10 Principles of Electronic Information Protection
There are 10 principles that have been set out by the Office of the Privacy Commissioner of Canada that have helped set the ground rules for the collection of personal data by the private sector in Canada. All Canadians are protected by the Personal Information Protection and Electronic Documents Act, which provides privacy responsibilities that must be adhered to by private businesses and organizations.
Principle 1: Accountability
When an organization is responsible for personal information, it is the companyâs responsibility to ensure that there are individuals charged with the businessâ compliance to the following principles.
Principle 2: Purpose
Prior to the collection of personal data, the purpose for the data collection must be identified by the organization. Frivolous reasons or unstated and concealed purposes are unacceptable motives for an organization to collect personal data.
Principle 3: Authority
The organization must gain the authority to collect, use, or disclose personal information by obtaining the knowledgeable consent of the individual whose data is in question.There are certain circumstances where it is unacceptable to collect or share personal data. These may include situations involving legal, medical or security matters.
Principle 4: Restricted Collection
The collection of personal data should be restricted to only include information related to the stated purpose(s) of the organization.Only lawful and fair means should be used in the collection of personal information. Personal data should not be collected using deceptive means.
Principle 5: Restricted Use
Personal information should only be used or disclosed for the reasons explicitly stated during its collection. Any use or disclosure of personal information for purposes other than those explicitly stated must be either consented to by the individual or as required by law. Personal information should be retained for no longer than is necessary to fulfill the organizationâs stated purpose(s).
Principle 6: Accuracy
All personal information should be as complete and up-to-date as reasonably possible for the purpose for which it is being used.
Principle 7: Safeguards
Appropriate security safeguards must be in place in order to protect personal information. Safeguards should protect against the following (depending on the situation): loss, theft, unauthorized access, disclosure, duplication, use, or modification. The highest levels of security should be reserved for the most sensitive information.
Methods of protection include:
1.      Physical Security: Locked file cabinets, restricted access to areas.
2.      Organizational Security: Security clearances, limited access.
3.      Technological Security: Passwords, encryption.
The maintenance and protection of personal information is the responsibility of the organization and its employees. The disposal or destruction of personal information should be handled with due consideration in order to ensure that unauthorized parties do not gain access to personal data.
Principle 8: Transparency
The specific policies and practices of an organizationâs methods of handling personal information should be made readily available.
Principle 9: Access
Any individual shall be informed of the existence and use of his or her personal information upon request. Furthermore, an individual shall be given access to this information upon request. Individuals have the right to challenge the correctness and completeness of the information, and have any necessary information amended. Any exceptions regarding an individualâs access to the information should be specific and narrow. The reason for a request denial should be provided to the individual upon request.Â
Reasons for exceptions to access:
Information may be too costly to provide, may contain references to other individuals, or may create security, legal, or proprietary concerns that outweigh the importance of the individualâs request.
Principle 10: Challenges
Individual challenges regarding compliance with the above principles shall be made to designated individual(s) responsible for the organizationâs compliance.
What is not covered in this Act?
Any collection or use of personal data by federal government organizations (as listed under the Privacy Act).
Provincial or Territorial governments and agents of the crown.
An employeeâs name, telephone number, business address, or title.
The collection, use, or disclosure of personal data for personal purposes (ex. Greeting card list).
The collection, use, or disclosure of personal information by an organization exclusively for journalistic, artistic, or literary purposes.