PIPWatch

1. PIPWatch www.pipwatch.caDavid Ley, University of Toronto Privacy Concerns Canadians are increasingly concerned about their privacy when engaging in online activities. In particular, people are concerned about how and when information is collected about them, and how that information is subsequently used. Various legal measures have been taken to try and protect Canadians’ privacy online. However, it is very difficult for the average citizen to determine if a particular website complies with Canadian privacy legislation or guidelines. About PIPEDA On January 1st, 2004 the Personal Information Protection and Electronic Documents Act (PIPEDA) came into effect. The legislation requires all privacy sector organizations that collect and use personal information to comply with a set of privacy practices and guidelines, based on privacy principles set down by the Canadian Standards Association PIPEDA and Openness PIPEDA requires that organizations disclose what information they collect and for what purposes personal data is used. In particular, PIPEDA requires organizations to identify a contact person responsible for explaining their privacy policies (a “Privacy Officer”). PIPWatch and PIPEDA The PIPWatch toolbar builds on this principle of openness enshrined in the privacy legislation by automating the process of asking for more detailed information about websites’ privacy practices and disseminating the responses to those questions to a community of privacy-concerned Canadians. The Personal Information Protection Toolbar Project The PIPWatch Toolbar gives users real-time feedback on the privacy practices of the websites they are visiting The “Privacy Beaver” gives a quick indication of potential privacy risks Do they make sure data collected is not subject to USA Patriot Act? The toolbar indicators give detailed information about specific privacy concerns PIPWatch & Social Navigation Is data only shared with PIPEDA-compliant organizations? PIPEDA Fact PIPWatch allows a community of privacy-concerned Canadians to coordinate their efforts to protect the privacy of their personal data and promote compliance with good privacy practices on the part of data collectors. This type of community coordination, known as “social navigation”, has been successfully used in many other Internet applications. • The PIPEDA legislation mandates that: • “An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.” • It also states that organizations must make available: • “the name or title, and the address, of the person who is accountable for the organization's policies and practices and to whom complaints or inquiries can be forwarded.” • PIPEDA, Schedule 1, Section 4.8 Is this website compliant with PIPEDA?