Getting to Privacy A Presentation to: Presented by: Mike Gurski

Agenda Background on IPC Privacy why’s and what’s Online Risks (Offline too) Online Privacy –Tasks –Tools P3P

Information & Privacy Commission/Ontario established in 1988 independent review of government decisions and practices concerning access and privacy resolve appeals, investigate privacy complaints, ensure compliance with the Acts, research access and privacy issues and educate the public about these laws.

What’s Drives the Privacy Issue? Large organizations disconnected from clients, gathering detailed data Increasing amounts of personal data, held, consolidated, used New privacy invasive technologies Application of a technology paradigm geared to manufactured goods on humans

Privacy & Security: the Difference Security  Privacy

Privacy & Data Security Authentication Data Integrity Confidentiality Non-Repudiation Privacy > Data SecurityPrivacy = Data Security + Data Protection (FIP) Personal Control Informational Self-determination Informed Consent

Privacy Defined Informational Privacy: The protection and control of any recorded information about an identifiable individual.

Some Headlines Stealing cards easy as Web Browsing –Jan 14, 2000 NSNBC Vast online credit card theft revealed: Hacker hides 485,000 stolen cards on US government computer –March 20, 2000 MSNBC CD Universe 300,000 cards hijacked.

Some more Headlines The Illusion of Privacy –National Post, Dec. 14, 1999 Woman’s one-way trip on information highway –Toronto Star March 23, 2000 Web sites can follow a trail of your data, recording every move –Ottawa Citizen, Jan. 18, 2000

Online Risks Web Bugs Web Cookies…Cookie Synchronization Double Clicks Malicious code Viruses

More Online Risks Unauthorized Access Snooping Spoofing Identity Theft

Remedies Become Privacy Literate –Know the Laws International National Provincial –Visit the Web Sites –Read the Books and Articles

Privacy Literacy Why are you asking? collection; purpose specification How will my information be used? primary purpose; use limitation Who will be able to see my information? restricted access; third parties Will there be any secondary uses? notice and consent; unauthorized disclosure

Who Has What Laws: E.U. Canada United States Other Countries

Current Global Environment E.U. Directive on Data Protection OECD Guidelines on E-Commerce C.S.A. Model Code for the Protection of Personal Information Canada’s Personal Information Protection and Electronic Document Act (Bill C-6) Principles for Consumer Protection in Electronic Commerce- A Canadian Framework U.S. Safe Harbor Proposal

Canadian Online Privacy Context Bill C-6: Personal Information Protection and Electronic Documents Act

The Canadian Privacy Legislative Framework Purpose: –support E-commerce strategy, –enable business with Europe, and –domestically to ensure Canadians feel secure in delving into e-commerce

Bill C-6 & CSA Model Codes: The Ten Commandments Accountability for personal information and shall designate an individual(s) accountable for compliance of principle Identifying Purposes purpose of collection must be clear and done at or before time of collection Consent individual has to give consent to collection, use, disclosure of personal information

The Ten Commandments Limiting Collection collect only information required for the identified purpose and information shall be collected by fair and lawful means Limiting Use, Disclosure, Retention consent of individual required for other purposes Accuracy keep as accurate and up-to-date as necessary for identified purpose Safeguards protection and security required appropriate to the sensitivity of the information

The Ten Commandments Openness policies and information about the management of personal information should be readily available Individual Access upon request, an individual shall be informed of the existence, use and disclosure of her personal information and be given access to that information, challenge its accuracy and completeness and have it amended as appropriate Challenging Compliance ability to challenge all practices in accord with the above principles to the accountable body in the organization.

European Union (E.U.) Directive on Data Protection Non-E.U. countries must be able to meet the test of having an ‘adequate level of data protection’. The absence of private sector privacy protection will serve as a non-economic trade barrier with E.U. and Asia/Pacific-Rim countries.

U.S. Proposed Safe Harbor Privacy Principles Notice Choice Onward Transfer Security Data Integrity Reasonable Access Enforcement

Other Jurisdictions Australia to introduce legislation in the first sittings of 2000 to strengthen self-regulatory privacy protection in the private sector. Asian countries, have developed or are currently developing laws in an effort to promote electronic commerce. Self-regulation is currently the policy promoted by the governments of Japan, and Singapore.

Other Jurisdictions “Many countries in the [South East] region have either adopted comprehensive [privacy]laws or are currently in the process. Hong Kong and New Zealand already have comprehensive acts in force. Taiwan’s act covers the public sector and eight areas of the private sector. The governments of Thailand, Malaysia and India are all currently developing comprehensive data protection legislation”.

More Remedies Tasks –Follow Ben Franklin’s Key Steps Be discreet Leave your SIN at home Go unlisted and non-published for your phone Get a P.O. Box

More Tasks Check out a Web’s Privacy Policy Never provide personal information –over the phone, –to unfamiliar web sites –to clerks (be positive and insistent) Get encrypted

Online Tools (cookie control) ( security sandbox, personal firewall, antivirus) ( encryption made easy) (pseudonymisers) (secure financial transactions)

Privacy Resources

P3P: A Proactive Approach Platform for Privacy Preferences –Consumer sets his/her privacy preference –Web sites set their privacy policy –P3P built into Browsers and Web sites –Allows consumer to be more informed and choose whether or not to proceed into a Web site

P3P: the June 21 Interop Invitation for your company to participate. Interested? Contact Lorrie Faith Cranor:

How to Contact Us Dr. Ann Cavoukian Ph. D. Commissioner, Information & Privacy Commission Ontario, Canada, M5S 2V1 Phone: Web: Info.ipc.on.ca Mike Gurski: