The new Bill, C-20, lays out sections for businesses who can trade information for business transaction purposes; this covers a vast array of companies who for one reason or another may have pieces of information about you, places you have ordered things for instance. The business transactions include purchases of organizations by a company, mergers, making of a loan, taking of a security interest of an organization, lease and or licensing of organization assets, or an arrangement between two or more organizations to conduct a business activity (they can just pass around your information even if they don't end up fully committing to an actual deal). Also, the bill refers to government institutions and law enforcement who can have access to this information even without a clear reason which is all disguised under intentions of national security.
Businesses are strictly forbidden from letting an individual know about any disclosure of their personal information unless they follow these guidelines:
(i) (in writing and without delay) notify the government institution or party concerned of it's intention
(ii) wait 30 days after the day the day on which the government institution or party concerned of its intention was notified to take action of disclosure
(iii) take action the day which the organization is notified the institution does not object
Also, the third point is subject to stipulations..
Within 30 days, the institution referred to can object on the basis of any of the following they deem the information may relate to:
(a) national security, the defence of Canada or the conduct of international affairs
(b) the detention, prevention or deterrence of money launder or the financing of terrorist activities
(c) the enforcement of ANY law of Canada, a province or foreign jurisdiction, an investigation relating to the enforcement of any such law or the gathering of intelligence for the purpose of enforcing any such law (basically for anything they want- even if you haven't been proved to be doing anything illegal, they can do this all on intuition)
They use terms like "as soon as feasible" when it pertains to your personal information- shouldn't it read "right away" that they would inform you of a breach regarding your private information?
Division 1.1 in the Bill on 'Breaches of Security Safeguards' lays out the course of action if any 3rd party other than them (basically referring to the government or any of its institutions) gains access to personal information- if it's not them, it's illegal. This is all a transparent front to try and kid us into thinking we don't have to worry about what they're doing with our information- just worry about what those pesky 'terrorists' will do with it.
The Bill further reveals that if a business provides information to a law enforcement agency, there is a provision blocking it from disclosing the disclosure to the affected individual. So even if a friendly businessman (oxymoron?) has a conscience and wants to tell you that a certain law enforcement is unjustly investigating you for something ridiculous, he is strictly forbidden by law.
I also found that there are no clear penalties for non-disclosure to individuals, only stating an individual can attempt to go through the Court if they feel they have been violated (if you even ever find out about it, that is!). The Uniform Law Conference of Canada's model data breach notification statute envisions penalties for non-compliance/non-disclosure still with a "significant/real harm" threshold- key word also being 'envisions'.
Now I offer you a comparison: California law requires disclosure of any breach of unencrypted personal information that has been acquired by an unauthorized person. There is no question of 'real risk', only that an unauthorized individual has acquired the private information.
Florida law provides penalties up to $500,000 for failure to notify an individual and up to $50,000 for failure to document non-notifications of security breaches.
Michigan runs up to $750,000 in some cases depending on circumstance.
States like Louisiana and New Hampshire establish private rights of action that provide for civil actions to recover actual damages sustained by individuals in cases of security breaches.
The basis of the whole act is for the government to monitor anyone and everyone it chooses without court approval/warrant of any sort, on a 'as we deem fit' basis with no benefit of disclosure to the citizens to let them know what's going on (echoes of Clinton and Echelon come to mind or the tactics of the many dictators who have arrested their people without providing a recognizable crime as reason for their actions).
In the Privacy Act, under the 'Collection of Personal Information' it states: "no personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution". This is not based on your rights, but as long as it serves a purpose to the government it's totally fine. Even if the purpose is just to keep a tighter grip on the lives of the citizens, this does not need to be explain- it falls under relating directly to a program or activity of the government. Isn't this just another variation of the ways that many radical leaders have gathered up specific demographics, by collecting information under false pretense? I'm sure the Jews of Europe didn't envision being filtered into ghettos and then getting burned alive when they were all asked to provide information about their ancestry.
It also states an individual will not be told if the government feels it will result in "collection of inaccurate information" (a.k.a if they told you what it was really for you probably wouldn't tell them shit) or "defeat the purpose of prejudice the use for which information is collected"- notice how the word 'prejudice' slipped in there? What prejudice could they use the information for? Again, is this how British Columbia rounded up Japanese-Canadians after Pearl Harbor, by asking for information in disguise as some other purpose?
Bill C-20 basically repeals a lot of good things for citizens from the Privacy Act and then adds a lot more controlling language. My worry is that the more countries we open up freed trade with, the more of our information will be exposed because these countries now have access to all the market information involved with whatever they are trading. This creates a whole new world of privacy issues. Obviously the aim of free trade is good intentions, but coupled with a Bill like this it comes with the potential of great risk to personal information. Certainly if the government were concerned about the citizens over false concerns for the nation, maybe we could count on them to protect our valuable information even while opening free trade with many other countries across the world. Unfortunately we do not have the benefit of having a government concerned with the plight of us 'small' people.
At least we aren't Britain, where the use of CCTV cameras which are numbered at around 1 camera for every 14 people. Until then we can count what blessings we have left but that future is not far off especially under the current leadership.
(Edit- FOR YOUR OWN REFERENCE the Bill in question.. C-20)
