Locking The Virtual Door: Privacy Matters In E-Commerce

The SAXLAW Report
Spring/Summer 1999

One of the many setbacks in the advance of e-Commerce has been fear due to a lack of privacy and the misuse of personal data over the Internet. In June of 1998 a US Federal Trade Commission took a survey that found 92% of 1400 sites collected personal information about visitors, but only 2% had a comprehensive privacy policy. Due to a lack of privacy and the misuse of personal data, businesses and consumers are up in arms about such violations. These can take several forms including: collection and recording of inaccurate data without the ability for the data to be corrected, the improper transfer or sale of data to third parties, and the collection of data without consent. This data can range from financial records to sensitive personal material.

In 1995, the European Union began drafting the first significant electronic privacy legislation. On October 1st, 1998 this legislation was set to work, setting into motion instant change in North American policy. This is due to the fact that under Article 7a of the EU directive, privacy initiatives must be in place on both sides of an electronic transaction. This said, it is also the responsibility of the third party to provide privacy protection. This posed a problem for third party countries, because they were now restricted with e-Commerce, due to a lack of privacy legislation on their behalf. If no privacy legislation existed, then a party from a third country must have individual cases approved by the EU.

The Canadian Federal Government is in the process of meeting privacy demands with Bill C-54, an act that amends the existing federal privacy legislation. Bill C-54 will guarantee the privacy of personal information as collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions. If passed the Bill will come as a great relief to Canadians who wish to conduct e-commerce, but have been fearful of the repercussions. It was hyped by Privacy Commissioner, Bruce Phillips as, "Â…the most significant advance in protecting Canadians' information since the Privacy Act regulated federal government handling of personal information in 1983."

Despite the effort on behalf of the Federal Government, not all in the Canadian private sector feel strongly about the proposed set of laws. The organization of Canadian General Accountants claims that Bill C-54 will not do enough to protect the privacy of consumers "It does not go far enough in extending privacy protection outside the domain of commercial activity." said John Yu, spokesman for the CGA. The Bill only lays out 10 rules on how personal information can be collected, used, and shared in commercial practices. The CGA feels that what is needed is a full scale privacy legislation that protects all users of the Internet from infringements in their personal and professional privacy.

The United States has not been as cooperative with the demands of the EU, as Canada was. Due to a tradition of individual rights over the collective, and a will not to have their destiny determined by others, the American government, (led by the Federal Trade Commission) has favored a policy of self regulation in the area of privacy. Businesses, individuals, and corporations (with specific emphasis on those conducting the e-Commerce) are responsible for the security of those involved in any electronic exchange of information.

In the eye of the public, the issue of privacy is still extremely important. This was demonstrated recently when Intel announced the release of their Pentium III processor. One of the significant features of the Pentium III was that it labeled each chip with a Personal Serial Number. The PSN can be traced and identified by other computers on the world wide web. The initial purpose of the PSN was to give the ability to trace e-Commerce transactions between buyers and sellers. Upon hearing this announcement there was a tremendous public outcry that this would constitute an invasion of privacy, and that the chip had to be modified. Intel, aware of public concerns, has installed software that allows individual PSN's to be turned on and off at will.

As the technology evolves at an ever increasing rate, it is extremely difficult for government organizations to respond with changes in legislation. However, there is a public consensus that something must be done (either by government or by the industry) to ensure what's mine stays mine and what's yours stays yours.

THE SAXLAW REPORT has been prepared by Michael M. Sax with assistance from David Sax and Annalysa Cabral for information purposes only and does not constitute a legal opinion. This representation is not intended to create, and the receipt of it does not constitute a solicitor-client relationship. Readers should not act upon this information without seeking professional counsel. This information is forwarded on the basis and understanding that Michael M. Sax, Barrister & Solicitor is under no responsibility or liability whatsoever in respect thereof.