In my last newsletter, I announced I would write about employee and contractor issues. However, since that time, there have been several developments in privacy law that are troubling to both you as an entrepreneur and as an individual giving out information to others.
Thus, this issue will be devoted on giving you a general and practical overview on how to collect and give out information with peace of mind. As usual, this newsletter should only be considered a general overview of the topic. Privacy law is a complicated and continuingly evolving field of law and you are urged to speak to a lawyer for assistance on this matter
Privacy law has become a concern to entrepreneurs and individuals everywhere because of three recent trends:
1. The increasing awareness of privacy rights and the means to enforce such rights against businesses of all sizes. For example, a recent high-profile Privacy Commissioner of Canada decision dealt with the marketing practices of the Ottawa Roughriders Football team, a mid-sized business in the nation’s capital. In the Commissioner’s finding of fact, the club repeatedly called and emailed a potential client after he requested that he not be contacted. This is a departure from the historic trend of only big businesses having to defend themselves against privacy complaints. The result was the football club spending time and money to answer the Privacy Commissioner’s inquiry and being subject to sanctions (which I understand have not been reported as of yet).
2. Several high-profile cases of stolen personal information in Canada and the United States may indicate that people who collect information about you are not safe-guarding it properly. It was recently reported that a financial institution in Thornhill, Ontario accidentally sent personal financial information of over 100 of its customers to an individual seeking a printout of his own recent account activity.
3. The increasing use of privacy law as a way to seek money against businesses- whether through legitimate or nuisance lawsuits. In February 2005, a multi-million dollar class action lawsuit was filed against a financial institution seeking monetary compensation for, among other things, a breach of the Personal Information Protection and Electronic Documents Act (“PIPEDA”), the act which governs many businesses in Canada.
How do you make sure you are not impacted negatively by these trends?
As a starting point, PIPEDA is the legislation which currently governs privacy practices in Ontario. Many regulated industries, such as the medical profession, and other provinces are governed by their own set of privacy laws. If you are a member of a regulated industry, please consult your regulator for more details.
The principles underlying many of these laws are substantially similar. Essentially, individuals must obtain consent to collect accurate personal information for a particular purpose and the collector of such information may only use the information for same purpose(s). For further information, please see http://privacyforbusiness.ic.gc.ca or contact your lawyer.
On a practical basis, every business should consider the following practices:
All marketing materials should be on an “opt-in” basis. If you collect information about your customers from trade shows, seminars or other promotional events, please make sure you have obtained consent to subsequently contact these individuals for marketing and sales purposes. Collecting names for a contest does not grant a business a right to contact an individual for purposes other than the contest. The Privacy Commissioner of Canada has ruled in the past that, generally speaking, an “opt out” consent provision (i.e. you have to actively take steps NOT to have personal information collected) violates privacy principles.
Your “do not call list” should be as important as your call list. Circulate a “do not call list” as frequently as a potential client list. A dated “do not call” list could lead to a complaint being filed against you.
All personal information should be password protected on your computer. Employees and contractors should, ideally, not be allowed complete access to this list. Employees are often, knowingly or unknowingly, the greatest source of privacy “leaks” in a business, with the employer being held responsible for such wrongdoings. Ideally, employees should only have portions of your client lists. This practice will minimize privacy violations and avoid disgruntled ex-employees from soliciting all your clients after they leave.
All personal information should be destroyed properly: ideally, any information with your customer’s name on it should be shredded if you intend to dispose of it.
All personal information should be kept out of sight: This is especially important if you are a home-based business and do not have a dedicated meeting/client room. Any personal information should be stored in such a manner that people visiting or passing by your desk cannot easily access information you have collected.
As an individual, you should consider the following steps:
Ask persons who collect information about you what they have on you. You have a right under the law to request access to your files in a reasonable period of time. You have a further general right to request that any unnecessary or out-of-date information collected about you is deleted.
Read the fine print carefully in your contracts. It was recently reported in Vancouver that an insurance company had a right to investigate the entire medical history of one of its clients, even if it was irrelevant to the insurance claim, because of the broad privacy clause inserted. If possible, strike out provisions in privacy clauses which are overly broad. If in doubt, ask a lawyer.
Give as little personal information as possible. Many of us have been warned about giving out our social insurance number unless absolutely necessary. Other pieces of personal information, such as home addresses and tax returns, should not be given out as well unless it is related to the purpose of collection. For example, your bank does not need to have access to your tax returns for day-to-day transactions. If you have a home office, please consider renting a mail box as your mailing address for privacy and safety reasons. I understand there are also several computer products on the market which allow you to surf the Internet without detection.
Know your rights. Privacy law can be an overwhelming concept to understand at times. If nothing else, please remember that your privacy is yours to give and not for others to take. And if in doubt…
Educate yourself. Speak to a lawyer. Read the Privacy Commissioner’s easy to understand FAQ at http://www.privcom.gc.ca. There are also several in-depth blogs on various aspects of privacy law (see www.technorati.com and type in “PIPEDA” as a search term to search the blog most relevant to you). These will be good starts to make sure someone is not taking advantage of you.
|
