4. The Internet and On-line Systems

The Internet has the capacity to be the most effective data-collector in existence.19 The Internet, and in particular the worldwide web, is a rich source of information about on-line consumers. Websites collect a great deal of personal information explicitly, through registration pages, survey forms, order forms, on-line contests and other means, and by using systems in ways that are not obvious to on-line consumers. Through cookies and tracking software, website owners are able to follow consumers' on-line activities and gather information about their personal interests and preferences.20 The on-line environment provides for unprecedented opportunities for the compilation, analysis and dissemination of such information. While businesses have always collected some information from consumers in order to facilitate transactions, the Internet allows for very efficient and inexpensive collection of a vast array of personal information. The prevalence, ease, and relatively low cost of such information collection distinguishes the on-line environment from the more traditional means of commerce and information collection and thus raises consumer privacy concerns.21

The Internet has a broad spectrum of participants, an extraordinarily quick pace of change, a significant decentralization of information processing activity and no deference for jurisdictional boundaries. A session on the Internet may involve websites located in different territories. Even a visit to a single website can result in transmissions of data to many territories. On-line directories, cookies, search engines, log analyses, intelligent agents, banner advertising, on-line shopping, to name just a few of the activities and infrastructure elements, underscores the increasing tendency, capability and commercial pressure to gather and use personal information on-line. In the Internet environment there is an enormous positive need for reliable personal information and the commercial value thereof creates very strong pressures for massive collection of personal data.22

A wide variety of detailed personal information is being collected on-line from and about children. Often, this collection occurs without actual notice to or an opportunity for control by parents. This information is collected from children in a variety of ways such as when the child is registering for a contest, completing a survey or playing a game. Children may also reveal personal information in the course of engaging in chat rooms or posting messages on electronic bulletin boards.23

Set out below are some examples of how personal information is collected and used on-line.

October 13, 1999

On October 1, 1998, the Federal Government introduced Bill C-54, entitled the Personal Information Protection and Electronic Documents Act. Part I thereof deals with "protection of personal information in the private sector". Its express purposes "is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances".49 This legislation is discussed below.

The Act incorporates by reference into Schedule 1 the principles set out in t he CSA Model Code and then prescribes that, subject to certain provisions, "every organization shall comply with the obligations set out in Schedule 1".66 The Act makes a distinction between those provisions in the CSA Model Code which are obligatory (those which use the word "shall") and those that are merely recommendations and do not impose an obligation (those using the word "should"). In spite of this distinction, however, an individual may file a written complaint with the Commissioner against an organization for contravening a provision of Division 1 or for not following the recommendations set out in the CSA Model Code.67

The Act imposes an important limitation on the collection, use or disclosure of personal information. It states that an "organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances".68 Unlike other principles in the CSA Model Code which premise their operation upon openness and consent of the data subject, this principle does not enable organizations to obtain the consent of data subjects for the collection, use or disclosure of personal information for any purpose. To this extent, the Act goes beyond many of the voluntary codes of fair information practices previously established in Canada or recommended for use in other countries such as the United States.

A summary of the Act's fair information practice principles as they relate to marketing and advertising is given below.

[Part 1] [Part 2] [Part 3] [Part 4] [Part 5] [Main Menu]