October 2004

Information & Privacy Commissioner for British Columbia

Privacy and the USA Patriot Act

Implications for British Columbia Public Sector Outsourcing

n the spring o 2004, the Oice o theInormation and Privacy Commissioner orBritish Columbia (OIPC) began receivingrequests rom government, the media, interestgroups and members o the public or guidanceabout possible implications or the privacy o British Columbians o section 215 o the USAPatriot Act, a US ederal law passed in Octobero 2001.

hese requests or guidance relatedto initiatives or outsourcing British Columbiagovernment unctions to US companies or theirCanadian subsidiaries.Interest in the USA Patriot Act was triggered by the widely reported launch o a lawsuit in the BritishColumbia Supreme Court by the British ColumbiaGovernment and Service Employees’ Union (BCGEU)to stop the British Columbia Ministry o HealthServices rom contracting out the administration o British Columbia’s public health insurance program,the Medical Services Plan, to a US-linked privateservice provider. One o the BCGEU’s claims wasthat the proposed outsourcing would contraveneBritish Columbia’s Freedom o Inormation andProtection o Privacy Act (FOIPPA) by making thepersonal health inormation o British Columbiansaccessible to US authorities under section 215 o theUSA Patriot Act.

What We Asked

In May 2004, the Inormation and Privacy Commissioner initiated a public process seekingsubmissions on two questions:1. Does the USA Patriot Act permit US authorities toaccess personal inormation o British Columbiansthat is, through the outsourcing o public services,in the custody or under the control o US-linkedprivate sector service providers? I it does, underwhat conditions can this occur?2. I it does, what are the implications or public body compliance with the personal privacy protectionsin FOIPPA? What measures can be suggested toeliminate or appropriately mitigate privacy risksafecting compliance with FOIPPA?

What We Heard in Response

More than 500 submissions arrived rom acrossCanada, the US and Europe. Tose respondingincluded individuals, governments, labour groups,inormation technology companies, health careproviders, library associations, privacy advocacy organizations and other inormation and privacy

1 Section 215 concerns secret court orders enabling the FBI to obtain access to “any tangible thing” or oreign intelligence purposes or to protectagainst international terrorism or clandestine intelligence activities. USA Patriot Act stands or the Uniting and Strengthening America by ProvidingAppropriate ools Required to Intercept and Obstruct errorism Act (USA PARIO Act) o 2001.

REPORT SUMMARY

PRIVACY AND THE USA PATRIOT ACT

commissioners.Tere was general consensus that US authoritiescould, at least under some circumstances, use powersenacted by the USA Patriot Act to make orders oraccess to personal inormation located in Canada thatis involved in outsourcing o public body unctionsto a US linked contractor. Tere was, however, a cleardiference o opinion about whether the risk o accessis unknown, low or o great concern, and what theimplications might be or public body compliance withFOIPPA’s privacy protection rules. Some inormationtechnology companies argued that there is no needor additional precautions to deal with any risk posedby the USA Patriot Act. Other submissions arguedthat the risk is so great that outsourcing to US-linkedcompanies should be prohibited altogether. Otherspressed the case or stifer contractual provisions,legislative amendments or technological solutions.Te submissions consistently endorsed the valueo privacy and raised larger questions about theplace o privacy in an era o economic globalization,widespread ear o terrorism, and ows o data acrossborders. Several themes related to these issues emergedin the submissions:• Many people eel that they are losing control overwhat happens to their personal inormation andworry that their privacy rights are being urtherdisplaced by economic and national security priorities.• Disclosure o sensitive personal inormation,particularly that o a medical nature, can lead todiscrimination against people with physical ormental disabilities—or example, people who areknown to be HIV-positive can be turned away rom the US border—and may jeopardize healthcare or patients who, earing disclosure, withholdcritical inormation rom their doctors or simply avoid seeking treatment.• Globalization o the inormation technology industry, enhanced by ree trade and the ease o data transer, produces economic opportunitiesbut also raises concerns about national sovereignty and creates privacy challenges or businesses,governments, regulators and the public.• Developments in inormation technology areuelling governments’ appetite or larger databanks and mining o data or national security and other purposes, and new laws are encouragingprivate sector disclosure to government authoritieso customers’ personal inormation or nationalsecurity and law enorcement purposes.• Tere are indications o a trend developingwhereby personal inormation collected ornational security purposes (including borderand transportation security) may be usedmore requently or ordinary law enorcementinvestigations. Tis leads to a blurring o thetraditional division between the role o the state inprotecting the public rom domestic and oreignnational security threats and its role in enorcingordinary criminal and regulatory laws, which hassignicant implications or privacy and other civilrights.Te questions we posed cannot be consideredin isolation rom these broader and interrelatedthemes, which relate to the importance o privacy as ademocratic right, expanding risks or privacy in an evermore interconnected world, and the risk and potentialimpacts o disclosure o personal inormation to USand other oreign authorities.

Protecting Personal Information:Old Rights and New Laws

Privacy is not an absolute right. I we acceptthe notion that trade-ofs are sometimes necessary,whether or reasons o e ciency, economic benetsor national security and public saety, where and