 2004-327 30 March, 2004 Her Excellency the Governor General in Council, on the recommendation of the Minister of Industry, pursuant to paragraph 26(1)(a.01) of the Personal Information Protection and Electronic Documents Act (see footnote a), hereby makes the annexed Regulations Amending the Regulations Specifying Investigative Bodies. REGULATIONS AMENDING THE REGULATIONS SPECIFYING INVESTIGATIVE BODIES AMENDMENT 1. Section 1 of the Regulations Specifying Investigative Bodies (see footnote 1) is amended by striking out the word "and" at the end of paragraph (a) and by adding the following after paragraph (b): (c) the College of Audiologists and Speech-Language Pathologists of Ontario; (d) the College of Chiropodists of Ontario; (e) the College of Chiropractors of Ontario; (f) the College of Dental Hygienists of Ontario; (g) the College of Dental Technologists of Ontario; (h) the College of Denturists of Ontario; (i) the College of Dietitians of Ontario; (j) the College of Massage Therapists of Ontario; (k) the College of Medical Laboratory Technologists of Ontario; (l) the College of Medical Radiation Technologists of Ontario; (m) the College of Midwives of Ontario; (n) the College of Nurses of Ontario; (o) the College of Occupational Therapists of Ontario; (p) the College of Opticians of Ontario; (q) the College of Optometrists of Ontario; (r) the Ontario College of Pharmacists; (s) the College of Physicians and Surgeons of Ontario; (t) the College of Physiotherapists of Ontario; (u) the College of Psychologists of Ontario; (v) the College of Respiratory Therapists of Ontario; (w) a corporation or other body
(ii) that is a member in good standing of a professional association that represents the interests of private investigators or detectives and that has such a privacy code; (x) a corporation or other body
(ii) that is a member in good standing of a professional association that represents the interests of insurance or claims adjusters and that has such a privacy code; (y) the Certified General Accountants Association of Alberta; (z) the Certified General Accountants Association of British Columbia; (z.1) the Certified General Accountants Association of Manitoba; (z.2) the Certified General Accountants Association of New Brunswick; (z.3) the Certified General Accountants Association of Nova Scotia; (z.4) the Certified General Accountants Association of Newfoundland and Labrador; (z.5) the Certified General Accountants Association of Ontario; (z.6) the Certified General Accountants Association of Prince Edward Island; (z.7) the Certified General Accountants Association of Saskatchewan; (z.8) the Certified General Accountants Association of Northwest Territories-Nunavut; (z.9) the Certified General Accountants Association of Yukon; (z.10) the Credit Union Office of Crime Prevention and Investigation of the Credit Union Central of Canada; (z.11) the Law Society of Alberta; (z.12) the Law Society of Manitoba; (z.13) the Law Society of the Northwest Territories; (z.14) the Law Society of New Brunswick; (z.15) the Law Society of Newfoundland; (z.16) the Law Society of Saskatchewan; (z.17) the Law Society of Upper Canada; (z.18) the Law Society of Yukon; (z.19) l'Ordre des comptables généraux licenciés du Québec; (z.20) the Nova Scotia Barristers' Society; (z.21) the Ontario College of Social Workers and Social Service Workers; and (z.22) the Royal College of Dental Surgeons of Ontario. COMING INTO FORCE 2. These Regulations come into force on the day on which they are registered. REGULATORY IMPACT (This statement is not part of the Regulations.) Description Part 1 of the Personal Information Protection and Electronic Documents Act establishes rules to govern the collection, use and disclosure of personal information by organizations in the course of commercial activity. The legislation requires an organization, which is disclosing personal information, to obtain the individual's consent in most circumstances. An exception to this rule is found in paragraphs 7(3)(d) and (h.2) of Part I of the Act which permit the disclosure of personal information to and by a private investigative body, without the knowledge or consent of the individual, if the investigative body is specified by the Regulations. The purpose of this amendment to the Regulation is to name additional investigative bodies for the purposes of paragraph 7(3)(d) or (h.2) of Part I of the Act. Many investigations into frauds and breaches of agreement are conducted by private sector organizations, either acting as or making use of independent, non-governmental investigative bodies. Should the investigation reveal grounds for suspecting that a fraud has been committed or a law contravened, the organization may then turn the findings over to a police or other law enforcement agency for further action or (as in the case of professional regulatory bodies such as the Law Societies and the Colleges) may take appropriate disciplinary action pursuant to its own statutory authority. Paragraph 7(3)(d) allows an organization to disclose personal information, without the consent of the individual, to a private investigative body in order to instigate or facilitate an investigation. Paragraph 7(3)(h.2) allows an investigative body to disclose personal information to another private organization, including the client organization on whose behalf it is conducting the investigation. The disclosures are circumscribed as they must be related to investigations of a breach of an agreement or a contravention of the law and be reasonable. Paragraph 7(3)(h.2) completes the exception provided in paragraph 7(1)(b) for collection without consent for the purposes of the prevention of fraud by extending it to disclosure. Collection alone would be of limited use to those combatting fraud and other breaches of agreement, unless the information could be disclosed to the parties that need the information. However, without paragraph 7(3)(h.2), the flow of information could only go in one direction — from the organization to the investigative body. The investigative body would be unable to disclose the results of its investigation back to its client or other interested parties without consent. The ability to exchange personal information without consent for investigative purposes between or among private organizations is the only exception granted to these organizations by the Regulation. Organizations and investigative bodies which exchange personal information will remain responsible for compliance with all other requirements of the Act for this information, and will be subject to oversight by the Privacy Commissioner of Canada and the ability of individuals to seek redress in the Federal Court of Canada. More particularly, the general requirement that the Act imposes on all organizations to obtain consent before disclosing personal information is not altered by virtue of granting an organization status as an investigative body. Organizations with investigative body status would be able to disclose personal information in their investigations without the consent of the individual only in those exceptional circumstances in which obtaining consent is impossible, impractical or undesirable because it would frustrate the conduct of the investigation. During the initial preparation of these Regulations, Industry Canada developed a set of criteria that would be used in the assessment of candidates for investigative bodies. These criteria were intended to cover privacy concerns associated with allowing organizations to disclose personal information without consent for investigative purposes. All of the criteria would not necessarily be applicable to each investigative body. The criteria include: the specific contraventions of law or breaches of agreements against which the investigative activities are directed; the specific personal data elements which are disclosed by other organizations to the body; the specific personal data elements which flow back to the organizations from the body; the uses and disclosures made of the information by the body; whether audit trails are maintained; the length of time the information is kept; the security standards and practices in place for retention and disposal of the information; whether the operational structure of the body or process is fully documented and formalized and the authority, responsibility and accountability centres are identified; whether there are specific legal regime, licensing requirement, regulation or oversight mechanisms to which it is it subject and whether sanctions or penalties for non-compliance exist; the privacy protection policies and procedures, such as a privacy code, followed by the body. The extent to which the policies and procedures comply with Part I of the Act; the extent to which the investigative body is independent from the association of members or client organizations that it serves; the extent to which all alternative methods of complying with the Act, such as contract or consent, have been exhausted; the amount of information provided to individuals about the existence and operation of the body and about how to make a complaint or seek redress. Part I of the Act was implemented in two stages. On January 1, 2001, it applied to the personal information of the customers and employees of the federally regulated private sector, including telephone and transportation companies, broadcasters, and banks. It also applied to organizations that sell personal information across provincial borders, e.g., companies selling or renting mailing lists. On January 1, 2004, the Act applied to all personal information collected, used or disclosed in the course of commercial activity. Due to the phased introduction of the legislation and the fact that it is new to the private sector, it was expected that additions to the list of investigative bodies in the Regulation would be necessary. For this reason, the Department has indicated that it would continue to consider applications on a case-by-case basis in the future. The Department would also like to underline the fact that the behavior of organizations receiving investigative body status will continue to be monitored by Industry Canada once the designation has been given. Should concerns be raised regarding the compliance of an investigative body with all of the requirements of PIPEDA, e.g., through findings issued by the Privacy Commissioner of Canada, then the investigative body designation will be withdrawn by an amendment to the regulation. Industry Canada has now completed its review of new applications from two different sorts of organizations. The first group of applicants are various professional regulatory bodies with a statutory authority to investigate professional misconduct on the part of their members. These include the Law Societies, the health Colleges, the College of Social Workers and Social Service Workers as well as the provincial disciplinary bodies of the Certified General Accountants of Canada. The second group includes various private sector organizations that conduct investigations into fraud and breaches of agreement. These include Teranet Services Inc., the Credit Union Office of Crime Prevention and Investigation, Certified General Accountants, private investigators, and independent insurance adjusters. On the basis of the documentation submitted, describing their operation and investigative activities, Industry Canada has concluded that the Regulation should be amended by adding the organizations listed. Copies of their submissions may be obtained by contacting Industry Canada or by visiting the Electronic Commerce web site http://strategis.gc.ca/privacy. Alternatives The legislative framework in Part I of the Act requires that an investigative body, for the purposes of paragraph 7(3)(d) or (h.2) of the Act, be specified by the Regulations. There are no alternatives to deal with the collection, use and disclosure of this information without consent. Benefits and Costs According to industry estimates, property related fraud cost the associated Canadian financial services industry upwards of $300 million in 2001, credit card fraud cost Canadian issuers of major credit cards $230 million in 2001, while insurance fraud cost the property and casualty insurance industry $1.3 billion annually. The costs of fraud are paid for by the public through increased premiums and the personal inconvenience caused by identity theft and the correction of credit rating errors. The Regulation will benefit the public by assisting organizations in combatting fraud as well as by providing a mandated standard of protection for the personal information that is obtained by the organizations engaged in private investigations. The professional disciplinary bodies, such as the Law Societies and Colleges, investigate the conduct of their members to prevent incompetent, unethical and unauthorized practices which is to the general benefit of all persons who make use of their professional services. Costs The Regulation should not impose significant additional costs on the organizations to which it applies as it merely permits the continuation of existing information sharing relationships between organizations and the specified investigative bodies. The Regulation will have no impact on Department resources. Consultation The public comments received following the pre-publication of the Regulation in the Canada Gazette in 2000 gave broad support for the goal of facilitating the ability of the private sector to combat fraud by specifying certain organizations as investigative bodies. Following the listing of the Insurance Crime Prevention Bureau and the Bank Crime Prevention and Investigation Office of the Canadian Bankers Association, Industry Canada has not received any complaints or expressions of concern regarding the operation of these organizations or of the Regulations themselves. Subsequent to the coming into force of the Act on January 1, 2001, Industry Canada has engaged in extensive discussions with the applicants concerning their investigative activities and the need for an amendment to the Regulation to add them to the list of investigative bodies. Consultations with the Office of the Privacy Commissioner have also taken place. To facilitate public comments concerning the proposed amendment to the Regulation, Industry Canada notified the privacy advocacy community and interested privacy organizations in advance of pre-publication in the Canada Gazette. Information was also made available on the Industry Canada web site (http://e-com.ic.gc.ca/ english/privacy/index.html). Following the pre-notification and subsequent publication of the Regulation in Part I of the Canada Gazette, a total of thirty-nine comments were received. Most addressed the applications on behalf of private investigators and independent insurance adjusters. Single comments were received addressing the applications on behalf of the Law Society of Upper Canada, the College of Physicians and Surgeons of Ontario, and Teranet Services Inc. The Office of the Privacy Commissioner of Canada submitted a commentary that addressed each of the applications. With the exception of Teranet Services Inc. all of the applications for investigative body status were supported and no major concerns were raised. The Office of the Privacy Commissioner made three general observations regarding the naming of investigative bodies. The first was that, because they are allowed to collect, use and disclose personal information without consent in certain circumstances (contrary to the general regime of the Act), great care should be taken in naming additional investigative bodies. The second was that granting investigative body status to an organization when only some of its work is 'investigative' in nature raises concerns about misuse of the authority. Finally, the Office expressed concern that granting investigative body status to a large number of small (or even single person) organizations raises concerns about effective oversight. Industry Canada fully agrees with these observations and will take them into consideration in reviewing future applications for investigative body status. The Office of the Privacy Commissioner reviewed each of the applications. As regards the professional regulatory bodies, the Office observed that all have legislated mandates with clearly defined powers, well-established investigative processes and powers to impose sanctions for non compliance, and all are required to act in the public interest. For these reasons, it had no serious reservations about adding these bodies to the Regulations. Turning to the second group of applicants, the various private sector organizations that conduct investigations into fraud and breaches of agreement, the Office made the following observations. The Credit Union Central of Canada is similar to the Bank Crime Prevention Office and exists solely to do investigations. The Office had no objections to the application. The Canadian Independent Insurance Adjusters consists of a large number of small firms and individuals and much of the work is not investigative, but routine claims processing. Nonetheless, on balance the Office was prepared to accept the application. The private investigator industry consists of a large number of small firms and individuals. However, a large proportion of their work is investigations and it is not always possible for investigators to obtain consent from the persons whose information they are collecting, using and disclosing. On balance, the Office was prepared to accept the application. In reviewing the Teranet Services Inc. application, the Office noted that Teranet does not do investigations per se, but rather maintains a database of information on fraudulent or suspicious real estate transactions and the individuals involved in the transactions. It expressed concern that approval would seem to open the door to other industry databases containing similar personal information. The Office concluded that Teranet Services Inc. had not demonstrated that designation was necessary. Comments regarding Teranet Services Inc. were also received from the Canadian Internet Policy and Public Interest Clinic. The Clinic questioned how the disclosures contemplated by Teranet to its subscribers could be considered reasonable for purposes related to investigating a breach of an agreement when the disclosures are intended to warn subscribers of alleged previous breaches by individuals and organizations. The purpose of the disclosure is to provide the subscriber with information upon which to decide whether or not to do business with the reported individual or organization. The Clinic also noted that the disclosure is automatic for subscribers and is done without reference to any reasonableness test. They concluded that Teranet's proposed disclosures fail to satisfy the plain wording of paragraphs 7(3)(d) and (h.2) of the Act. Accordingly, Industry Canada will not be proceeding with the designation of Teranet Services Inc., at this time. Teranet could, in future, submit a revised application to address the concerns that were raised with respect to its current submission. In reviewing the application of the Certified General Accountants, the Office of the Privacy Commissioner noted that it consisted of two parts. The first part sought to designate the various disciplinary bodies of the provincial CGA's and the second part sought to designate the certified general accountants who are also public practitioners, i.e., registered CGA's who offer their services directly to the public (representing approximately ten percent of the total number of CGA's). The Commissioner's Office had no reservations concerning the designation of the CGA's provincial disciplinary bodies. As regards the registered public practitioners, the Office noted that the number who would be specified as investigative bodies represented only about ten percent of the total number of CGA's. It also observed that public practitioners are required by the CGA to meet special standards of practice and that the option of obtaining consent was not available for many of the investigations that public practitioners undertake. The Office concluded that there was adequate justification for designating all registered public practitioners as investigative bodies. Compliance and Enforcement Individuals may make complaints about the practices of an organization to the Privacy Commissioner of Canada who will investigate the matter and deliver a report to the parties. The Commissioner may make recommendations to an organization concerning its practices and whether they are considered to comply with Part I of the Act but the Commissioner does not have the power to issue binding orders on the organization. The individual or the Privacy Commissioner, or both acting together, may take unresolved complaints to the Federal Court of Canada which has the power to order an organization to change a practice and to pay damages to the individual. Contact
Mr. Richard Simpson
S.C. 2000, c. 5 SOR/2001-6 |
||||||||||||||||||||||||
|
NOTICE:
|
|||||||||||||||||||||||||
