Politech: Michael Geist's defense of Canada's data collection law [priv]

[Declan McCullagh <declan () well com>]

---

I'm not familiar with the details of Canada's law, but here is an argument 
for privacy-federalism in the U.S., and I presume the principles would be 
the same:
http://www.politechbot.com/p-01687.html
-Declan

---

Date: Mon, 19 Jan 2004 08:53:28 -0500
To: Declan McCullagh <declan () well com>
From: Michael Geist <mgeist () pobox com>
Subject: In Defense of Canada's Privacy Law

Declan,

Of possible interest to Politech -- my regular Toronto Star Law Bytes 
column takes on the recent rise of criticism of PIPEDA, Canada's federal 
privacy  legislation, which has been recently labelled a multi-dimensional 
mess by critics.  The column argues that  replacing the single federal 
standard with potentially  competing provincial laws would be bad for 
business, privacy  enforcement, and relations with the European Union.  The 
column also examines the issues at the heart of the recent  Quebec 
challenge of the law's constitutionality.

Column is online at
<http://shorl.com/dukuhagytrasu> [Toronto Star]

MG

Fighting privacy law questionable
Toronto Star - Law Bytes

In a year of headline-grabbing privacy developments in Canada, the Quebec 
government saved the best for last. On Dec. 17, just days before Canada's 
national privacy law, the Personal Information Protection and Electronic 
Documents Act (PIPEDA), was scheduled to take full effect, the Quebec 
government initiated a constitutional challenge that threatens the law's 
very existence. That challenge will likely kick off before the Quebec Court 
of Appeal early in 2004 and make its way up to the Canadian Supreme Court 
either very late this year or early in 2005.

Critics of the privacy statute have used the constitutional challenge to 
increase the volume of their dire warnings. In the words of skeptics, 
PIPEDA is a "tax," a "multi-dimensional mess," "unhinged," "vague," 
"ungainly" and now "constitutionally suspect." What the critics don't say 
is that the alternatives breed even greater business uncertainty, create 
the prospect for a data trade war with the European Union and simply don't 
make sense in an era where provincial boundaries are largely irrelevant to 
most commercial transactions.

While critics often claim that the privacy law creates uncertainty within 
the business community, the truth is that a diverse collection of 
provincial privacy statutes would create a far more complex - and more 
expensive - legislative framework. Businesses of all sizes that shudder at 
the prospect of complying with a single privacy law, should consider the 
chaos of a framework featuring up
to a dozen potentially conflicting privacy statutes.

The United States has long recognized the danger of multiple competing laws 
addressing the same issue by adopting the doctrine of pre-emption to cut 
off conflicting state laws with a single federal standard. For example, the 
recent decision by the U.S. Congress to pass anti-spam legislation was 
heavily influenced by the dozens of state anti-spam statutes. After 
California passed a state anti-spam law with far more onerous obligations 
than those found elsewhere, Congress was urged to set a national standard 
and pre-empt California's statute.

A world where a typical consumer transaction may involve a product 
originating in British Columbia, a retailer in Alberta, a credit-card 
provider based in Ontario, a call centre in New Brunswick, and an order 
fulfillment provider in Quebec, recognizes that personal data traverse 
provincial boundaries with ease. Arguing that local businesses will 
struggle to comply with PIPEDA misses the larger point: the alternative 
would burden those same businesses with multiple provincial standards.

Critics of PIPEDA also claim that the federal statute lacks effective 
enforcement powers. While I too have argued that better enforcement is 
needed, a move toward multiple provincial privacy laws would actually 
exacerbate the enforcement problem. Quebec's private sector privacy law has 
been in place for
many years, yet there has been little discussion about the need for 
businesses operating in Quebec to comply since the reach of provincial 
privacy commissioners is far more limited than that of a federal commissioner.

By establishing a national privacy minimum but enabling provinces to enact 
their own "substantially similar" legislation, PIPEDA establishes an 
appropriate compromise between the interests of the federal and provincial 
governments. Moreover, it creates regulatory efficiencies by allowing 
businesses to address privacy compliance through a single national standard.

A finding that PIPEDA is unconstitutional would also set off a costly chain 
reaction from the European Union. The EU was an early privacy-law leader, 
establishing comprehensive privacy protections throughout Europe in the 
mid-1990s. The EU sought to extend those protections outside Europe by 
blocking the transfer of personal information to any non-EU member state 
that did not
establish "adequate" privacy protections.

PIPEDA received the EU's seal of approval in 2002, thereby removing the 
threat of data blockages between Canada and European countries.

If PIPEDA is now found unconstitutional, the EU's approval will be lost. 
Each individual province will be forced to obtain its own adequacy finding, 
resulting in a regulatory nightmare that could leave some foreign 
businesses wondering whether the Canadian market was worth the additional 
compliance costs.

Given the serious costs that would be created by the elimination of PIPEDA, 
the stakes in the constitutional challenge are enormous.

The federal government will likely argue that the Canadian constitution 
grants it legislative authority to make laws in relation to trade and 
commerce. The trade and commerce power covers both interprovincial and 
international trade as well as general trade and commerce regulation that 
affects the whole country.

The first, fairly straightforward branch of the power assures that the 
federal government would face little difficulty in demonstrating the 
constitutionality of the privacy law as it applies to personal information 
that is used for commercial purposes between provinces or internationally.

The second, more general (and more contentious) branch was last the subject 
of a Supreme Court of Canada decision in 1989 when the court established 
five indicia to consider when assessing the validity of federal legislation 
premised on the trade and commerce clause.

The indicia include confirmation that a) the legislation is part of a 
general regulatory scheme; b) the legislation is continuously monitored by 
a regulatory agency; c) the legislation is concerned with trade generally 
rather than with a particular industry; d) the legislation is of a nature 
that the provinces jointly or severally would be incapable of enacting; and 
e) the failure to include one or more provinces within the legislative 
scheme would jeopardize the successful operation of the law elsewhere.

Although PIPEDA may have been crafted with these five indicia in mind, 
there are no guarantees once the law is subjected to the scrutiny of the 
courts. The federal government will argue that the law is general in nature 
with broad application, it is monitored by the federal privacy 
commissioner, the provinces could not enact an equally effective statutory 
framework, and, as the EU recognized, the failure to include a single 
province could create a data haven that jeopardizes the protection of all 
personal information. Whether the Canadian courts agree will have a huge 
impact on the future of privacy in Canada.

The Government of Quebec, along with PIPEDA critics, correctly claim that 
the new federal privacy legislation comes at a cost. Where they err is in 
failing to appreciate that the alternatives - whether the absence of 
legislation or multiple provincial statutes - are indeed far costlier for 
business, consumers and Canada's credibility on the global stage.


-- 
**********************************************************************
Professor Michael A. Geist
Canada Research Chair in Internet and E-commerce Law
University of Ottawa Law School, Common Law Section
Technology Counsel, Osler, Hoskin & Harcourt LLP
57 Louis Pasteur St., P.O. Box 450, Stn. A, Ottawa, Ontario, K1N 6N5
Tel: 613-562-5800, x3319     Fax: 613-562-5124
mgeist () pobox com              http://www.michaelgeist.ca

----- End forwarded message -----
_______________________________________________
Politech mailing list
Archived at http://www.politechbot.com/
Moderated by Declan McCullagh (http://www.mccullagh.org/)