PIAC Submission to Ontario government re: proposed privacy legislation
Sunday, March 31, 2002
Comments to the Ontario MCBS on the Consultation Draft of the Privacy of Personal Information Act, 2002
Key Points
- The draft legislation’s opt-in approach to consent for marketing strikes the right balance between individual privacy and business needs, and reflects clearly expressed public opinion.
- If negative option consent is permitted, it should only be so in limited, specified circumstances, and only where specific conditions have been met. Those conditions should require that the negative option be brought to the individual’s attention, be clearly worded and sufficiently detailed, and be easy to execute at minimal cost.
- The proposed “definition” of implied consent in subs.8(5) is appropriate and should not be revised. If negative option consent is permitted, it should be subject to a different set of requirements, given important distinctions between it and normal implied consent.
- Express consent should not be required where consent can be implied under the proposed test in subs.8(5). Nor should exceptions to the rule of consent be provided where the test for implied consent is met. Such duplication creates unnecessary confusion, suggesting as it does that consent cannot be implied where indeed it can.
- If necessary to address stakeholder uncertainty as to when consent can reasonably be implied under subs.8(5), the legislation or regulations can be used to elaborate further on the circumstances in which consent can be implied, outside the negative option context.
- Exceptions to consent for collection, use and disclosure of personal data in both the health and non-health contexts should be much more limited than in this draft. Particularly where Ontario is proposing broader exceptions than those in the federal PIPEDA, explanation is required as to why such new or broader exceptions are necessary and appropriate. In each case, the most privacy-protective safeguard appropriate (e.g., notice or negative option consent) should be included.
- Regulation-making powers should be far more limited than in this draft. For example, it should not be possible for the government to fundamentally alter the legislation’s scope of application by regulation. Governments should not be able to fundamentally change the application of legislation, or the substantive rights and obligations in it, through a process that does not involve full public scrutiny. Regulation-making powers should be limited to technical matters of implementation. PIAC cannot support legislation which leaves the door open to such substantial narrowing of scope through regulations.