"What we are really dealing with," said Canadian Privacy Commissioner Bruce Phillips, "is the degree to which we ... offer to individuals at least a minimum of respect for our personal autonomy and our right to control what the world knows about us."
The Information Age puts state and local governments between the rock of public access and the hard place of personal privacy. Since 1991, Phillips has made the tough calls for Canada.
Phillips was interviewed by Government Technology Features Editor Brian Miller.
GT: Polls taken in this country and in Canada have indicated that a great many people are at least concerned about their privacy being violated. Where does this feeling come from?
Phillips: I think at the consumer level, people are beginning to understand that a great deal of their personal information is now being freely traded in the marketplace without their knowledge or consent. The enormous increase in the amount of unsolicited mail is the kind of consumer tip of the privacy iceberg that has alerted people to the fact that there is a great deal of information about them being moved around in the system that they don't know anything about. I think that people are concerned about losing control.
GT: Is this something people really need to be concerned with or is it an overreaction?
Phillips: I think the problem up to this point has been under-reaction. We're moving into an age in which personal information has itself become an important marketplace commodity. We need a stronger set of basic legal standards -- both in private and public sectors -- to get the public the kind of protection for their personal privacy for which they are entitled.
GT: What kind of legal standard do you think would best address this?
Phillips: Well, there already is one in place in many parts of the world. In New Zealand and Australia, and in most jurisdictions in Western Europe, there are strong privacy statutes which state as a basic principle that personal information about the people living in those countries can't be collected and used without their consent and knowledge.
That is essentially the missing ingredient in North America, except in those jurisdictions where there are some privacy laws. The Canadian government happens to be one such jurisdiction. We have a Privacy Act in this country which regulates the federal government's collection and usage of personal information, and a number of our provinces have similar statutes as well.
But nowhere in Canada, with the single exception of the province of Quebec, is there any privacy statute affecting personal information practices in the commercial or the private sector. There's a yawning gap here.
GT: What principles do you advocate for handling privacy issues in the private sector?
Phillips: I think what's required across the whole of the social system -- governmental and commercial -- is to apply, essentially, the Code of Fair Information Practices, which is the foundation of every privacy statute in the world. The essence of the Organization for Economic Cooperation and Development [OECD members
are industrialized nations] guidelines, for example, simply set out a code of basic rules by which people can
collect information about
individuals, use it, dispose of it, disclose it or store it.
There's no great mystery about this. Essentially what it does is introduce into personal information traffic an element of openness so that people know when their information is collected and have some right to its disposal. That's what is missing now.
The OECD was a pioneer, in a sense, because 10 years ago members brought out a set of guidelines to which all of the OECD countries have subscribed. But not all of them have followed up by making sure that these guidelines are adhered to in their own jurisdictions.
GT: A key item in Canada's Privacy Act prohibits an agency from using data in a way which is inconsistent with the original intent for which it was collected. Doesn't this hinder government operations? An agency might be more efficient if certain data is shared.
Phillips: It is not an absolute prohibition. There are circumstances under which data matches can take place in the federal system that may be an unrelated use of the information. If they want to do a data match of that kind, they have to bring it to my attention so that I have an opportunity to review it and offer an opinion as to its advisability.
A simple example had to do with federal government student loans. The sum total of delinquent loans became very large, running into the hundreds of millions of dollars. The government felt it had a right not to pay tax refunds, for example, to people who might be delinquent in their student loans.
They proposed that the Revenue Department should be required to produce the names of people who are qualifying for tax refunds who had an obligation to the government in terms of student loans. We looked at that and did approve that as a sensible unrelated use. So, it's not an absolute prohibition.
The so-called one-stop shopping of government services does raise the possibility that more than one database from one department will be linked so that people around the country can stop at a government services kiosk, insert a card and get access to their database, no matter where they are in the government.
This is a very interesting thing that raises the issue of linking databases which at this moment are not linked. We're part of a study group that is looking into this, and I think it can be done in a way that will respect the Privacy Act.
GT: My next question has to do with another issue in the Privacy Act, which allows persons to examine data held by the government. What does this do for a person's privacy in both concrete terms and in perception?
Phillips: That's one of the elements of any code of fair information practices, that the individual to whom any particular file or dossier relates has access to it. We handle hundreds of cases like this every year where people write to government departments wanting to see their file on a matter. And the government, under our act, is obliged to produce it.
There are some exemptions and exceptions to the rule. Our security agencies and a lot of our enforcement agencies are empowered to decline to disclose personal files if it would be injurious to the security of the state or law enforcement.
GT: Why would a person want to look at this information on themselves? To check the accuracy?
Phillips: That is certainly one of the reasons, accuracy being a some-time thing in any record-keeping system. Under our act, people have the right to challenge the accuracy of a file and to have the file annotated to reflect the person's dissatisfaction with what it says and, where inaccuracies are provable, to have the record corrected.
These things do crop up. There are thousands and thousands of requests from Canadians to see one file or another. All kinds of people write to the Tax Department to say "I had a dispute with you about my taxes, I want to see what you wrote about me in your files." They have a right to see that information. I have just begun to enumerate the vast number of circumstances. People frequently write and ask for files to help clear up a state matter -- all kinds of reasons.
I think it contributes to a much healthier democracy. What the Privacy Act says, in a sense, is that we recognize people who live in this country as distinct, autonomous human beings -- not merely as digitized subjects -- who are to be treated as individuals and who have a right to an open system in which they can see what the government contains in its files about them.
I feel more comfortable with that. I think it's just a basic right that people ought to have in a good, functioning, healthy and self-confident democratic system.
GT: What is your approach to resolving complaints from constituents?
Phillips: Frequently, what this job entails is not only looking at the strict interpretation of the Privacy Act, but trying to find common-sense solutions. It is a form of alternative dispute resolution, and I try to strike a balance in my mind between the public interest and the private interest.
I am required to sort of stand in the shoes of the complainant. In cases of doubt, I am disposed to resolve it in favor of the privacy side of the issue.
Frequently, people request access to very voluminous files. Often, in the course of examining the files, we will strike an agreement with the department of concern and say "look, you should give this part to the requester, but this other part, I think we can agree with you that they shouldn't get that part." So, there's a good deal of negotiation that goes along with the process. What you're looking for in cases like that is a common-sense view of what it is we're doing.
GT: What is the most important thing you have done, so far, as commissioner?
Phillips: I guess the most important thing we've done here is to help sensitize the Canadian public about the changing nature of society as a consequence of the marriage of computer technology to modern communications technology -- that it is changing the way the world works, it's changing the relationship of the individual, both to the business world and to society generally. As for the protection of individual autonomy, this is going to be a vastly different world.
Privacy is really not a good enough word to describe what we are dealing with here. What we are really dealing with is the degree to which we are going to continue to offer each other as individuals at least a minimum of
respect for our personal autonomy and our right to control what the world
knows about us.
GT: Could you explain your obligations to the Parliament?
Phillips: As an office of Parliament, I don't work for any particular government department. The purpose of that is to certify the independence of this office.
One of my obligations is to try to give Parliament timely advice and, in my annual reports, on privacy issues generally. We do have a small staff that does public policy issues. We try to advise departments of government on things we think they ought to be looking at. We examine statutes as they come before Parliament for their privacy implications.
For example, let's take DNA analysis, which is now becoming an important tool of law enforcement in terms of criminal identification. When the government started thinking about this, we provided the Justice Department with a paper setting out our views on what would constitute a reasonable use of DNA evidence in the law enforcement process. They subsequently brought in a bill which, to a very large degree, reflected the points we made.
Another example that leaps to mind is that in Canada, more and more government operations are being turned over to the private sector. In this country we're in the process of turning over a number of our transportation functions, such as traffic control, to private operators. Some federal employees will be transferred to private companies.
As long as they are federal employees they enjoy all the protections of the Federal Privacy Act. But because we don't have any legislation covering the commercial world in the privacy context, they would be effectively losing rights they now enjoy. So we're consulting with the government of Canada about means by which they can carry these protections with them. We get involved in literally scores of issues of this kind.
For further information, see Canada's Privacy Commissioner home page at .