August

"A review of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) is long overdue, said privacy commissioner Jennifer Stoddart. Specifically, Stoddart would like to see better transparency when law enforcement agencies and government organizations access the personal information of Canadian citizens without their consent. ""Parliamentary schedule seems to overlook the fact that PIPEDA requires such a review every five years,"" said Stoddart, who noted that updating federal privacy regulation is a big concern. ""The last review was scheduled in 2006."" Information covered under PIPEDA includes a person's name, email address, health records, financial information, Social Insurance Number (SIN), and even fingerprints. Under the current act, Canadians' personal information may be obtained from such organizations for a wide range of purposes, including for issues of national security, intelligence gathering, and the enforcement of Canadian law. Stoddart suggests clarifying PIPEDA's use of lawful authority to determine under what circumstances, and by which authorities, personal information can be accessed and she also hopes to see changes to the way that PIPEDA governs the protection of personal information as it relates to corporate responsibility. "

Many businesses are not complying with Alberta's law surrounding the collection, use and storage of customers' personal information, says the province's privacy office. The Personal Information Protection Act (PIPA), has been law for nine years, but a survey conducted by Alberta's information and privacy commissioner found 50% of companies haven't trained staff on protecting customers' information. A recent example of this involves an Edmonton woman who received a series of late-night text messages from a mechanic at Sherwood Ford who got her number when she had her car serviced, more than a year ago. Her privacy complaints to the company, the RCMP, Ford of Canada, and the Better Business Bureau, were ignored and dismissed. Brian Hamilton of the privacy commissioner's office says the case raises several concerns, including how many people in a business have access to customers' personal information. A greater privacy breach is using a customer's contact information for purposes other than the business reason for which it was gathered. The woman said her complaint would never have gone so far if the company had taken her concerns more seriously.

The law around references given to prospective employers by ex-employers is changing. There is no positive obligation on an employer to provide a reference for an ex-employee. On the other hand, the failure of an employer to give a reference has been found to be a factor courts will consider when determining the period of reasonable notice in a wrongful dismissal case. There are also risks in giving references. Whatever reference is given, and however it is given, it must be truthful. There have been cases where an employer has been sued for giving a false reference. There have also been cases where writers of 'bad' references were found to have defamed the person for whom the reference was written. If an employer is going to give references, it should have a policy, or standardized reference process. A policy helps to ensure consistency. A policy may also help an employer avoid liability in a case where a reference is given by someone not authorized to do so, and which is not in keeping with the employer's policy. Employers should also require, as a practice, consent from job applicants to seek out references.