In 1994, citizens of Quebec became the first in North America to have their personal information in the hands of the private sector protected by statute. The federal governments of Canada and the United States, a number of Canadian provinces and some U.S. states all provide similar protection for personal information collected, maintained and used by government, but Quebec was the first -- and continues to be the only -- government to extend those protections to private-sector information. While the United States already has laws that protect privacy in certain business sectors -- most notably banking and credit -- the Quebec law does not distinguish between industries but instead covers all private-sector records.
Most European nations already have privacy laws covering the public and private sectors, commonly referred to as data protection acts. The European Union has developed a directive on data protection that restricts the transfer of personal data from one jurisdiction to another unless the recipient jurisdiction has adequate privacy protections. Before Quebec passed its law, data protection professionals in Europe believed no jurisdiction in North America had adequate privacy protections, since existing laws in North America covered only public-sector records. Quebec broke that mold with its private-sector law, and many North American observers realized that Quebec was the only jurisdiction in North America with adequate protections.
Although George Orwell's vision of a Big Brother government, which snoops and pries into the lives of all citizens, continues to reside in the unconscious of every information society, it has been business that has made the most consistent and systematic use of personal information -- vacuuming it up through numerous direct contacts with consumers, through credit bureaus and public records, analyzing it for demographic advantages and profiling the wide array of likes and dislikes of individual consumers. While many argue that unwanted junk mail is a small burden to bear in exchange for potentially attractive targeted mail, anyone who has been victimized by inaccurate information appearing in a credit report knows first-hand how devastating the use of personal information can be in the private sector.
So in 1993, Quebec's National Assembly took steps similar to those that many European countries took years ago; it created a regulatory scheme that protected the integrity of personal information use by the private sector to complement its existing regulation of the use of such information by the public sector. Government regulation of the private sector's information practices may run counter to the libertarian strains of American political philosophy, but such regulation recognizes the obvious: That in an age where personal information can move virtually anywhere in the blink of an eye, the misuse and inappropriate collection of such information by businesses is every bit as detrimental to civil liberties as is its collection by governments.
Flexible Public Protection
Quebec decided against the European model of data protection, which generally requires the registration of personal information collections with a data commissioner. Instead, the Quebec approach provides that any business operating in the province that collects, uses or disseminates personal information must make available upon a written request any information concerning the existence of a file and its contents. An individual has the right to request correction of the record, and the business must respond within 30 days. Any remaining disagreement may be appealed to the Commission d'acc
