Privacy rights should stand on their own legislative ground. They should be legally recognized on their own merit, not as enablers of electronic commerce. Under the Code, organizations must identify their purposes internally, and must make reasonable efforts to ensure that the individual is advised of those purposes. However, there is nothing to stop organizations from collecting or using personal information for objectionable purposes, as long as they have identified such purposes. Secondly, the Bill fails to separate the requirements of knowledge and consent in those situations where the requirement for consent is waived.
People deserve to be notified of information collection, use and disclosure in almost all cases.
Yet, the Bill, like the CSA Code, treats knowledge and consent as one and the same thing. Wherever the requirement for consent is waived, so is the requirement for notification. We hope that this is an oversight that will be corrected. There is no limit to the types of organizations and activities which can qualify under these exceptions. At a minimum, the use of personal information for research should be permitted only where anonymous information will not suffice, and only with approval from the Privacy Commissioner.