But can an individual request that personal information be deleted under PIPEDA?

And if so, how can that individual verify that personal information has indeed been destroyed?

On the surface, PIPEDA does not seem to give individuals the right to request that organizations delete their personal information upon command.

This doesn’t mean that the personal information an organization collects has to linger in a database forever. If we dig deeper into the legislation we find privacy principles at play that work harmoniously to achieve a similar objective.

Let’s see what PIPEDA says about consent, data retention, and personal information after an organization has collected it.

Withdrawing Consent under PIPEDA

According to the third privacy principle of PIPEDA — Consent — an individual has the right to withdraw his or her consent at any time subject to any legal or contractual restrictions.

The individual must give the organization reasonable notice and the organization must inform the individual about the implications of withdrawing consent, if any.

That doesn’t solve our problem though. An organization is still in possession of your personal information even if you withdraw consent from it being used or disclosed. Data retention periods determine how long personal information will be kept for.

Minimum and Maximum Retention Periods

The fifth privacy principle of PIPEDA — Limiting Use, Disclosure, and Retention — states that an organization should implement minimum and maximum retention periods for personal information and should only retain personal information for as long as it is required to fulfill its intended purposes.

An organization may choose to hold all personal information it collects for a minimum of one year after its intended use and disclosure. It should be long enough to allow an individual to request his or her personal information, especially if it has been used to make a decision about that individual (e.g. a pre-employment check).

An organization may also be subject to legislative requirements with respect to retention periods.

If an organization is subject to an access request it should retain that information for as long as is necessary to allow the individual to exhaust any recourse under PIPEDA.

Once an organization has retained personal information for a maximum period, it must destroy, erase (delete), or make the information anonymous.

Destroying, Deleting, and Anonymizing Personal Information

Clause 4.5.3 of PIPEDA’s Limiting Use, Disclosure, and Retention principle states:

Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.

Rather than deleting or erasing full records containing personal information, many organizations find benefit in “anonymizing” personal information instead. This allows organizations to retain statistics about records while at the same time removing all traces of personal information from a record.

The problem with this technique is that it is sometimes possible to reverse-engineer “anonymous” data sets by combining that information with other publicly available information.

For example, in 2006 Netflix published 10 million movie rankings by 500,000 customers. The data set was made anonymous by removing personal information descriptors from the set. Through reverse engineering, researchers at the University of Texas were able to de-anonymize some of the data by comparing rankings and timestamps with public information available from the Internet Movie Database (IMDb) (full story).

Legal Recourse under PIPEDA

PIPEDA’s Openness principle states that organizations need to be open about their policies and practices with respect to how personal information is managed.

If you want to know how long your personal information is retained for or how it is disposed of after its retention, write a letter or email to the organization. The privacy officer or personal responsible for privacy compliance should be able to explain what happens with your personal information.

If you think the organization retains your personal information for too long or does not dispose of it properly, try working it out with the organization. If that does not work or you are unsatisfied with the response, you may file a compliant with the Office of the Information and Privacy Commissioner of Canada. The routine is similar for organizations subject to privacy legislation in BC, Alberta, and Quebec.

More Information

• How Privacy Law in Canada Works
• PIPEDA – The Ultimate Guide
• The 10 Privacy Principles of PIPEDA

The post Can Personal Information Be Deleted Under PIPEDA? appeared first on PrivacySense.net.

One of the ongoing struggles that privacy professionals around the world endure, particularly privacy officers, is convincing senior management in organizations that the management and security of personal information is extremely important. I have personally worked for two organizations where I encountered the same hurdle.

The longer a company retains data, the more of a liability it becomes.

And now, as if senior management wasn’t hard enough to convince before, it has become more difficult since businesses lack finances to adequately manage and safeguard your data, especially if businesses are not yet complaint with privacy legislation.

When Companies Fold, What Happens to your Data?

“Certain companies have been disposing of records containing sensitive consumer information in very questionable ways, including by leaving in bags at the curb, tossing it in public dumpsters, leaving it in vacant properties and/or leaving it behind in the offices and other facilities once they’ve gone out of business and left those offices,” says Jacqueline Klosek, a senior counsel in Goodwin Procter’s Business Law Department and a member of its Intellectual Property Group.

That’s a scary thought.

If a company goes bankrupt, its storage devices are also usually sold to competitors “specifically with the intention of trying to salvage the data.”

In addition, when businesses are in the process of going bust, protecting their data may be one of their last concerns.

“When a company fails there is less concern about fines for non-compliance when there is no one left to pay the fines,” says John Gunn, general manager at Aladdin Knowledge Systems North America.

After all, if there’s no money, no employees, and no company left, who is left to bear the costs and shame of a privacy breach?

Making ends meet

Another reason your personal information is less safe in a weak economy is that when the economy is weak, people are more likely to engage in criminal activity in order to make ends meet. This means that there is more of a market for stolen personal information, and that criminals are more likely to have the time and resources to commit identity theft.

There are a few things that you can do to protect yourself, however. First, you should keep an eye on your credit report and credit card statements for any unusual activity. If you see anything that you don‘t recognize, report it to your credit card company or the credit bureau immediately. You should also be careful about who you give your personal information to, and only do so when you are sure that the person or company is legitimate. Finally, you should consider investing in a good credit monitoring service, which can help you keep track of your credit report and alert you to any suspicious activity.

While you can‘t completely protect yourself from identity theft in a weak economy, taking these precautions can help you minimize your risk.

The post Is Your Personal Information Safe in a Weak Economy? appeared first on PrivacySense.net.

In fact, one of the 10 privacy principles of PIPEDA was crafted entirely to provide individuals with access to their personal information.

When requesting information under PIPEDA you must do so in writing. Be sure to include enough information so that the organization may identify you and your records. This may include your full name, address, account or order numbers, and the approximate date that you provided the organization with personal information.

You should address your letter to the organization’s privacy officer. However, because many organizations are small and may not have someone specifically employed as a privacy officer, you can address the letter to the organization’s secretary, customer service, compliance, or legal department.

Here is an example:

Dear Sir/Madam,

Under section 4.9 of Schedule 1 of Canada’s federal privacy legislation — The Personal Information Protection and Electronic Documents Act — I am requesting a copy of all records which contain my personal information from your organization.

You are obligated to provide copies at a free or minimal cost within thirty (30) days in receipt of this letter. If you choose to deny this request, you must provide a valid reason for doing so under Canada’s PIPEDA. Ignoring a written request is the same as refusing access.

If your organization fails to provide a reason within thirty (30) days, I may file a complaint with the Office of the Privacy Commissioner of Canada.

Please let me know if you require additional information from me before you proceed.

If you do not normally handle these types of requests, please forward this letter to the person in your organization responsible for privacy compliance.

Here is information that may help you identify my records:

Full Name:
Address:
Birth date:
Account #:
Order #:

Sincerely,
Your Name

How Do I Know of PIPEDA Applies?

PIPEDA will apply to the commercial transactions of organizations operating in Canada’s private sector (read more about Canadian privacy legislation).

More specifically, PIPEDA applies to organizations that are federally regulated and fall under the legislative authority of the Parliament of Canada, such as the telecommunications and broadcasting industry, and all local businesses in Yukon, Nunavut, and the Northwest Territories.

In addition, PIPEDA applies to the private sector of each province unless a province has enacted its own privacy legislation that is substantially similar to PIPEDA, such as British Columbia, Alberta, and Quebec.

Credit unions in Canada are subject to PIPEDA. This is why you can request a free copy of your credit report.

Know More

Learn more about Canadian privacy legislation, your privacy rights under PIPEDA, or the individual access principle.

The post How To Request Personal Information under PIPEDA appeared first on PrivacySense.net.