From: nobody@soda.berkeley.edu
Date: Wed, 9 Jun 93 15:35:01 PDT
To: cypherpunks@toad.com
Subject: Maclean's Article on privacy issues in Canada
Message-ID: <9306092231.AA21926@soda.berkeley.edu>
MIME-Version: 1.0
Content-Type: text/plain



Without permission from Maclean's magazine (April 26, 1993)

[Any errors are from my poor typing.  Some emphasis added to replace
italics in the original article.]


Business (page 20)

Preserving individual privacy
New technology has made trafficking in personal data a huge industry

Until Jan. 18, 1993, checking out licence plates was a $5-million-a-year
business for the Ontario ministry of transportation.  For a $5 fee, anyone
could walk into their regional vehichle licensing bureau, fill in an
application form and learn a wide range of details about a
vehicle--including the owner's name and home address.  According to ministry
spokesman Anne McLaughlin, most people conducted searches for legitimate
reasons:  they wanted to know the history of a used car they were thinking
about buying or they needed to track down a witness to an accident.  But
some searches clearly resulted in gross violations of privacy.  In November,
an Ottawa woman, who declined to be named, complained that a man found out
where she lived by tracking her licence plates and asked to take here out.
McLaughlin said that the ministry "was aware of a few of these situations"
and, as a result, stopped providing names and addresses to the general
public.  Now, she said, the ministry will only provide that personal
information for specific purposes, including court proceedings and police
investigations.

The collection, compilation and trafficking in personal data has become a
huge industry:  some privacy experts say that it is worth as much as $300
million a year in Canada.  It has grown, in part, because rapidly evolving
technologies, including telecommunications and computers, have simpily made
it easy to do.  Said Evan Hendricks, editor of "Privacy Times", a
Washington-based newsletter that tracks privacy issues worldwide:  "The
paper trail has become the electronic trail."  But as technology has become
more pervasive, so has the sense that it is increasingly difficult to ensure
that private matters remain private--as Premier Robert Bourassa's aides
discovered during the referendum intercept of cellulas calls and the chatty
Prince Charles and his lover Camilla Parker-Bowles now know.  As a result,
organizations ranging from the federal Office of the Privacy Commissioner to
the Canadian Standards Association (CSA) and the Quebec government are
taking a new look at the issue.

At the heart of the matter is a delicate balancing act:  the right of the
individual to privacy versus the legitimate needs of government or business
to gather information.  Privacy advocates express concern, however, that it
has become much too easy for organizations to gather, store, use and
manipulate data about an individual.  "The average Canadian's name is being
crunched through various computers five to 10 times a day," said Bruce
Phillips, the privacy commissioner of Canada and strong advocate of
restraint on snooping.

A joint study between several federal government departments and four
private-sector organizations indicates that many Canadians share Phillips
concern.  In Privacy Revealed, a survey of 3,000 Canadians released late
last month, 60 per cent daid that they have less personal privacy than they
did a decade ago.

Nevertheless, the trend towards collecting even greater amounts of data is
bound to continue.  The advertising and marketing industries are
increasingly using consumer-profile data.  Part of the reason is that
companies need better information on targeting the fickle markets for
consumer goods.  At the same time, there is an increasing fragmentation in
television.  In the age of the TV zapper and the proliferation of cable TV
channels, advertisers can no longer be certain that they are reaching their
target audience.  As a result, they are turning more often to other
alternatives, including data-based direct-mail campaigns.  To reduce the
cost of mailings, direct marketers attempt to reach customers who have
indicated an interest in a given area.  S.I.R. Mail Order, for one, a
Winnepeg-based firm specializing in hunting, fishing and camping equipment,
rents its customer lists to others who want to attract rural subscribers.

In December, Quebec became the first jurisdiction in North America to attemp
to regulate personal information in the hands of the private sector when
Communications Minister Lawrence Cannon introduced Bill 68.  Although the
federal government and most provinces have privacy acts, they apply only to
information in government records.  Still, many consumer advocates say that
Quebec's proposed legislation, which should be in force by the end of June,
does not go nearly far enough in protecting individual rights.  On the other
hand, some executives say that the bill places so many restrictions on how
companies may share information with third parties that the bill will add
greatly to the cost of gathering data.  Said Jean-Claude Chartrand, chairman
and chief executive officer of Montreal-based Equifax Canada Inc., the
nation's largest credit bureau:  "That will add to the cost of credit, which
in the final analysis will cost the consumer."

Several industry organizations in Canada have attempted on their own to deal
with privacy concerns.  The Canadian Bankers Association adopted a voluntary
privacy code in 1990 that spells out how banks should collect, store and use
customer information.  Since 1990, Canada's six major chartered banks have
inmplemented the code or devised their own.  Still, the Royal Bank of
Canada sparked controversy last month when it revealed that it sometimes
included client-card numbers along with names, ages and addresses among the
information sent to market-research firms that were testing demand for new
products.  Although a Royal Bank spokesman insisted that the practice was
not an invasion of privacy, the bank has since stopped releasing client-card
numbers for research purposes.

Another industry group that has passed its own privacy code is the
Toronto-based Canadian Direct Marketing Association.  Effective next
January, members must obtain a customer's permission before they sell or
trade any information about that customer to a third party.  Association
members must provide customers with an easy mechanism, such as a box to
check off on an order form, that allows them to remove their names from
marketing lists before those lists are transferred to other marketers.  Said
association president John Gustavson:  "This way, our customers can receive
information on the things they want and avoid the stuff they don't want."

On another front, the CSA, a Toronto-based nonprofit organization that has
traditionally restricted itself to the safety testing and certifing of
electrical appliances and other consumer products, is also turning its
attention to privacy issues.  In December, 1992, the CSA established a
committe that will try to establish a standard to recommend to companies
across Canada.  David McKendry, head of the consumer affairs consulting
practice with Price Waterhouse in Ottawa, is chairman of the committe, which
also includes members from government, the private sector and consumer
groups.  He said that privacy is a logical issue for the CSA to tackle.
"Safety is changing in the marketplace", McKendry said.  "Privacy *is* a
safety issue in the information age."

Many privacy advocates say that they welcome attempts by various sectors to
come to terms with privacy issues.  At the same time, however, they note
that Canadians still need more legal protection.  "I'm all in favor of
self-regulation," said David Flaherty, a Canadian professor of law and
history, currently on sabbatical, at the Woodrow Wilson International Centre
for Scholars in Washington.  "But it doesn't have the force of law."
Flaherty said that many Canadians are surprised to learn that they do not
have a constitutional right to privacy.  "The word 'privacy' is not in the
Charter of Rights and Freedoms," he said.

For his part, Privacy Commissioner Phillips, a former newspaper and
television reporter, said that he agrees with Flaherty that privacy should
be included in the Charter.  "It would be a benchmark for the entire
country," he said.  Many experts, however, maintain that Canadians have
adequate protection.  Simon Chester, a lawyer with the Toronto firm McMillan
Binch, said that there are better ways to protect individual's privacy than
spelling it out in the Charter.  The charter, which applies only to
government and not the private sector, is too blunt an instrument, Chester
said.  "It is much more important to have specific specific legislation," he
added.

Equifax's Chartrand said that, as a result, his credit bureau operates its
systems to meet the toughest standards in the country, which, he says, are
usually Ontario's laws.  That means, Chartrand said, that consumers across
Canada enjoy the same level of protection, even if they are in the two
provinces that have no consumer credit laws.  Clearly, however, Canadians
will continue to be concerned about whether technology has moved ahead
faster than the law's ability to protect their privacy.

Barbara Wickens