We've got your number

Sarah Staples 2003-05-12

We've got your number

The first plaintiff under a new privacy act takes Telus to court

It's only a toonie. But if Mathew Englander wins his battle in court, the lowly coin could end up costing Canadian companies billions. In May, Englander--a nonpractising graduate of UBC's law school--will square off against Telus Corp. (TSX: T) over the legality of a two-buck monthly charge on his phone bill. Under new federal privacy rules, Englander argues, Telus shouldn't be allowed to charge a fee to keep his name, number and address out of the phone book. And he says the telco doesn't ask for explicit enough consent to sell his personal details to telemarketers, charities and political parties. "Your information belongs to you, not to a company, and if they want to use it, they need your permission," he says. "It's inconsistent with that principle to say, 'We're going to allow your number to be published all over the place unless you pay us.'"

Telus has some 250,000 customers who pay for unlisted numbers, and victory for Englander could cost the company millions in lost revenue. Businesses across Canada could feel the impact as well. Englander's three-day hearing, starting May 21, is the first-ever judicial reckoning of the Personal Information Protection and Electronic Documents Act, or PIPEDA, which took effect in January 2001. The legislation gives consumers, among other things, the right to access any information typed about them by customer service reps, squirreled away in computerized cash registers, or revealed to creditors, doctors and employers.

So far, PIPEDA covers only federally regulated companies, as well as enterprises that do business across provincial borders. But as of Jan. 1, 2004, the law will apply to every company engaged in commercial activity in Canada. Big-box retailers and local corner stores alike will have to record whom they share your personal information with and provide proof that the data are encrypted for maximum secrecy. Englander's case--which was deemed not well founded by Canada's privacy commissioner in 2001--will establish just how far companies must go to protect customers' privacy and to secure permission to collect and use personal information.

"This is a watershed case because it allows individuals to challenge practices that were in place before the advent of privacy rights," says Stephanie Perrin, a member of the Industry Canada task force that crafted PIPEDA. Lawmakers, she adds, have been scrambling to control technology's reach since the 1970s, when mainframe computers enabled governments to cross-reference massive amounts of data. Now, in the post-9/11 era, says Perrin, law enforcement agencies are gaining unprecedented access to personal files. "It's a fundamental erosion of your ability to go through life anonymously, without people knowing what you're buying, seeing, saying or doing," says Perrin, president of Montreal-based privacy consultant Digital Discretion. "And yet, once these things are brought in, it seems like they've always been there."

Complying with PIPEDA won't be easy. "If a bank asks to share your data internally," says Perrin, "it might go through quite a circuitous route. And there can come a point where you begin to lose track of which department or affiliate it's been sent to." Companies may have to invest in costly encryption software or remove sensitive databases from computer networks. They may also have to add staffers to pore over complaints and requests, and mail every stitch of information they've collected within 60 days.

Businesses that rely on tracking customers' spending habits--like retailers--will take an especially hard hit, as they find themselves having to convince consumers that tracking what, where and how much they buy is somehow in their best interests. "Once companies start using personal information, it becomes embedded in their revenue cycle," says Perrin. "It's hard to step back from that because it means a potential loss of profit."

Two other PIPEDA cases will go to court later this year. Nancy Carter has filed a complaint against Inter.net Canada after the Montreal ISP withheld her personal e-mail--including a job offer--because of a dispute over payment. Ronald Maheu, president of Markham, Ont.-based marketing firm Pharma Communications Group, is taking IMS Health Canada to court; if he wins, companies will have to ask doctors' permission before buying prescription records and reselling them to pharmaceutical makers.

As for Englander v. Telus, the telco wants the court to uphold a 1998 ruling by the CRTC that said phone books are a public service (the regulator subsequently set the $2 maximum fee). Englander, of course, disagrees. "When you value privacy in one scenario, it increases the value of privacy in all others," he says. "And when you lose some of your privacy in one context, you risk devaluing it in others. There's a slippery slope there. It would be nice to have a strong statement from the courts to reinforce some of those principles."

Read all about the ongoing case at Mathew Englander's website.