Interview with Frank Work

December 2003

Terry McQuay, Nymity's President, recently interviewed Frank Work, Information and Privacy Commissioner of Alberta to gain insight into Bill 44, the forthcoming Personal Information Protection Act (PIPA).

Date of interview - November 24th, 2003.  Alberta's PIPA was enacted as Bill 44, Personal Information Protection Act, received third reading on December 3, 2003, and was passed by the Alberta Legislature. The new law is scheduled to come into force on January 1, 2004.

To view bill and amendments see:
http://www.assembly.ab.ca/pro/bills/ba-bill.asp?SelectBill=044

Nymity: When do you expect PIPA to be deemed substantially similar?

Work: I am not sure but I suspect around April of 04.

Nymity: Are Alberta-based companies required to comply with PIPEDA and PIPA for consumer information? What if PIPA is substantially similar? What if it's not? Is compliance required with one or the other, or both?

Work :  There is a lot of uncertainty surrounding this. A lot depends on the nature of the company. Some (i.e. airlines) are under Federal jurisdiction. Some are provincial. Generally, I would think any organization which is compliant with PIPEDA would be compliant with PIPA (since the laws are substantially similar). The Federal law regulates "transborder data flows". I am not sure the extent to which this extends Federal jurisdiction. We are working on that one.

Nymity:  If PIPA is not deemed substantially similar, will Alberta-based companies and companies with operations in Alberta be governed by PIPA for employee information?

Work: Yes, PIPA will be the law in Alberta, substantially similar or not. The ability of the Federal government to regulate employees of provincial entities is limited by the Constitution.

Nymity:   In 2004, when a complaint against a private sector organization reaches your office, what process will you follow to decide if the organization is governed by PIPEDA or PIPA?

Work: The complainant first has to go to the organization. If there is not resolution there, the complainant comes here. One of our case workers tries to bring about a resolution. If that is not possible, I hold an oral or written inquiry and may issue an order. I cannot impose fines or penalties or award damages.

Nymity:  For organizations that collect, use and disclose consumer information, what are the major differences between BC's and Alberta's PIPA?

Work:   The Government in BC and AB are analyzing that. I expect something to be on a website soon. Keep in mind that the Bill 44 has not seen third reading. I'm confident that details on collection, use and disclosure of consumer information will be addressed over the next two weeks (during the Fall Session of the Alberta Legislature).

Nymity:   What are the major differences from BC's and Alberta's PIPA with respect to employees?

Work: Once again, the legislation is only at first reading. The Government of Alberta will have 10 sitting days to deal with details presented to them by government lawyers who have been working on the regulations this past summer.

Nymity:  How is your office gearing up for PIPA? What challenges do you foresee for your office in the first half of 2004?

Work: We are hiring 3 case workers and another lawyer. We already have a private sector Team Leader in our Calgary office. The first task will be education and publicity.

Nymity. What consumer education programs do you expect in 2004?

Work : In addition to our PIPA Guide (already available on our website at www.oipc.ab.ca ), we will utilize public speaking events such as conferences and workshops, a new brochure, media interviews, and public service announcements on radio.

Nymity:  PIPA requires an organization to provide access to the names of the individuals and organizations to whom personal information has been disclosed. Does this include employees who have accessed the individual's personal information? If not, please explain why.

Work : It depends upon how the term "disclosure" is interpreted in the applicable provisions of PIPA. Generally, disclosure of information within an organization for identified purposes is viewed as a "use" of information within the organization, not as a "disclosure" of information.

Nymity:  Providing access to the names of individuals and organizations to whom personal information has been disclosed would require an organization to update their IT systems to track access. Should organizations implement a tracking mechanism that audits access to individuals' information in order to be compliant with PIPA?

Work: A disclosure log or tracking mechanism to document disclosures would be ideal for larger organizations if resources permitted. Low-tech initiatives are a good option and may include an inside sheet located in a folder to log access.

Nymity:  PIPA provides your office with the power to issue a Commissioner's order to enforce the Act. Commissioner orders cannot be appealed, but one can make an application for judicial review. Please explain.

Work: The court is my oversight body. Judicial Review allows the court to review my decisions. The court can set aside, uphold, or remit my decision back to me for further reconsideration.

Nymity:  Are fines allocated for not following Commissioner's orders or for not complying with PIPA, or both?

Work: If someone doesn't comply with an Order, that person is breaching s. 59(1)(f) of PIPA and is liable for a fine of up to $10,000 for an individual and up to $100,000 for a corporation or similar entity.

Nymity: How will your office determine what is reasonable? How is the law positioned to accommodate the problems that would arise if it becomes 'reasonable' to carry out what we would now consider privacy-invasive activities?

Work: "Reasonableness" is a case-by-case determination, considering things like established industry standards and practice, sensitivity of personal information and prudent security precautions.

Nymity: How do you see BC, Alberta, Quebec and the Federal Commissioner's offices working together?

Work: I hope to see exchange of views on general interpretation and administration and a cooperative approach to sorting jurisdiction.

Nymity:  In closing, what advice do you have for organizations with operations in Alberta?

Work: I fully appreciate that compliance is very challenging, especially for smaller organizations. My advice would be to do the best you can and don't hesitate to ask questions.