The law closes a gap in Canadian law. Until C-6, no Canadian federal legislation protected personal information in the private sector, although such data is federally guarded in the public sector. C-6 governs collection, use and disclosure of, and access to, personal information in the private sector.
Implementation marks the first step in a three-year process.
Businesses in federally regulated industries, such as telecommunications, financial services, and airlines, must immediately comply with the law. Medical information will fall under the rule in 12 months, followed by all remaining commercial businesses that handle information by January 1, 2004. Two months after the Safe Harbor agreement became effective, few U.S. firms have agreed to abide by the pact. To date, only about a dozen firms have signed up for Safe Harbor, which was designed to make it easier for U.S. companies to comply with stringent EU data privacy laws. If a U.S. firm signs up for Safe Harbor and is certified, EU officials and companies can have confidence that the firm follows reasonable privacy protection policies.