Now for the Flip Side

So a few weeks ago I posited in “Don’t Need It, Don’t Want It” that service providers should not be the sacrificial lamb regarding handling of personal information (“PI”), or personal health information (“PHI”), where the service provider does not need access to this type of information to provide the services. Now for the flip side.

If the services that a service provider is providing do in fact necessitate an entity entrusting this type of information to it, then the service provider does have to accept more stringent controls and security that are legislated in a number of jurisdictions – e.g. Personal Health Information Protection Act, 2004 (Ontario), Personal Information Protection and Electronic Documents Act (Canada) etc..

By way of examples: service providers to the health care industry who have to have access to the PHI in a client’s care should have in place, as a matter of course, use and security standards that meet regulatory requirements for the handling of PHI. Service providers to the financial services industry who have to have access to the PI in a client’s care should have in place, as a matter of course, use and security standards that meet regulatory requirements for the handling of PI. As part of their business model these standards should be “baked into” the services provider’s fees.

What becomes tricky is if a particular client stipulates a stricter standard than industry standards or regulatory requirements. In these instances the client needs to be prepared to lose some of the cost benefits of using the service provider’s standard services, and the service provider needs to evaluate the extra cost associated with it accommodating the special requirements. Both parties have to work together to address their respective concerns in these circumstances.

To quote the philosophical geniuses that are The Rolling Stones (Mick Jagger and Keith Richards),

“…You can’t always get what you want
But if try sometimes you just might find
You get what you need…”

Don’t Need It, Don’t Want It

I understand that enterprise - both private and public – has obligations with respect to the handling of personal information, including special standards for health care information.

But if a party advises that it does not need, nor does it want, access to such information in order to engage in business with the enterprise, then is it not incumbent upon the enterprise to ensure they don’t get give it?

Most entities have standard confidentiality and security practices – commercially available firewalls, virus protection etc. - that are suitable for their industry as a whole. It is not a viable business model to have to continually change these standards – different levels of encryption, special screening programs etc. - to comply with the differing requirements of each client. Unless of course the client is willing to pay all associated initial and ongoing costs for these measures.

I cannot see how an enterprise would be fulfilling its responsibilities with regard to the proper handling of personal information if all they do is insist that the other party agree to comply with its often amorphous standards of care regarding handling personal information, that the enterprise also reserves the right to change from time to time at its discretion.

I have been pleasantly surprised when enterprise has understood this. It agrees that it is not going to provide the personal information, but if it inadvertently does the other party’s obligation is to advise when they become aware of having received such information and to return and/or destroy it as soon as possible. This is a reasonable solution that both parties can live with.

Personal Information - Use with Caution

Databases are the backbone of twenty first century enterprise. Some well publicized gaffes and changes in policies on the part of Google and Facebook have generated a renewed interest in the fact that the social media and search engine industries have access to, and use, the significant amount of personal information about individuals that are in their databases. But let's not forget that banking, other financial services and large retail also have enormous databases of personal information.

This post is not going to debate the “goodness” or the “evilness” of this situation: the broader media are having a field day with that. I am going to set out a quick refresher about the basic situation governing the collection and use of personal information in Canada.

No private enterprise operating in Canada has free rein in its use of personal information. There are variations on a theme in the provincial legislation of Alberta, B.C. and Quebec and there are additional laws regarding health information in most of the provinces, but the basic tenets of privacy legislation affecting private enterprise in Canada are very simple. They are outlined in Schedule 1 to the Personal Information Protection and Electronic Documents Act [the legislation can be found at: http://laws.justice.gc.ca/eng/StatutesByTitle ]. I am summarizing the guiding principles below, but you should, at a minimum, actually read Schedule 1.

Organizations are accountable for the personal information that they have in their possession or within their control. They have to have policies, procedures, guidelines and training regarding the handling of personal information. An organization must inform the public about these policies, procedures and guidelines. It must provide access to the personal information within its possession or control regarding an individual to that individual. The organization must have a complaints procedure (more details below) to handle individuals’ concerns with respect to their personal information.

With limited exceptions, companies have to have the individual’s consent to collect and use personal information. The consent has to be for the specific use for which the information is being collected. An organization cannot use the personal information it collects for a specific purpose for another purpose unless it obtains consent for that other purpose.

The personal information collected has to be accurate, complete, safeguarded and retained only for the period of time necessary to fulfill the purpose for which it was collected. When it is no longer required for the purposes for which it was collected, it must be destroyed or made anonymous.

Individuals have the right to find out what personal information an organization has about them and who has access to it. Individuals may request access to their own personal information held or controlled by an organization, and are entitled to require that any corrections be made to the information to the extent it contains any inaccuracies or is incomplete.

To the extent individuals believe their information is being misused or that their access is being improperly denied, they can utilize the organization’s complaints procedure, which procedure must note how the individual can make a complaint to the Privacy Commissioner of Canada.

Seems pretty simple, doesn’t it?

However when you introduce the Internet into the equation, with its ability to proliferate and disseminate information globally and exponentially, complicated issues emerge.

If I terminate a social media service, how am I assured that they do eradicate the personal information that I no longer consent be made available? Why when I want access to a specific service such a cell phone service do I have to consent to them sharing information with their affiliates? What happens if there is a breach in the safeguards exposing my personal information? This is what businesses and privacy watchdogs are struggling with now in real time.

Privacy laws are constantly being tweaked to address recurring issues: e.g. mandating certain notifications in the event of actual and potential exposure of personal information; requiring companies to advise persons if their information is going to be transferred outside of Canada (May 1, 2010 Personal Information Protection Act (Alberta)).

So, with the current attention on the problems associated with data breaches you want to minimize the bad publicity that ensues. If you operate a business in Canada understand what your current obligations are, keep up with the legal developments and review and revise your use and handling of personal information policies and procedures on a regular basis.