"What we are really dealing with," said Canadian Privacy Commissioner Bruce Phillips, "is the degree to which we ... offer to individuals at least a minimum of respect for our personal autonomy and our right to control what the world knows about us."
The Information Age puts state and local governments between the rock of public access and the hard place of personal privacy. Since 1991, Phillips has made the tough calls for Canada.
Phillips was interviewed by Government Technology Features Editor Brian Miller.
GT: Polls taken in this country and in Canada have indicated that a great many people are at least concerned about their privacy being violated. Where does this feeling come from?
Phillips: I think at the consumer level, people are beginning to understand that a great deal of their personal information is now being freely traded in the marketplace without their knowledge or consent. The enormous increase in the amount of unsolicited mail is the kind of consumer tip of the privacy iceberg that has alerted people to the fact that there is a great deal of information about them being moved around in the system that they don't know anything about. I think that people are concerned about losing control.
GT: Is this something people really need to be concerned with or is it an overreaction?
Phillips: I think the problem up to this point has been under-reaction. We're moving into an age in which personal information has itself become an important marketplace commodity. We need a stronger set of basic legal standards -- both in private and public sectors -- to get the public the kind of protection for their personal privacy for which they are entitled.
GT: What kind of legal standard do you think would best address this?
Phillips: Well, there already is one in place in many parts of the world. In New Zealand and Australia, and in most jurisdictions in Western Europe, there are strong privacy statutes which state as a basic principle that personal information about the people living in those countries can't be collected and used without their consent and knowledge.
That is essentially the missing ingredient in North America, except in those jurisdictions where there are some privacy laws. The Canadian government happens to be one such jurisdiction. We have a Privacy Act in this country which regulates the federal government's collection and usage of personal information, and a number of our provinces have similar statutes as well.
But nowhere in Canada, with the single exception of the province of Quebec, is there any privacy statute affecting personal information practices in the commercial or the private sector. There's a yawning gap here.
GT: What principles do you advocate for handling privacy issues in the private sector?
Phillips: I think what's required across the whole of the social system -- governmental and commercial -- is to apply, essentially, the Code of Fair Information Practices, which is the foundation of every privacy statute in the world. The essence of the Organization for Economic Cooperation and Development [OECD members
are industrialized nations] guidelines, for example, simply set out a code of basic rules by which people can
collect information about
individuals, use it, dispose of it, disclose it or store it.
There's no great mystery about this. Essentially what it does is introduce into personal information traffic an element of openness so that people know when their information is collected and have some right to its disposal. That's what is missing now.
The OECD was a pioneer, in a sense, because 10 years ago members brought out a set of guidelines to which all of the OECD countries have subscribed. But not all of them have followed up by making sure that these guidelines are adhered to in their own jurisdictions.