30Th Anniversary of the OECD Privacy Guidelines

30th Anniversary of the OECD Privacy Guidelines

Remarks by Jane Hamilton, Industry Canada

OECD

Paris, France (March 10, 2010)

Pleased to be part of this panel and speak to you today about the OECD Privacy Guidelines from an Industry Canada perspective.

That is to say, from the perspective of the Government Department in Canada that developed, and now continues to administer,Canada’s private sector privacy legislation.

The OECD Privacy Guidelines are the definitive benchmark against which virtually all subsequent instruments have measured themselves to demonstrate soundness and credibility and Canada, proudly I might add, is part of that tradition.

The Guidelines, which are technology neutral, easy to understand and flexible, served as the basis for Canada's federal private sector privacy law and subsequently its provincial private sector privacy laws.

This demonstrates that the objective of the Guidelines to establisha cohesive, well-aligned set of privacy “”rules” internationally, adapted well to the realities of countries that also face challenges related to the free flow of data at the sub-state level, in our case, at the level of Canadian provinces and territories.

Also of interest,is the way our legislation evolved. Namely, moving from a national standard developed on a consensus basis by a multi-disciplinary stakeholder group, to a legislative approach that had the support and buy-in of those original stakeholders.

This is further evidence of the flexibility of the Principles-based approach encompassed in the Guidelines, in that they can form the basis for a standard, as well as national legislation. Going forward, preserving these attributes in the Guidelineswill be key.

In addition to assisting government in this way, the flexibility built into the OECD Guidelines allows organizations to adapt their requirements to their own needs and circumstances. This means that they can take practical and cost-effective approaches to meeting their obligations. A very important consideration from the perspective of the marketplace.

This consumer empowerment is a key policy objective in our national legislation as well. Consumers are empowered under the principles of“Individual Participation” (which provides for access) and “Use Limitation” (which requires consent).

On the subject of consent, there is widespread recognition that increasingly complex data flows and new service offerings are putting pressure on the notion of consent……..(we heard from Justice Kirby that this will be an important element of the Guidelines to revisit in light of the new pressures on the concept of consent).

Within Canada, individual control continues to be highly valued and we continue to work towards ensuring that consent is not “symbolic” or “fictitious” (in the words of Justice Kirby).

In the 30 years since the Guidelines have been in place, dramatic advances in technology have fundamentally changed the way data is collected, used and shared……..And yet, the Guidelines remain relevant.

Theycontain key principles that allow countries to build on, and expand as required, to address national values and priority policy objectives.For example, the accountability principle means that Canada's privacy regime extends to third-party service providers that may be located outside our borders. Again, a matter of key importance to Canadians.

The concept of accountability is increasingly attracting attention internationally as an enforcement mechanism for privacy protection but as I understand others on this panel will be delving into that subject in a little bit more detail, I will leave my remarks there on that particular subject.

The Guidelines continue to withstand the test of time. In contrast, laws are more evergreen instruments thatare periodically adjusted to address new issues.

Canada is currently in the process of its first parliamentary review of itsprivacy legislation. We have heard (from stakeholders and the Parliamentary Committee that reviewed the law), that our Act is working well and that only some fine-tuning of the legislation is required. This attests to the effectiveness and continued relevance of the legislation.

However, the review presents the opportunity to do improve the effectiveness of the legislation and to further clarify certain obligations for business. By way of example, like the Privacy Guidelines, Canada’s privacy law includes a safeguarding principle.

To further expand upon this principle, we areproposing amendments to include data breach notification requirements. The legislative approach we plan to takewill be risk-based with a view to not being overly prescriptive.

We expect that the safeguarding principle will be the subject of much discussionin the assessment ofthe OECD PrivacyGuidelines and theever-increasing need for organizations to improve on security practices and procedures … (which is so dear to the hearts of the WPISP members in the room today).

The next five-year review of our legislation will soon be upon us. Our federal Privacy Commissioner will be holding consultations to assess the impact of new technologies and these discussions will help inform this next review.The changing business models anddramatic increases in global data flows have started an internationalstocktaking trendand these various processes (particularly the current review of the OECD Guidelines) will also be informative.

Of particular interest to Canada is the work the OECD is undertaking to better understand the extent to which personal information is integrated into business models and its contribution to economic activity, company performance, and the Internet economy as a whole. The intention here is to not view the economic dimensions of privacy protection in isolation, but rather in conjunction with a wide range of other considerations related to privacy protection. (e.g., in the context of democratic values as Justice Kirby reminded us).

As such,we fully support theplanned roundtable on the “economics” of privacynext December and look forward to thediscussion and debate that will take place at that time.

We view the Guidelines as having played a significant role in the development of Canada's privacy law for the private sector as well as having a continuing impact despite major changes in the marketplace.

It is important to maintain these high-level flexible Guidelines to guide countries as they continue to seek to adopt internationally aligned approaches to privacy protection and encourage the free flow of data that is now required for trade and economic growth.

Page 1 of 3