By Colleen Dane
The final phase of the Personal Information Protection and Electronic Documents Act came into effect Jan. 1.
It requires all businesses and organizations to get consent in order to keep their customers’ personal information on file, including what information may be kept on file and what it can be used for.
But because the law applies retroactively, businesses need to notify their clients of any personal information they’ve already collected.
This has made updating files and informing customers a challenge for local businesses.
“It’s incredibly labour-intensive,” says Sue Pentacost, manager of TQ3 Travel Solutions on Slater Street. “We are still updating files — weeks and weeks of inputting data.”
Pentacost says the travel agency sent letters to clients before Christmas, explaining the new regulations and asking for written consent to keep their personal information on file.
“It just seems strange,” says Pentacost.
“We’ve had all this data for years, and it’s always been under the understanding that it was confidential, and now we need consent.”
Deborah Charron, co-owner and pharmacy manager of White Cross Dispensary, agrees.
“It’s been time-consuming getting consent and explaining to everyone,” says Charron.
“We have to inform everyone, but we’ve been (informing them) all along.”
The federal privacy commissioner, who will act as an ombudsman in the enforcement of the new law, says the challenges businesses face now are worth the expected increase in consumer confidence.
“I think it’s ultimately good news,” says Anne-Marie Hayden, spokesperson for the commissioner’s office.
“We think it will lead to a competitive advantage, (businesses) practices’ will be something clients will recognize.”
Hayden also says their office has provided numerous tools to help both businesses and the public better understand the new rules, including guides available through their website and an inquiries line.
This isn’t the first time they’ve had to teach this material to the public.
The new regulations have been phased-in gradually since 2001 and already cover commercial activities by the federal government. This final stage applies to all provinces but Quebec, Alberta and British Columbia, which already have similar privacy protections in place.
This means all Canadians are now protected by these new rules, but some businesses say the lack of public awareness makes the exercise cumbersome.
“A lot of people haven’t heard about it, they look at you like you have three heads when you tell them about it,” says Charron.
She adds that in their case, customer’s normal practices are affected.
For example, without written consent, no one can pick up a prescription for a relative because the labels contain personal information about the patient.
“It slows us down, and some of it actually seems quite silly,” says Charron.
But Hayden reminds businesses that privacy is a large concern for many people.
She says the privacy commissioner’s office will investigate any complaint filed as well as violations they learn about through other means.
“This isn’t a ‘gotcha’ game — we are trying to improve personal information handling practices.”
But Charron says these new rules don’t make significant changes to their handling practices, and that they already took the recommended precautions prior to Jan. 1.
“Privacy has been important all along, nothing’s really different.”