Information Access and Control

Overview

Chair:
Magda Seydegart, Executive
Director, Human Rights
Research and Education Centre,
University of Ottawa

Speaker:
Inger Hansen, Q.C.
Privacy Commissioner
Canadian Human Rights
Commission

Have you stolen any personal information lately? Would your lawyer be able to defend you successfully if you had?

The answer to the first question is probably "maybe." The answer to the second question is: your lawyer would probably get you off. Now, if you had used a telecommunication facility without any "colour of right," you might be convicted of having obtained the service.

The reason I say that you might be able to get away with stealing personal information about another is because the Canadian Criminal Code requires that, before you can be convicted of theft, you must fraudulently and without colour of right take something, animate, or inanimate, with the intent of depriving another of his property or interest in it. If you have taken personal information concerning another, you may be charged with, and possibly convicted of having stolen the paper, or the floppy disc on which the information was recorded. You might get off easily, because the judge would not be able to take into consideration anything but the value of the paper or the floppy disc, perhaps not in excess of $2.

Is that right? Is it adequate? Should the judge not be able to take into consideration the possible harm that might accrue because of loss of informational privacy? Does the possession of information about you represent power in the hands of another? I think so, and I would suggest that anyone who has access to any kind of personal information about you holds some power over you, has some ability to influence you. That person can grant you a promotion, he or she can deny you insurance benefits, he or she can cause you to be fired, can cause you to lose your good credit rating, can nominate you for political office, can target you for marketing of goods or services, can ruin your reputation in the community, can plan to kidnap your children, can forge your cheques, and learn when you are not at home so that your home can safely be broken into, etc., etc.

Why, then, do so many of us give so much information away about ourselves? Why, then, are so many of us careless with our personal information? Why do we leave it around for strangers to find? Why do we give it to those who may not need it? Why do we care so little whether we are allowed to check the records others keep concerning us? Why do we not, as consumers, insist on knowing what others do with our personal information? Why do we not demand to know in advance the purposes for which that information is collected, how long it will be kept, whether it will be kept confidential, or shared liberally with others? And why do we throw out copies of our credit slips and bank statements - without destroying them so that the information they contain may not be recognized? Why do we provide strangers with details about ourselves when they inquire on the telephone or at our door?

I think we should remedy the inadequacy of our laws to protect personal information, particularly considering the capacity of electronic information processing. Let me first say that I do not think computers are bad; I do not think we should stop speedy and accurate methods of processing information. Needless to say, we all give up some privacy in exchange for services, but we must develop new methods to protect ourselves against too much information being collected, against abuse of personal information, against secret and unauthorized use of information. And I do not believe that codification and encryption alone will solve the problem. I do not think we can, nor do I think we should, stop technological progress. Machines speed up processes; machines reduce errors - but machines may also facilitate fraud and minimize our ability to detect such frauds.

Machines allow us to provide selective access to data. Machines are not greedy; machines are not ambitious or devious. Human beings may be, and they invariably deal with the information, before it is codified and after. That is why we need laws to restrain abuse of personal information, regardless of how that information is processed.

The federal government was the first jurisdiction in Canada to enact fair information practices and, for the last four years, it has been my task to see that the government adhered to its own laws, which grant "an individual" the right:

1. to ascertain what records concerning the individual inquiring are used for administrative purposes;

2. to ascertain the uses to which such information has been put since the proclamation of Part IV, which took place on the 1st of March, 1978;

3. to examine such records, or copies thereof, regardless of who provided the information;

4. to request correction of the personal information; or

5. to require a notation on the record if the correction is not accepted.