US Secure Flight Program

The US Transport Security Administration’s Secure Flight Program was launched in August 2009 and has been phasing in new regulations since. The TSA explains Secure Flight as a “behind the scenes” program, aimed at enhancing security of domestic and international air travel. The program was initially developed by the Department of Homeland Security in response to 9/11 Commission Recommendations.

The Secure Flight program began with the Secure Flight Passenger Data check, which required passengers to provide personal information to their airline when making a reservation. This information included their name as it appears on government-issued identification; date of birth; gender; and redress number, if necessary. The information would then be transmitted to TSA’s Secure Flight and crosschecked with federal government watch lists. The results of this check would then be transmitted to the airline. The TSA has access to all US government databases.

According to the TSA, the goals of watch list matching include:

• Decreasing the chances of compromised watch lists; limiting distribution of watch lists.
• Early identification of potential matches, meaning expedited notification of law enforcement authorities and threat management.
• Developing a fair, equitable and consistent matching process for all airlines.
• Reducing instances of misidentified individuals.
• Consistent application of redress process for misidentified individuals.

Individual privacy has been a prominent concern during the implementation of the Secure Flight program. The TSA has developed a Secure Flight Privacy Program, which includes the following elements:

1. Foundation privacy principles
2. Privacy organization, including a privacy officer and supporting staff
3. Secure Flight privacy policies
4. Systems development and security to manage privacy risks throughout the Secure Flight system
5. Awareness and training programs
6. Monitoring and compliance procedures
7. Redress and response processes
8. Privacy risk management technique

The TSA set out objectives of checking 100 percent of domestic flight passengers by early 2010. It also states intentions of vetting 100 percent of passengers on all international commercial flights into, out of, or over the US by the end of 2010.

Objections

The TSA’s Secure Flight objectives raised public outcry in Canada and Europe. The application of Secure Flight on airlines flying over US airspace was seen as an unprecedented assertion by the TSA. Once the program launches globally in December 2010, the TSA can prevent passengers from boarding flights, even if they are only flying in US airspace. For instance a passenger may be denied boarding an aircraft in Canada, headed to Mexico, if they have not passed the Department of Homeland Security screening. The Secure Flight program applies to flights to, from, or over the US. About eighty percent of Canadian flights to the Caribbean, to other southern points and to Europe fly over the US.

Secure Flight requires that Canadian airlines transfer travelers’ personal information to the Department of Homeland Security at least seventy-two hours before departure. Using Infoglide, a package of fifty identity resolution algorithms, it checks passenger identities. The Department also has access to data collected in Canada, such as police records.

In the case that the search results in “no match,” the airline will be informed and the passenger can be issued a boarding pass. In these situations, the personal information will be purged from the Department of Homeland Security system after seven days.  However, a potential match (according to the Department, this is someone who has not been determined as an exact match, but has the potential to match some data elements) can be kept in the system for seven years. Positive, or exact, matches are kept in the Secure Flight system for ninety-nine years. It will take around fifty to sixty days to resolve false positives.

Many privacy watchdogs and advocates are wary of this new program as it requires non-US airlines to release passengers’ personal information to US government departments. It is unacceptable to many, as Canadian Parliament never adopted or even discussed the Secure Flight program. The European Parliament has raised a number of objections to the program.

Most airlines do not host their own passenger name records (PNR). This is often outsourced to a third-party computerized reservation system (CRS). PNR data is entered through travel agencies, tour operators and travel websites and is stored as a master copy in the CRS. It is the CRS that sends the PNR data to the Department of Homeland Security.

However, there is no data protection law for CRSs in the US. Once a CRS has PNR data, they are legally able to use, disclose, transfer or sell that data, without notice or consent. Currently, CRSs in the US share data with data mining and marketing companies, as well as with PNR processing companies. Since the CRS does not keep as access log on who retrieves the PNRs, it is impossible to determine who has seen passenger information.

Security vs. Privacy?

Canadian airlines currently check all flight manifests against the US no-fly list, a watch list compiled by the FBI and distributed amongst airlines worldwide. This no-fly list contains the names of 16,000 people suspected of terrorist involvement by the US government. According to the Canadian Charter of Rights and Freedoms, the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA), it would be difficult to introduce measures such as Secure Flight without considering the following:

• The right to privacy is a fundamental right. It cannot be infringed unless it is necessary for the public good.
• Collection of personal information can only occur when proven necessary.
• Necessity of collection must be assessed continually.
• Less privacy-invasive alternatives that fulfill the same purpose should always be considered.

From the Canadian Privacy Commissioner’s perspective, shifting responsibility for checking the passenger manifest from the airlines to the Department of Homeland Security brings privacy safeguards as well as privacy risks. After investigating the Secure Flight program, the Commissioner made the following recommendations to the Canadian government:

• Negotiate with US authorities on the collection of minimal personal information.
• Determine if the retention periods (seven days, seven years, ninety-nine years for negative, potential and positive matches, respectively) are necessary.
• Negotiate robust and accessible redress mechanisms in the case of false positive matches.
• Implement measures to support Canadians who must use those redress mechanisms.
• Inform Canadian passengers on the scope of information collected and disclosed under the Secure Flight program.
• Clarify Canadian law regarding the conditions for disclosure of personal information, in order to ensure public debate and legal certainty.

According to the Privacy Commissioner, the issues of privacy and security are not at odds. They can both be supported at the same time, since privacy protection deems the collection of personal information be kept to a minimum, while the efficacy of security depends on the collection of only relevant information.

Summary

This article explores the issue of aviation security and privacy protection issues in trans-border data sharing. The US Transport Security Administration (TSA), a branch of the Department of Homeland Security, proposed the Secure Flight program, which collects and crosschecks passenger data for all flights to, from or over the US. While it is currently implemented domestically, the TSA intends to launch the program internationally in December 2010. This stands to significantly impact Canadian travelers. The article examines privacy concerns and objections to the Secure Flight program. The Canadian Privacy Commissioner’s responses and recommendations are also highlighted.

CIPP/C Preparation

In preparation for the Certified Information Privacy Professional/Canada exam, a privacy professional should be comfortable with topics related to this post, including:

• Co-regulatory model of privacy protection (II.B.a.)
• Regulating activities: processing, transfers, data sharing (II.B.d.)
• Enforcement agencies & powers (II.B.e.i.)

What is RFID?

RFID is a term for a group of technologies that enable machines to identify objects. This may include bar codes, smart cards, optical character readers, biometric technologies and more. RFID uses radio waves to identify items. Its first application was the identification of aircraft during WWII. Since then, developments in technology have reduced the cost and increased potential applications of RFID technology. The automatic identification offered by RFID is attractive to many organizations and retail stores, as it reduces the time and labor necessary to manually input data and to improve data accuracy.

There are three components in an RFID system:

1. Tag: this is usually made up of a microchip unit, antenna and encapsulating material. Microchips can store up to two kB of data. This may be information about a certain product, such as its destination or sell-by date. An RFID system may include multiple tags.

Tags are also referred to as transponders. They can be read-only or read-write tags. “Read-only” means that the information on the tags cannot be changed in any way. Read-write tags can have the information modified or erased multiple times. Since they offer greater functionality, their price is much higher than read-only tags.

1. Reader: this is a device that has at least one antenna to communicate with the RFID tag. It emits radio waves and receives signals back from the tag. The reader passes digital information to a computer system. Readers are also known as interrogators. They can be portable, handheld devices or fixed terminals positioned in strategic places, such as loading bays or doorways.
2. Infrastructure: this includes the necessary hardware and software for supporting the RFID system. The RFID software translates the data from the tag into the information about the goods and orders. This information is transmitted into other databases and applications for processing.

How can RFID be used?

RFID technology has and will be applied in a variety of public and private sector organizations. Uses include:

• Product Integrity – to ensure that products are authentic and untampered with
• Supply Chain Management – to monitor and control the flow of goods through the supply chain (i.e. from raw material to finished product to consumer)
• Warranty Services – goods with tags incorporated into the materials, in order to facilitate warranty services
• ID, Travel & Ticketing – to verify the identity of the traveller; to ensure that travel documents are genuine
• Baggage Tracking – to monitor and control the movement of baggage (e.g. from check-in to loading)
• Patient Care & Management – to rapidly, accurately verify patient information (e.g. allergies, prescription, health history, etc.)

Privacy Issues

According to the Canadian PIAC (Public Interest Advocacy Center), RFID technology presents a challenge to Canadian privacy legislation. The basic surveillance capabilities of RFID are unlikely to violate privacy, though the PIPEDA significantly limits the use of RFID for consumer surveillance purposes.

However, later Office of the Privacy Commissioner of Canada (OPC) research indicated that there were significant concerns regarding the use of RFID in the workplace. Through a number of public consultations, the OPC was able to establish the perspectives of academics, RFID vendors, industry groups and private citizens. Numerous privacy threats were identified:

Repeated collection of information

• Since RFID tags are very small, they can easily be embedded on/in objects or documents without the individual’s knowledge. It is possible to read RFID tags through fabric, plastic and other materials, as radio waves are not restricted to line of sight. Tags can also be read from a distance. These factors render it impossible for individuals to know if/when he/she is being scanned.

Tracking Movements

• If there is a sufficient network of RFID readers, the tags can be tracked in time and space. This is possible through a combination of GPS (Global Positioning Systems) and RIFD technologies.

Profiling Individuals

• RFID technology means that each object has its own unique identification. This contrasts bar code technology, which gives the same identification to all similar objects (e.g. in a grocery store, all orange juice cartons of the same brand have the same bar code). If unique identifiers are associated with individuals, then profiles of purchasing habits can be compiled.

Secondary Use

• Creating profiles and tracking individual movement can be linked to other information which the individual may not want revealed.

Massive Data Aggregation

• RFID records may be linked with personally identifying data, which may facilitate any of the other privacy threats listed previously.

OPC Responses

The OPC recommends that the ten principles of the CSA Model Code, as well as the PIPEDA form the basis for an RFID privacy management framework. OPC research responds to each of the ten CSA principles, with respect to RFID technologies:

1. Accountability – Who has access to and who is accountable for the data generated by RFID systems, as well as other data collection systems in the workplace?
2. Identifying Purposes – RFID systems that are used for legitimate business purposes (e.g. supply chain management) are more likely to be supported than RFID systems used for secondary purposes or surveillance (e.g. employee surveillance, workforce management). The OPC identified that industry standards, policies or guidelines can help to ensure that the data collected through these systems are used and disclosed for identified purposes.
3. Consent – Meaningful consent must be secured before an RFID system is implemented. However, there is the challenge of securing meaningful and completely voluntary consent in a workplace setting.
4. Limiting Collection – Reasonable expectations of privacy must be balanced with reasonable management of RFID systems. While reasonable expectations of employees are important, the reasonable management of the RFID system is the employer’s responsibility. This involves the protection of employee privacy.
5. Limiting Use, Disclosure & Retention – The issue of RFID implants was a significant concern for OPC and other groups who were consulted, as implants present significant privacy and security issues. For instance, employee conduct might be monitored during and after work hours, at lunch, during vacation, and for tracking physical movements and conduct. This may pose a serious security issue.

Employers should limit the collection of personally identifiable information, including RFID-related data. Data from RFID systems should not be linked to other databases, unless there is a proven need.

1. Accuracy – It is the responsibility of the employer to ensure that personal information is accurate, complete and up to date for the purposes for which it is to be used. An audit trail might be established and maintained regarding the lifecycle of the RFID data.
2. Safeguards – RFID systems that contain personal information must be protected in a way that is proportionate to its sensitivity. Employers should be made accountable for any breach of RIFD technology. Protecting data in each distinct part of the system is an effective approach to safeguarding employee privacy.
3. Openness – For instance, hidden tags or readers should not be implemented. Clients, employees and/or unions should be consulted before RFID systems are installed. Tags and readers ought to be in plain sight, never used for covert surveillance.
4. Individual Access – Individuals (e.g. clients, employees, union leaders) should be guaranteed access to any personally identifiable data generated by RFID systems.
5. Challenging Compliance – Individuals ought to be able to challenge compliance with other principles. This may be the ability to make inquiries or lodge a complaint if necessary.

After examining each principle individually, the OPC stated some guiding applications for the implementation of RFID technology in a way that respects Fair Information Practices:

• If the RIFD chip has an individual’s personal information contained on it, then it is defined as a repository of personal information.
• If the tag is unique, it can be associated with an individual. The tag becomes a unique identifier for that individual.
• Personal information includes information about possessions, purchases or behaviors that can be processed to create a profile.

Summary

This article provides a brief introduction to RFID (radio frequency identification) technology. It explores some uses of this technology in consumer and work settings. Privacy concerns regarding RFID systems are raised. The article also offers some responses and recommendations made by the Privacy Commissioner of Canada regarding implementation of RFID technology.

CIPP/C Preparation

In preparation for the Certified Information Privacy Professional/Canada exam, a privacy professional should be comfortable with topics related to this post, including:

• CSA Model Code for the Protection of Personal Information (II.A.a.i.)
• Radio Frequency Identification (RFID) (V.A.a.5.)
• Security threats and vulnerabilities (V.A.b.)
• Information management (V.c.i.)

What is authentication?

Authentication in this context refers to the verification of user identities in an electronic information system. Authentication can be discussed in terms of three factors, or authenticators:

1. Something that is known by the individual (e.g. a password, personal identification number, account number, etc.)
2. Something that the individual has (e.g. a bankcard, token, identity card, digital certification, etc.)
3. Something that the individual is or does (e.g. a biometric, such as a facial image, retinal scan, voice print; or a person’s signature)

Single-factor authentication is the traditional security process. In this type of authentication, the user must provide an authenticator in one of the above categories. For instance, before a user has access to an account, he/she must provide a username and a password. Single-factor authentication is more likely to result in compromised privacy or security.

Two-factor, or multi-factor authentication requires authenticators from two or more of the above categories. For instance, before accessing a system, a user must provide a physical token, such as an identity card and a security code. Authentication that is based on more than one authenticator from the same category is known as multi-layer authentication.

Electronic Authentication in Canada

A 2008 study conducted by the Public Interest Advocacy Center (PIAC) focused on electronic authentication of consumer financial transactions. It established that Canadian consumers were particularly attentive to electronic authentication methods in their daily transactions, which included banking and financial services, airport check-in and online shopping. While many online banking services required two-factor authentication, the most common online authentication is single-factor authentication with a username and password.

A 2004 study revealed consumer frustration with the lack of security provided by online banking services and online retailers. A later 2005 study showed that Canadian consumers were more concerned about security and privacy than their American counterparts; 40% of Canadians avoided online shopping due to security issues, compared to 24% of Americans. The Privacy Commissioner of Canada continues to note concerns with the increasing trend of collection, use and retention of personal data.

Authentication Principles

In May 2004, Industry Canada released the Principles for Electronic Authentication to provide guidance for the development, implementation and use of authentication services and produces in Canada. The Principles complement existing authentication governance through establishing benchmarks for products and services. They also ensure compatibility with international developments in authentication.

The Principles for Electronic Authentication are outlined below:

1. Responsibilities of Participants

Participants in authentication processes should be aware of their functions and responsibilities. Responsibilities should be proportional to the degree of knowledge and control they can reasonably be expected to have. Functions may include: administration, specification, end use, standards development, compliance assessment and infrastructure provision.

2. Risk Management

Any risks associated with authentication processes should be identified, assessed and managed in a reasonable, fair and efficient manner. Risks may include financial risks, loss of confidentiality or privacy, damages to reputation or identity theft. Assessment should be done in the context of the six functions listed in the previous principle.

3. Security

Participants in authentication processes should be responsible and accountable for security. A security incident that only affects a single participant may have implications for all participants. Participants have a responsibility to mitigate risks through sound security practices, but most of this responsibility lies with infrastructure providers and authentication administrators. Review and assessment is essential in ensuring the ongoing efficacy of security programs.

4. Privacy

Organizations involved in the design or operation of authentication processes should comply with data protection regulations set out in privacy legislation. The collection, use and disclosure of personal information in the context of authentication should be minimized. For instance, the authentication of a business should be focused on business attributes, rather than personal attributes of individual employees.

5. Disclosure Requirements

Organizations offering authentication services should disclose information, such as policies, practices and procedures, to other participants. This will ensure that all participants are aware of the risks and responsibilities associated with participation. Disclosure should not include any information that would introduce vulnerabilities or increase risk. The extent and nature of the information disclosed may vary, depending on whether the end user happens to be an individual or an organization.

6. Complaints Handling

Organizations that implement authentication processes should establish a complaints-handling process in order to enable participants to effectively resolve complaints and respond appropriately to non-compliance issues. Adequate complaints-handling processes should reflect the following characteristics: visibility; accessibility; responsiveness; fairness and objectivity; free of charge; confidentiality and privacy; accountability; continual improvement; and third-party dispute resolution processes for unresolved complaints.

Authentication Initiatives Since 2004

Since the publishing of the Authentication Principles, governments and consumer groups have been involved in several electronic authentication initiatives:

• The Data Protection Working Party adopted a working document on online authentication services. It studies the efficacy of the Microsoft .NET passport, which reduces the number of accounts a user needs to create and makes more services accessible through a single authentication process.
• In June 2007, the OECD released their Recommendation on Electronic Authentication as well as the OECD Guidance for Electronic Authentication, which lists a number of foundational principles for authentication.
• In September 2007, the Department of Finance began discussions regarding the expansion of the Debit Card Code to cover a broader array of electronic payments.

Authentication Principles, Revisited

In October, 2008, the PIAC released a report calling for a substantial overhaul to Industry Canada’s Authentication Principles. The report cited the Principles’ widespread failure to provide adequate protection when conducting online business transactions. While consumers are becoming increasingly careful around security and privacy risks online, the report urges federal and provincial governments to play a greater role in the regulatory process.

The following is an outline of some of the criticisms and recommendations made by the PIAC regarding the Authentication Principles:

• Criticism: The Authentication Principles provide insufficient assurance of consumer security. Principle #3 is based on security, but it is too vague to be meaningful as it does not indicate how an organization might achieve appropriate security.

Recommendation: Authentication should move beyond multi-layer single-factor techniques. Two-factor authentication provides only minimal security for highly sensitive transactions. One-time-passwords can be provided to the consumer through the financial institution or retailer. This strategy has been implemented internationally, but has yet to be introduced in Canada.

• Criticism: The Principles do not clarify who is liable for losses. Consumers should not be held liable.

Recommendation: Standard form contracts must make clear who bears the liability for losses. Banks and retailers should bear the burden of responsibility for unpreventable losses.

• Criticism: The Principles fail to adequately protect consumer privacy, especially in light of continually evolving security breaches.

Recommendation: Prioritizing consumer privacy would help to minimize the harm that results from security breaches related to authentication. The Principles should tie in corresponding sections of the Personal Information Protection and Electronic Documents Act (PIPEDA) fair information practices. Sensitive personal information should be used as authenticators only in very limited situations. Consumers should be able to choose the pieces of personal information they use as authenticators.

• Criticism: The Principles must mandate full public disclosure and consumer education.

Recommendation: Implementation of authentication processes should be transparent. This includes notifying consumers if the authentication system has changed; making information available before the user creates an account; providing full public disclosure of audits and compliance reviews; providing security breach notification; and providing consumer education.

• Criticism: Consumers are not guaranteed protection in a voluntary framework. Consumers need a better regulatory framework to address electronic authentication.

Recommendation: Regulate authentication through sectoral regulation. Strengthen online authentication through implementing two-factor authentication. Regulate authentication in the retail sector. The Privacy Commissioner of Canada should oversee authentication practices.

Summary

This article examines the concept of electronic authentication in a consumer context. Single-factor, two-factor and multi-factor authentication are explored. Industry Canada’s Principles for Electronic Authentication are defined and later criticisms and recommendations are raised. The article also looks at other authentication initiatives that have developed in Canada since 2004.

CIPP/C Preparation

In preparation for the Certified Information Privacy Professional/Canada exam, a privacy professional should be comfortable with topics related to this post, including:

• Security Controls: Authentication (V.A.a.i.)

Beliefs & Behaviors

Online environments often raise issues of youth privacy and awareness. Studies have documented that many young Canadians frequently reveal personal information online without thinking of the potential consequences. According to the Media Awareness Network, 80% of youth use the Internet alone. A 2008 Kids Help Line study revealed that 40% of youth were willing to give personal information to someone they only knew online.

A federal Privacy Commissioner’s survey found that almost half of Canadian youth admit that they do not read privacy policies on websites. The majority of youth believe that if a website has a privacy policy, users are assured that the information they provide will not be shared with third parties. Many are unaware that online services may be used to monitor their behavior, or that personal information can be stored and sold to third parties. Although the Commissioner’s study found that many young Canadians do not agree with increased censorship or surveillance, they do want the ability to make more informed decisions about the sites they visit and their online activities.

Privacy Issues: Facebook

In July 2009, the federal Privacy Commissioner completed an investigation of the popular social networking site, Facebook. The investigation was prompted by a complaint from the Canadian Internet Policy and Public Interest Clinic (CIPPIC), which identified serious privacy gaps and violations of Canadian privacy legislation. This was an overarching concern for the Commissioner, especially since 12 million Canadians are registered on Facebook, many of them youth.

The Commissioner issued a report identifying a number of key privacy issues with Facebook:

• Third-party application developers (of which there are almost 1 million worldwide) have access to personal information beyond what was necessary to run an application. Developers are also allowed to retain users’ personal information even after the user deletes the application.

• The option of account deletion was inaccessible to users, which means that Facebook could still retain information in user profiles. Many users confuse account deactivation with account deletion. In situations of account deactivation, Facebook does not inform users that their information is being retained for future use.

• Facebook does not obtain the consent of non-users before uploading their personal information to the site (e.g. through photos, videos and wall posts). Non-users are not notified if their personal information is provided to Facebook. When users send invitations to non-users, Facebook collects and retains the email addresses of the non-user indefinitely, without knowledge and consent from the individual.

• Users do not have the ability to opt-out of posthumous displays of their profile. Relatives of a deceased user are unable to remove their family member’s profile. Facebook does not clearly explain that user profiles are kept active after death, in order to allow friends to post comments and memorialize the individual.

As a result of the Commissioner’s report, Facebook agreed to make significant technological and policy changes to help its users better understand how their personal information is used and to make more informed decisions about sharing the information. The Commissioner felt that Facebook’s response was a positive step and agreed with its one-year timetable for implementing changes. The Facebook investigation sets expectations for the privacy practices of other social networking sites.

Privacy Issues: Nexopia

A privacy complaint was filed against the Canadian social networking site Nexopia in January 2010. The Public Interest Advocacy Centre (PIAC), an Ottawa-based consumer advocacy group brought the attention to the federal Privacy Commissioner in a 35-page complaint, which identified six violations of the PIPEDA by Nexopia privacy practices. Under the PIPEDA, the Privacy Commissioner has one year to investigate the complaint and deliver findings. The six violations are outlined below:

• User profiles and personal information are disclosed to the general public. Non-member visitors can easily access sensitive information, including personal information, comments, blogs, messages and photos. Even with the highest privacy-protective setting on Nexopia, some person information (i.e. username, age, sex and location) will always be available to the public.

• Members cannot opt-out of being searchable; the “visible to all” default setting is beyond reasonable expectations and violates the PIPEDA.

• Without providing Nexopia with personal information (i.e. username, email address, birth date, sex and location), a user cannot join the Nexopia community. Users are not directed to the Privacy Policy and are not made aware of the ways in which their personal information can be used or disclosed.

• While Nexopia uses targeted advertising to generate income, it does not adequately explain its advertising practices. Users do not have meaningful consent as to how their personal information will be used or disclosed. Users do not have the ability to opt-out of the targeted advertising program. According to the Canadian Marketing Association’s (CMA) Code of Ethics, collecting contact information from teens aged 13 to 16 requires opt-in consent. Nexopia fails to incorporate this practice into its information collecting procedures.

• Current Nexopia practices regarding the transferring and sharing of personal information with third parties is not transparent.

• Nexopia’s information retention policies violate the PIPEDA. For instance, if Nexopia members send email invitations to their non-member friends, Nexopia stores the email addresses the members provide for future use, although the non-members have not given consent to the collection and use of their email addresses. They also do not have the option to unsubscribe from Nexopia invitations or emails. Further, Nexopia reserves the right to retain members’ personal information indefinitely.

Nexopia’s extremely advanced search function presents additional privacy concerns. The PIAC noted that the member search engine is a worrisome tool, as it permits a fine-grained search of its members. For example, the advanced search can allow an individual to search for females between the ages of 13 and 16 who live in a particular city, or attend a specific school and have certain interests. It is clear that the search tool does not respect youth privacy.

Joint Resolution

In response to child and youth privacy concerns, the federal Privacy Commissioner and provincial privacy oversight officials issued a joint resolution, expressing commitment to improving online privacy standards for children and youth. The resolution, released on June 4, 2008, reinforced children’s rights to privacy and described the actions that the Privacy Commissioner and provincial ombudsmen would take. The Offices advocated an education-based approach that would be upheld by partnerships between commissioners, governments, industry and organizations. Some of the steps to be taken included:

• Collaboration between Commissioners and ombudsmen on public education activities.
• Recommendations on privacy education tools to governments, industry, child/youth advocates, parents and teachers.
• Increase stringency of private sector privacy laws regarding online environments for youth/children.
• Websites for children/youth to offer privacy policies and user agreements that are clear, simple and easy to understand.
• Industry guidance for better privacy practices.
• Commissioners and ombudsmen should be accessible to children/youth to lodge a complaint and seek the appropriate resolution.
• Collaboration with privacy protection regulators worldwide.

On the same day the resolution was released, the Office of the Privacy Commissioner launched Youth Privacy, an interactive website that offers resources to youth to protect their personal information and their online activities.

Summary

This article introduces the issue of child and youth privacy in Canada. It presents a background of youth beliefs regarding online privacy and their privacy protecting behaviors. The article explores two online social networking sites that compromise youth privacy – Facebook and Nexopia. Finally, the article discusses the federal Privacy Commissioner’s and provincial ombudsmen’s responses to issues of youth privacy protection.

CIPP/C Preparation

In preparation for the Certified Information Privacy Professional/Canada exam, a privacy professional should be comfortable with topics related to this post, including:

• Personal Information Protection and Electronic Documents Act of Canada: PIPEDA (III.A.a.)
• Canadian Private Sector Laws & Practices: privacy incidents (III.B.g.)
• Online Privacy: online data collection (V.B.C.)
• Children’s online privacy: parental consent, age restrictions (V.B.f.)

The Model Code was largely based on the Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data, created by the Organization for Economic Cooperation and Development (OECD). While the Code remains a voluntary standard, it enjoys strong support and endorsement by a variety of Canadian companies as the national standard on privacy protection.

In April 2000, the Personal Information Protection and Electronic Documents Act (PIPEDA) became law. The CSA Model Code forms an important component of the PIPEDA.

What is the CSA?

The CSA is an independent, not-for-profit association that aims to serve national and international businesses, industries, governments and consumers. As a leader in standards development, the CSA involved with product certification; quality and environmental management systems registration; and information products. The CSA is a membership organization governed by a Board of Directors who are both elected and appointed.

Standards are written and developed by volunteer committees made up of representatives from government, industry, consumer groups and users. Committees are facilitated by CSA employees and use a consensus-based approach to decide on the contents of a standard and to determine if the standard will be published.

Developing the Code

The Code intends to balance the privacy rights of individuals with legitimate data requirements of industries, businesses and institutions. It was developed by a 45-member committee with representatives from the main groups concerned with personal privacy issues in Canada. Committee representatives included:

• Federal and provincial governments
• Consumer advocates
• Organized labor
• Security and IT experts
• Industries including:
  • Financial services
  • Telecommunications
  • Cable television
  • Direct marketing

What does the Code say?

The Code outlines basic guidelines for the protection of personal data. It addresses two main issues:

I)             How organizations collect, use, disclose and protect personal information.

II)            How individuals access and correct personal information collected by the organizations.

Organizations who choose to follow the Code demonstrate that they are handling the information they collect fairly. The Code offers consumers, employees and other data subjects a means for challenging an organization’s practices.

The Code is based on ten interrelated principles:

1. Accountability

This principle states that an organization is responsible for personal information under its control. The organization should designate an individual or individuals to be accountable for the organization’s compliance with the principles stated in the Code. An organization needs to implement policies and practices that will help them respect the principles.

2. Identifying Purposes

An organization should identify the purposes for collecting information at or before the time of collection. This will enable the organization to determine which information needs to be collected in order to meet their needs. This goes hand in hand with the Limiting Collection principle (#4). Depending on the manner in which information is collected, this principle can be fulfilled orally or in writing. For example, an application form may explain the purposes of information collection to an individual.

3. Consent

Where it is appropriate, an individual must have knowledge of and give consent to the collection, use or disclosure of personal information. An organization should make a reasonable effort to inform individuals of the purposes for collecting information. Consent should be meaningful; the purposes should be explained in such a way that the individual can reasonably understand the use and disclosure of their personal information. Individuals are entitled to withdraw consent at any time.

4. Limiting Collection

Personal information should only be collected as necessary for the purposes that the organization has identified. This includes limiting the amount and type of information. The information should be collected by fair and lawful means.

5. Limiting Use, Disclosure and Retention

An organization should not use personal information for new purposes, unless it has the consent of the individual, or as required by law. Personal data should only be retained as long as is necessary to fulfill the organization’s stated purposes. An organization should develop specific guidelines and procedures governing the destruction of personal information.

6. Accuracy

In order to meet the intended purposes, personal information should be accurate, complete and up-to-date. This principle aims to minimize the possibility that incorrect information is used to make a decision about an individual. This also applies to information disclosed to third parties.

7. Safeguards

An organization should implement appropriate security safeguards to protect the personal information collected. The appropriate safeguard should be determined by the sensitivity, amount, distribution, format and method of storage of the information. Employees in the organization should be aware that confidentiality of personal information should be maintained.

8. Openness

An organization should be open about its personal information policies and practices. Individuals should be able to access an organization’s policies and practices relatively easily. The method of disseminating such information depends on the nature of the organization. This may include brochures, mail to customers, online access or toll-free information lines.
9. Individual Access

Individuals should be informed of the existence, use and disclosure of their personal information. Individuals should have access to their personal information and be able to question and correct the accuracy and completeness of this information.

10. Challenging Compliance

Individuals should be able to challenge an organization’s compliance with the above principles. The person accountable for an organization’s compliance will be responsible for dealing with inquiries, challenges or complaints. An organization should investigate all complaints and if it is necessary, adjust its policies and practices appropriately.

Implementation

The Code is meant to be used by any organization that collects or uses personal information. Such organizations may include:

• Financial institutions
• Service providers
• Retailers
• Direct marketers
• Telecommunications companies
• Product manufacturers
• Schools
• Universities
• Hospitals
• Government agencies

As organizational compliance with the Code is purely voluntary, organizations may incorporate the ten principles in its policies to varying degrees. The Quality Management Institute (QMI) has a program that recognizes three levels of compliance:

Tier 1: Declaration

An organization declares its compliance with the code by signing a code of ethics or statement of their information protection principles.

Tier 2: Verification

An organization submits documented policies and procedures to the QMI, which may conduct on-site audits in order to confirm compliance with the Code.

Tier 3: Registration

The QMI reviews the organization’s documentation and carries out an audit. This establishes compliance with the CSA Model Code and with ISO 9001 or 9002.

Blind Spots

Since its introduction, a number of critiques of the Code have arisen. Many of these critiques point to the vagueness in interpretation, which have led to confusion, loss of confidence and decreased utility of the Code. Due to differences in meaning and application of the Code, a number of cases have been taken to the Canadian Privacy Commissioner. This process is slowly eliminating some uncertainties in the Code.

Some gray areas of the Code include:

• The issue of collecting personal information from or about children is not mentioned.
• Different types of consent are not distinguished (e.g. express, implied and deemed consent).
• The Code does not elaborate upon the issue of notice. What constitutes a reasonable effort to advise an individual on collection of personal information?
• It is unclear if retention of personal information constitutes a “use” under the Code. If so, retention would require consent from the individual.
• The Code does not require businesses to explain the purposes of personal information collection to its customers. This has led to widespread failure of customer service representatives to reasonably explain the purposes of information collection to the ordinary consumer.
• The principle of openness is only encouraged, rather than required.

Summary

The CSA Model Code for the Protection of Personal Information presented a foundation for Canadian privacy protection legislation, such as the PIPEDA. A number of Canadian businesses and organizations have modeled their own privacy codes, policies and practices on this standard. Individuals have also used the Code to understand their privacy rights and protect their personal information. Over time, provisions in need of greater clarity or strengthening have been identified in the CSA Code.

CIPP/C Preparation

In preparation for the Certified Information Privacy Professional/Canada exam, a privacy professional should be comfortable with topics related to this post, including:

• Canadian Standards Association (II.A.a.)
• Model Code for the Protection of Personal Information: CAN/CSA-Q830-96 (II.A.a.i.)

The Privacy Commissioner and those assisting the Office of the Privacy Commissioner (OPC) act as advocates for Canadians’ privacy rights. The OPC takes and investigates privacy violations and brings citizens’ concerns to the federal government. Like all federal government agencies, the OPC is funded through the Treasury Board Secretariat, which enables it to fulfill its responsibilities under the Privacy Act as well as the PIPEDA.

Organizational Structure

The OPC is headed by the Privacy Commissioner and two Assistant Commissioners. Canada’s current Privacy Commissioner is Jennifer Stoddart, who oversees investigations and reports directly to the House of Commons and the Senate. The Privacy Commissioner is appointed for a seven-year term. The Privacy Commissioner is assisted by two Assistant Commissioners – Chantal Bernier and Elizabeth Denham, responsible for the Privacy Act and the PIPEDA, respectively.

The OPC is organized into seven branches, whose responsibilities are as outlined below:

• Investigations & Inquiries

• Investigates individual complaints under the Privacy Act and the PIPEDA, as well as complaints not filed under those provisions.
• Assists federal government departments and organizations in preventing violation of privacy legislation.

• Audit & Review
  • • Conducts audits to assess organizations’ compliance with the Privacy Act and PIPEDA.
    • Provides recommendations on privacy impact assessment reports (PIAs).
    • Research, Education & Outreach
      • Conducts research on privacy and technology concerns and the promotion of protecting personal data.  
      • Supports policy development, investigation, audit and public education programs.
      • Communications
        • Provides strategic advice.
        • Supports communication and public education activities.
        • Plans and implements public education activities through media monitoring, public opinion polling, media relations, publication and special events.
        • Legal Services, Policy & Parliamentary Affairs
          • Provides strategic legal and policy expertise and legal advice and support to the OPC.
          • Represents the OPC before Canadian and international courts.
          • Monitors legislative and government initiatives.
          • Human Resources
            • Provides strategic advice, management and delivery of HR programs.
            • Corporate Services
              • Provides advice and administrative services, including corporate planning; resource management; financial management; IT and general administration. 

In addition, the OPC regularly consults with an External Advisory Committee, which offers multiple perspectives on public policy and privacy issues. The External Advisory committee is made up of professors, industry association leaders, privacy consultants and other experts.

There is also an Internal Audit Committee, which provides advice and recommendations to the Commissioner regarding the quality and efficacy of the OPC. The Audit Committee oversees core areas of OPC responsibilities and accountability. It takes these findings and integrates them into the OPC strategic planning and priority setting processes. This reinforces the audit regime promoted by the OPC, thus strengthening the independence and accountability of the OPC.

Responsibilities

The mission of the OPC is to protect and promote privacy rights of individuals. The OPC is responsible for overseeing compliance with federal privacy legislation: the Privacy ACT and the PIPEDA. Although the OPC reports to the federal government, it functions independently from any other part of the government and often carries out investigations regarding the federal public sector.

The OPC also has the jurisdiction to investigate matters regarding personal data in the private sector, except in provinces that have established substantially similar privacy legislation. These provinces are Quebec, British Columbia, Alberta and, to a certain extent, Ontario. The OPC functions at the federal level, which means it provides advice and recommendations only. Provincial privacy commissioners’ advice is binding.

While the Privacy Commissioner aims to resolve issues through negotiation, mediation and conciliation, the Commissioner also has the authority to summon witnesses, administer oaths and demand evidence, in situations where this would be appropriate, or if cooperation is withheld. The Commissioner also has the authority to take investigations to the Federal Court for resolution.

The Commissioner, supported by the OPC is responsible for carrying out a number of advocacy activities, which include:

• Investigating complaints made under the Privacy Act and PIPEDA.
• Issuing reports in response to federal government departments and private sector organizations.
• Bringing unresolved matters to Federal Court.
• Providing individuals (i.e. citizens, permanent residents, corporations) with access to personal information records under the Access to Information Act.
• Creating new and revise existing privacy impact assessments.
• Engaging with government institutions, industry associations, academia, legal community, professional associations to proactively promote public awareness on privacy issues.
• Partnering with privacy stakeholders throughout Canada and internationally to identify and respond to global privacy issues arising from transborder data flows.

The OPC helps individuals gain access to personal information held by the federal government. One resource is Info Source, a public directory that enables individuals to identify which government agency has personal information, what type of information as well as the contact information for requesting or correcting the personal data. The goal of Info Source is to enable individuals to exercise their rights under the Privacy Act and the Access to Information Act. Using Info Source is part of the procedure for filing formal requests under the Privacy Act.

In order to promote privacy safeguarding practices, the OPC hosts consultations with Canadians on a number of key challenges. The purpose of these consultations is to learn about industry practices, explore privacy implications, learn about Canadians’ privacy expectations and promote discussions on privacy implications that arise as a result of new technological developments. Consultations consist of a series of one-day panel discussions presenting the broadest perspective as possible.

OPC Complaint Process

The Privacy Commissioner has the authority to investigate all complaints made by individuals under the PIPEDA or the Privacy Act. Such complaints may include challenges accessing personal information from an organization or government department, or an individual believing that unnecessary personal data is being collected.

The Investigations & Inquiries branch of the OPC handles thousands of public inquiries annually. Filing a complaint is free for the public and all consultation is provided by the OPC. The Commissioner works independently to investigate potential violations, thus the Commissioner does not act as advocate for personal privacy rights.

The investigation process includes:

• Clarification of complaint.
• Communication with the respondent organization to determine if there have been corrective actions taken or proposed.
• Examination of records and carry out interviews.
• Analysis of information obtained.
• Determine if there is a basis for making findings or recommendations.

If the OPC determines that the complaint is well-founded, then it will make a post-investigation report, which includes:

• Summary of both parties.
• Findings and recommendations
• Determining if an agreement has been reached.
• Request of proposed recommendations and actions to be taken by the organization, if necessary.
• Recourse to the Federal Court, if appropriate.

Areas of Focus

In recent years, there have been a number of notable investigations and areas of focus for the OPC, under the leadership of Commissioner Stoddart. These include:

• Online Social Networking
  • Social networking sites, like Facebook, MySpace, or LinkedIn often do not comply with Canadian privacy policies and practices.
  • The OPC has conducted numerous public opinion polls and events to raise public awareness regarding the privacy implications of online social networking.
  • As a result of OPC investigations, Facebook has agreed to make the appropriate changes to their privacy policies and practices in order to comply with Canadian privacy legislation.

• TJX Data Breach
  • TJX is an American retail corporation which operates outlets in Canada as well as Puerto Rico, the UK and Ireland.
  • In 2007, the OPC investigated a major data breach involving a network computer intrusion which affected 45 million payment cards worldwide.
  • The OPC maintained that every organization in Canada will be held to the principles established in the PIPEDA or other provincial privacy legislation.
  • Recommendations from this investigation included: implementing multiple layers of security; keeping up to date with technological advances; and, most importantly, not collecting or retaining personal information unnecessarily.

• Increase private sector awareness
  • The OPC has published numerous resources and conducts regular training and education programs to ensure that the private sector is aware of its responsibilities under the PIPEDA.
  • One concern is ensuring that small and medium businesses are also kept abreast of privacy policies and practices. The OPC helps support such businesses in complying with privacy legislation by promoting the business benefits of doing so.

• Promote youth privacy online
  • OPC research has shown that the majority of Canadian youth ignore the privacy settings and security rules on online social networks.
  • As a result, the OPC has launched an online resource to educate youth about privacy practices and to generate discussion regarding the effects of new technologies and social networking tools on their privacy.

Summary

This article gives an overview of the role of the Privacy Commissioner of Canada as well as the Office of the Privacy Commissioner (OPC). It introduces the legislation which protects Canadian privacy rights: the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA). The OPC’s responsibilities, services and complaint procedures are also described.

CIPP/C Preparation

In preparation for the Certified Information Privacy Professional/Canada exam, a privacy professional should be comfortable with topics related to this post, including:

• Canadian government and legal system (I.A.a.)
  • Office of the Federal Privacy Commissioner (II.B.e.i.1.a.)