New law targets companies’ privacy policies

A new federal Act, the Personal Information and Electronics Documents Act, taking effect on January 1, 2004, will require companies to assess information they have collected on customers and to take measures to assure its security. The law will take effect in every province except Quebec, which currently has comparable legislation, and British Columbia, which has passed a similar law but not yet set an effective date for the new law.
The law only applies to personal information collected on an identifiable person. According to Anneli Legault, a member of Toronto-based law firm Fraser Milner Casgrain’s Privacy Law Practice Group, prior to Jan. 1 companies need to conduct a quick audit to determine if they collect, use or store personal information in their businesses. This is information about a person, including home address, family members, credit history, income level and the like. If a company does not sell to individual consumers it may have no personal information on site. As well, the federal legislation does not apply to personal information about a company’s employees.
"If you find that you do have personal information on customers you will need to comply with the Act by appointing a privacy officer," said Legault. These companies will also need to draft a privacy policy, ensure that personal information is used only with an individual’s consent and establish safeguards to protect the information. Under the law, all affected individuals will have the right to see information a business holds on them.