Daniel Urbas is a lawyer with Woods & Partners. His practice focuses on media law, intellectual property, e-commerce and litigation. He can be reached at durbas@woods.qc.ca
The contents of Publishing Law should not be construed as legal advice offered by Masthead or Mr. Urbas. Readers should consult their own lawyers before acting.
Column for April 2001
Question and Answer: How will the new privacy laws affect my magazine?
This two-part series of questions and answers was generated further to suggestions made by Janet Feaver, general manager of Canadian Homes & Cottages. The Mississauga-based magazine has a circulation of 51,000 and is published eight times a year; the Web site is at www.homesandcottages.com.
I have taken Ms. Feaver's suggestions and developed my own questions and answers regarding the Federal Personal Information Protection and Electronic Documents Act.
Q: I have heard there is new Federal privacy laws which apply to magazines. Can you tell me more about the legislation?
A: The Federal Personal Information Protection and Electronic Documents Act (the "Act") governs three distinct activities regarding personal information: the collection, the use and the disclosure. There are two main parts to the Act. The first part deals with personal information and the second part deals with the electronic documents. The first part of the Act must be read along with a lengthy schedule which contains ten Principles. Those Principles are:
Principle 1 - Accountability
Principle 2 - Identifying the Purposes
Principle 3 - Consent
Principle 4 - Limiting Collection
Principle 5 - Limiting Use, Disclosure and Retention
Principle 6 - Accuracy
Principle 7 - Safeguards
Principle 8 - Openness
Principle 9 - Individual Access
Principle 10 - Challenging Compliance
The full text of the Act and the accompanying Principles can be found at the following URL: http://laws.justice.gc.ca/enp-8.681251.html.
Q: What is personal information?
A: The Act defines "personal information" to mean information about an identifiable individual. The Act's definition specifically excludes the name, title or business address or telephone number of an employee of an organization.
Q: Does that definition mean that anyone's business address is not considered personal information?
A: Not necessarily. The concluding words of the definition are "employee of an organization". An "organization" is broadly defined to include an association, a partnership, a person and a trade union. The definition of organization does not include necessarily a trust or a corporation unless "person" is considered to include a legal person (corporation) and physical persons. "Employee" is not defined either in the Act. However, self-employed people such as doctors, accountants and architects as well as partners are not considered to be employees. There is therefore some ambiguity whether or not partners and self-employed will be considered to be an employee. Only with time will we learn the limits of that "employee" exception. Once a name does qualify under that exception, the name would be easier to sell, barter or lease without any restrictions imposed by the Act.
Q: I have heard that magazines are exempt from the Act?
A: You have heard wrong. The Act applies to all organizations which collect, use or disclose personal information in the course of commercial activities. The Act only exempts the collection of personal information which is solely for journalistic, artistic or literary purposes. While the content of the magazine may be journalistic, artistic or literary, the collection of subscribers' names and addresses is simply a commercial activity. If the names and addresses are collected for the purposes of an article, then the Act does not appear to target that information. The mailing lists, however, are subject to the Act. Because the definition of personal information does not include the name, title or business address or telephone number of an employee of an organization, the Act generally imposes a greater burden on consumer magazines than business and trade magazines.
Q: Does the Act apply today to magazines?
A: Not yet but it will by January 1, 2004 if no equivalent provincial legislation comes into force in the provinces in which your magazine circulates.
Q: Why should we worry about legislation which will not affect us until 2004?
A: The Act applies to the collection of information and will automatically apply in 2004 to information which your magazine has on hand on January 1, 2004. You should prepare now to be able to continue to use and disclose that information in conformity with the Act on January 2, 2004 once the Act applies to your activities.
Q: Our magazine does not sell its mailing list. Does the Act apply to us?
A: The Act targets the collection, use and disclosure of personal information for any conduct that has a commercial character which, under the Act, specifically includes any sale, bartering or leasing of donor lists, membership lists or other fund raising lists.
Q: I have read the Principles about consent which appear to say that magazines which do not have a direct relationship with subscribers are not subject to the rules.
A: Be careful. Principle 3 provides that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. An accompanying note, which the Act excludes, mentions that: "organizations that do not have the direct relationship with the individual may not always be able to seek consent. For example, seeking consent may be impractical for a charity or a direct-marketing firm that wishes to acquire a mailing list from another organization. In such cases, the organization providing a list would be expected to obtain consent before disclosing personal information."
Q: We supplement our circulation by obtaining targeted lists of names from professional list companies. Our list sources say that it is legal for them to sell us the names and addresses but that it is my magazine's responsibility to find out if we can use it? Who is right?
A: The Act governs the collection, the use and the disclosure of personal information. Even though your list providers have collected the information, you are both subject to the Act. The list provider is responsible for personal information in its possession or custody and for personal information that it has provided to another organization for processing.
The organization which collected the information and which intends to disclose it to another for use can use formal agreements with the other party to ensure that the latter provides a similar standard of protection for the information while that information is in its hands.
Q: What do we have to do under the Act to allow me to collect, use or disclose personal information?
A: Each organization must demonstrate it has the consent of the person whose personal information appears in their records such as circulation lists.
This concludes Part I of this two-part series. See my column for May 2001 for Part II.