Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada April 21, 2008, Montreal, QC Online privacy and identity A regulatory bodys perspective

2 Internet Use and the Norm o$50 million in sales to Canadians o10 million Canadians use social networking sites o1 million Canadians visit Second Life each week oOver $1 billion in revenue from online advertising Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

3 Issues for the OPC oEnforcing the law in a virtual environment oEnforcing Canadian standards in a global context Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

4 Personal Information Online oConsumption oFinancial institutions oCarelessness of Internet users o25% use privacy settings o3% adjust their cookies Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

5 Educating the Public oBlogs oProtecting yourself when using social networking sites Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

6 Ads Targeted at Consumers oMarketing value oOnline profiling is becoming more accurate oGoogles acquisition of DoubleClick Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

7 Federal Trade Commission oProposed Online Behavioral Advertising Privacy Principles December 2007 oDifferent from Canada Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

8 Jurisdiction in the Virtual World oLawson v. Accusearch Inc. (F.C.), 2007 FC 125 oReal and substantial connection because much of the data came from Canada/was about a Canadian oThe issue of being able to effectively carry out an investigation is separate from the issue of having jurisdiction to investigate Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

9 Outcome oSites that are accessible from Canada may fall under the OPCs jurisdiction for investigations oThese sites must comply with PIPEDA Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

10 PIPEDA Standards oThe Streetview caseGoogle oThe Ticketmaster case oThe private life of avatars Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

11 International Cooperation is Essential oFTC oCooperation oPossibility of intervening in Accusearch Inc.s appeal to the U.S. Tenth Circuit Court of Appeals oOECD oGuidelines on the Protection of Privacy and Transborder Flows of Personal Data Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

12 The Influence of Canadian Standards- TJX oAlberta-Federal investigation oPublic findings oLoss of $60.8 million to date oA reserve fund of $178.1 million set up by TJXthis represents an estimate of total losses Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

13 Security of Personal Information oIdentity theft/false pretence oBill C-27 (An Act to Amend the Criminal Code) oRecklessness as to subsequent use of identity information o…being reckless Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

14 Review PIPEDA oProvision on data breach notification oA clear definition of triggers and thresholds for notification is essential oTwo-step approach: (i) notify those affected by a loss of personal information where there is a high risk of significant harm; and (ii) have a requirement that the OPC be advised of any major loss or theft oOPCneed for objective information on the extent and cause of losses Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

15 Identity in Context oGordon v. Canada (Health)(2008 FC 258) oInformation will be about an identifiable individual where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information. Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

16 Conclusion oCanada oEuropean standards oIndividuals: right/choice regarding protection of their personal information oMultinational companies must ensure they comply with PIPEDA online Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada

17 Conclusion oPrivacy, continually redefined oWyndowe v. Rousseau (2008 FCA 39) oAn individual has a right of access to the information he or she provides in the context of an independent medical exam performed by a third-party doctor and to the final opinion of the doctor oPrivacy Commissioner v. Blood Tribe Department of Health (SCC decision pending) oReview of solicitor-client privileged documents Office of the Privacy Commissioner of Canada Commissariat à la protection de la vie privée du Canada