Many small firms not ready for privacy rules

Confusion surrounds the federal privacy law that takes effect today, with many small businesses unprepared or unaware of the new rules and Quebec threatening a constitutional challenge.

"Many [small businesses] are unaware of the Act and others, who are aware that something's happening in January, are woefully underprepared," said Ann Cavoukian, Ontario's Privacy Commissioner. "It's not rocket science, but it requires some preparation."

The Personal Information Protection and Electronic Documents Act requires that all businesses now get consent from customers before they collect data such as names, identification numbers or credit records.

The Act also requires that businesses explain why they need the information they're requesting and also say how it will be used. Businesses will have to put a specific person in charge of privacy, to handle requests and complaints.

The Act first became law in January, 2001, for federally regulated businesses such as banks and telephone companies.

Today, it comes into effect nationally, except in Quebec, which has had its own privacy law for a decade. And while the federal government has said the Quebec legislation can stand on its own, the Quebec provincial government believes Ottawa has overstepped its constitutional bounds.

But the first problem is the large number of Canadian businesses that aren't ready, Ms. Cavoukian said. According to a survey from earlier this year, about four in five businesses didn't know about the new privacy rules, a figure Ms. Cavoukian says hasn't changed much since the summer.

For those behind the curve, harsh punishments aren't likely, even though fines of as much as $100,000 are possible. According to Catherine Swift, head of the Canadian Federation of Independent Business, federal Privacy Commissioner Jennifer Stoddart has indicated that a more collaborative approach will be taken to help everyone make the grade.

"It's not going to be a police-state approach at all," Ms. Swift said.

Still, of the federation's 105,000 independent business members, each of whom generally has 20 workers or less, many aren't ready.

"The mind isn't focused until deadline," Ms. Swift said. "We've been warning people for over a year."

Big businesses are ready. Robert Sartor, chief executive officer of Forzani Group Ltd., said his company began taking privacy quite seriously around 2000 when it began selling products on-line. "We had a lot of stuff already in place," Mr. Sartor said. "It was a question of making sure it was all formalized."

Calgary-based Forzani is the country's largest sporting goods retailer. Mr. Sartor said it does not share or sell personal information it collects.

Quebec's potential constitutional challenge has been described by several people as a "monkey wrench" in the transition to the new privacy law. Quebec has had its own law since 1993 and privacy has been a part of provincial rules related to civil rights for an even longer time.

In November, Ottawa declared Quebec's law "substantially similar" to the federal law, meaning the provincial law will hold for businesses that conduct business solely in Quebec.

British Columbia and Alberta also have privacy laws coming into effect today but they have not yet been deemed substantially similar.

Privacy has traditionally been a matter of provincial jurisdiction, said Simon Chester, head of the privacy practice at law firm McMillan Binch LLP in Toronto. The federal law was written to apply to trade and commerce, commercial activities that fall under Ottawa's oversight. But Mr. Chester said Quebec feels it's an "affront," wanting to find out "does this exceed the constitutional powers of Ottawa?"

The Quebec government received approval from the Quebec Court of Appeal on Dec. 17 to challenge the federal law. The court of appeal said Ottawa's privacy law "interferes" with Quebec's control of provincial civil rights, adding that Ottawa went too far.

"Canada's top court will get to decide whether this is beyond the powers of Ottawa," Mr. Chester said.

Industry Canada, which is responsible for the privacy act, said it could not comment on Quebec's possible actions.

"The federal legislation rests legally on the trade and commerce power," said Richard Simpson, head of electronic commerce at Industry Canada.

"That's linked very much to the purpose of the legislation, to protect the privacy of Canadians in the Internet economy where information flows nationally and internationally. We needed a standard set of rules to protect privacy of information."

Another prominent lawyer also thinks the Quebec case will likely proceed.

"This case will undoubtedly go to the Supreme Court," said Michael Geist, a lawyer at Osler Hoskin & Harcourt LLP and a professor at the University of Ottawa.