By ANDREW WAREING
Northern Ontario Business
Protecting customer privacy does not need to be a burden. In fact, it can be a major selling point.
On Jan. 1,2004 the Personal Information Protection and Electronic Documents Act's (PIPEDA) regulations governing private sector use of personal information will come into effect and will require businesses to be careful of how they use personal information collected from clients and customers.
"From a business perspective, businesses are not aware of the breadth and depth of this legislation," says Ian Turnbull, director of the Canadian Privacy Institute. "From a consumer perspective, consumers are not aware of the rights they have. What we're seeing is people aren't getting practical suggestions. Nobody has any sense of how much work it will take to be fully compliant."
"Businesses (have to) get ready for this law and they aren't," says Ontario Information and Privacy Commissioner Ann Cavoukian. "Very few are even aware that they are going to be affected by this law because there has been little education by the federal government. My office has been consulting extensively with business about this legislation."
 |
ANN CAVOUKIAN |
The federal privacy commissioner's office is responsible for public education about the Act, but Cavoukian says this past summer's issues revolving around former privacy commissioner George Radwanski have taken up the agency's attention.
She says she has been averaging about two discussions a week to business groups around Ontario about the legislation.
There are a total of 10 principals with the Act, the first of which is for companies to designate someone as a privacy officer who will be responsible for protecting customer information.
Other crucial principals of the Act demand that businesses inform people of the uses they will have for the information and to not use the information for any other purpose.
"This is big because companies aren't used to this," says Cavoukian. "Companies think that, once they have that information, they can use it to send customers information on new products and in a variety of different ways. With this legislation, they will no longer be able to do that."
Companies must also realize they must have security measures for information they collect and they must also make what information they have on a client available to that client when they ask for it. Failure to comply with the law can result in a complaint by a customer filed with the federal privacy commissioner's office, followed by an investigation and, if found guilty, a fine of up to $100,000.
"I've always taken the position that you may do these things because it is the law, but you should treat privacy as a business issue, not a compliance issue," she says. "There are good business reasons to protect client privacy."
Cavoukian, who has written a book on the issue, says companies not only risk hefty fines for contravention of the law, they also face negative publicity and civil action by people who have been affected. By adopting the principals of the law, companies gain customer confidence that can give them a competitive advantage.
"It's not that it's an onerous law; it's just that businesses aren't accustomed to the consent requirements in this law so they have to be more mindful of these matters," she says.
www.ipc.on.ca
www.privcom.gc.ca
