Daniel Urbas is a lawyer with Woods & Partners. His practice focuses on media law, intellectual property, e-commerce and litigation. He can be reached at durbas@woods.qc.ca
The contents of Publishing Law should not be construed as legal advice offered by Masthead or Mr. Urbas. Readers should consult their own lawyers before acting.
Column for March 2001
Proposed Ontario Privacy Act Would Affect Magazine Publishers; Fines May Be Up to $500,000
Magazine publishers doing business with consumers in Ontario should start reviewing the way they handle their subscriber lists. New provincial legislation regarding privacy is being considered by the Ontario Ministry of Consumer and Commercial Relations.
Last summer, the Ministry released a consultation paper on its proposed Ontario Privacy Act ("Proposed Act"). Copies of the consultation paper are available on the Ministry's web site at http://www.ccr.gov.on.ca. The consultation period ended last fall and the Ministry is reviewing the results of the consultation.
The Proposed Act will focus on what happens to personal information obtained from consumers. Personal information is considered to be information about an identifiable individual such as address, telephone number and age as well as retail purchases, interests and financial status.
The Proposed Act intends to protect personal information in areas not covered by the existing Federal legislation, namely the Personal Information Protection and Electronic Documents Act. Passed in April 2000, the Federal legislation provides that its provisions will apply in 2004 to all commercial transactions in those provinces which do not have similar privacy legislation in force at that time.
Consumers would have three rights under Ontario's Proposed Act:
1) to control if and how their personal information is collected, used and disclosed;
2) to see and, if necessary, correct their personal information; and
3) to file a complaint if the collection, use or disclosure of their personal information violates the Proposed Act.
The goal is to impose rules which would be consistent with consumers' expectations about the collection, use and disclosure of their personal information. Handling the personal information would be limited to the purposes for which it was collected except with the express or implied consent of the individual.
The Proposed Act would set guidelines for express and implied consent regarding the collection, use and disclosure of personal information as well as an accessible, free opt-out option available to consumers to signify their refusal to participate.
The Proposed Act considers creating "sector" codes which are sets of rules tailored to a specific industry, type of information or way of using information. Though the consultation paper does not expressly mention a sector code for the magazine industry, the revenue streams associated with list information will likely attract a sector code.
The Proposed Act anticipates allowing information to be collected, used and disclosed without individual consents for journalism but magazines would still need consent to release its subscribers' list.
Magazines can also choose not to contract with someone who refuses to consent if that personal information is justifiably necessary. For example, the street address and name for the individual and their name will be necessary to subscription delivery; however, selling that information to a third party for another use would not be justifiably necessary. The Proposed Act would distinguish between maintaining a subscription list and generating a revenue stream by trading, lending or selling the contents of the list to someone else.
Under the Proposed Act, magazines would be allowed to collect, use or disclose personal information for only those purposes which are identified, appropriate and meaningfully described. For example, if your magazine advised consumers that it was going to use the information to do marketing, the magazine would have to specify the type of products or retailers which the magazine thinks would be valued by the consumer based on his or her declared consumer preferences.
A culinary magazine might extend its list to the grocery and fitness industries provided it specified these when it solicited consent. When soliciting consent, a magazine could advise consumers that it will send personal information to third parties identified by the magazine as a result of surveys answered by individual consumers. However, the line is not yet drawn by any express wording in any draft legislation. In either case, mail subscription cards will likely have to be modified in the future in order to gauge consumer preferences and solicit their express consent. Magazines' web sites could be modified to allow consumers to opt-out once they begin to receive unwanted mail.
Magazines can only keep the personal information as long as they still need it to fulfill the original purposes covered by the consent. Once the subscription is terminated, the personal information would have to be retired. The Proposed Act, though, contemplates organizations keeping archive copies to respect business records legislation.
These new rules will likely prevent magazines from renting their terminal names to other publications or merchants unless the subscribers have given their consent to do so. Under the Proposed Act, magazines should therefore prepare ways to obtain their subscribers' individual consents to rent their personal information after the subscriptions have terminated. These consents could be solicited, for example, at the onset of the subscription, or by way of renewal during the term of the subscription, by way of mail in response cards.
A magazine could move the personal information within and out of Canada provided it takes reasonable steps to insure the subsequent use of the information respects the Proposed Act. The Proposed Act does not say whether the magazine will be liable if the third party breaches the Proposed Act or what constitutes "reasonable" steps.
Breach of the Proposed Act would entail significant administrative penalties. Individuals would pay up to $50,000 and corporations would pay up to $500,000. As well, the Proposed Act expressly provides access to civil Courts for individuals to sue for damages resulting from a breach of their rights to privacy under the Proposed Act.
In my April column on MastheadOnline.com, I'll review a case study and show how one magazine publisher must deal with the both existing Federal privacy laws and Ontario's Proposed Act.