European Commission Recognizes Canadian Legislated Privacy Protection

OTTAWA, January 14, 2002 — The Honourable Brian Tobin, Minister of Industry, and the Honourable Pierre Pettigrew, Minister of International Trade, today announced that the European Commission has ruled that Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) meets the rigorous standards for the protection of personal data as outlined in the European Union's Data Protection Directive. This unanimous decision by the European Parliament and the Commission allows for the continued flow of personal information between the European Union (EU) and Canada.

“Canada and the European Union have been working closely together to foster the growth of global electronic commerce,” said Minister Tobin. “Our similar approach in protecting personal data has established a high degree of mutual confidence in our respective regimes and provides a strong basis for the future growth of electronic commerce conducted by both Canadian and European businesses.”

“We welcome this development,” said Minister Pettigrew. “Canada is the first non-European country to be recognized as providing legislated privacy protection that meets the rigorous standards of the EU Directive.”

In 1995, the EU passed a Data Protection Directive aimed at protecting personal information and harmonizing privacy laws among its member states. Under this directive, all member states must adopt privacy legislation or revise existing laws. The directive also establishes rules to ensure that personal data may be transferred only to those countries outside the EU that provide an equivalent level of protection.

The privacy provisions of Canada's PIPEDA, which came into force on January 1, 2001, set out rules for the protection of personal information collected, used or disclosed in the course of commercial activity. The Act's provisions will be phased in, and by January 2004, they will cover all personal information that enters the commercial sphere in all sectors of the economy.

The EU decision fulfills a 1999 commitment made by Canada and the EU in their Joint Statement on Electronic Commerce in the Global Information Society. Both parties agreed to work together to build trust and confidence in the electronic marketplace, including support for high standards of personal data protection.

For more information, please contact:

Heidi Bonnell
Director of Communications
Office of the Minister of Industry
(613) 995-9001

Sébastien Théberge
Press Secretary
Office of the Minister of International Trade
(613) 992-7332

Backgrounder

• Canada hosted the Organization for Economic Cooperation and Development (OECD) Ministerial Conference on Electronic Commerce in October 1998 and has led international efforts to develop policies to promote the growth of global electronic commerce.



• In 1999, Canada and the European Union (EU) signed a Joint Statement on Electronic Commerce in the Global Information Society that included the support and endorsement of a shared vision and policy principles for the global environment to facilitate the growth of electronic commerce. Both parties agreed to pursue bilateral and multilateral consultations. Moreover, Canada and the EU supported legislative approaches to protect privacy and personal information.



• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) is based on the Canadian Standards Association's Model Code for the Protection of Personal Information (CAN/CSA-Q830-96), a national standard that was developed in 1996 by consumer and business groups, privacy advocates and government representatives.



• Organizations covered by the PIPEDA are required to comply with a set of ten principles that outline their responsibilities with respect to the collection, use or disclosure of personal information in the course of commercial activity.



• The PIPEDA also provides for independent oversight and redress mechanisms through the Office of the Privacy Commissioner of Canada, and the Federal Court. The Privacy Commissioner acts as an ombudsman, aiming to resolve conflicts between individuals and organizations through dispute resolution mechanisms. The Federal Court can order an organization to change its practices and award damages to the aggrieved.



• The PIPEDA, which came into force on January 1, 2001, initially applies to the federally regulated private sector, such as transportation, telecommunications and banking, and to cross-border disclosures of personal information. These provisions became applicable to personal health information on January 1, 2002. In 2004, the Act will apply more broadly to all sectors of the economy. In provinces and territories where a privacy law is passed and is deemed substantially similar to the PIPEDA, organizations in the province will be exempt from the Act's provisions for transactions that take place within their borders.



• To be deemed substantially similar to the PIPEDA, provincial and territorial privacy laws must provide privacy protection similar to those in the Act, along with independent oversight and redress.