Canada's recently enacted Personal Information Protection and Electronic Documents Act took effect establishes rules to govern the use, disclosure and collection of personal information by the private sector.
The law does not apply to U.S.-based companies, but it does cover the Canada-based subsidiaries of U.S. companies.
The legislation, also known as C-6, requires foreign marketers doing business in Canada to secure the explicit consent of a customer before making commercial use of the customer's personal data. The act also provides retroactive protection for information collected prior to passage of the legislation and requires marketers to provide customers with easy access to their personal information. Companies also must appoint a chief privacy officer to manage privacy compliance.
“With the acceleration of electronic commerce and new advances in digital technologies, we believe that privacy will be the defining issue of the next decade,” George Radwanski, Canada's privacy commissioner, said in a statement.
“It is important that Canadians realize they have fundamental rights when it comes to privacy and that they are not obliged to give information about themselves to everybody who asks,” he said. “C-6 gives them the power to ask why the information requested from them is needed and gives them more control over how it is used.”
It also broadens the role of Canada's privacy commissioner and establishes him as a privacy ombudsman. Responsibilities will include conducting research and promoting awareness of privacy issues in Canada, as well as encouraging organizations to develop and adopt privacy policies and information protection practices.
In addition, individuals may complain to the privacy commissioner about how organizations handle their personal information. He can take marketers to the Federal Court of Canada, which can order organizations to stop privacy violations and can award substantial damages.
The legislation also closes a gap in Canadian law. Until C-6, no Canadian federal legislation protected personal information in the private sector, although such data are federally guarded in the public sector.
Charles Prescott, the Direct Marketing Association's international vice president, said direct marketers in the United States have been contacting the DMA to get information about the act.
“The Canadian Privacy Act is a practical application of the European Data Protection Directive and as such will be data protection's Trojan horse into the United Sates,” Prescott said.
The legislation will be enforced in three stages.
The first stage, which took effect last month, applies to the federally regulated private sector, including banks, telephone companies, broadcasters, cable companies and air carriers. The act also covers all businesses and organizations engaged in commercial activity in Yukon, the Northwest Territories and Nunavut.
The second phase, which will go into effect next January, will apply to health information.
The third phase, taking effect in 2004, will extend coverage to all commercial transactions involving personal information.