Striking a balance between Data Privacy Legislation and Charter Rights relating to Freedom of Expression

Within the Canadian constitutional landscape data privacy legislation is arguably within the ambit of both federal and provincial jurisdictions. Under section s 91(2) trade and commerce clause of the Constitution Act of 1867 Parliament of Canada enacted the Personal Information and Protection Act (PIPEDA) which applies to private sector organizations with commercial activities across Canada. At the same time provincial legislatures have also implemented privacy legislations pursuant to s 92(13) property and civil rights provisions of the Constitution Act. While the constitutionality of PIPEDA may be challenged[1] at a future date[2]  there is acknowledgment of shared jurisdiction between the federal government and the provinces. Provinces are exempt from compliance with Part 1 of PIPEDA if provincial privacy legislations are “substantially similar” to obligations relating to the collection, use and disclosure of personal or personally identifiable information.

There is yet another dimension of the tension between provincial and federal jurisdictions that surfaced with the recent Alberta Court of Appeal decision in United Food and Commercial Workers Local 401 v Alberta (Attorney General), 2012 ABCA 130.  In this appeal the court was asked to determine whether or not a union’s actions of videotaping individuals who may have crossed picket lines and then posting it to a website are protected by Charter of Rights as freedom of expression or does it infringe upon privacy rights pursuant to the provisions of the Alberta Personal Information Protection Act (PIPA). The court held that while it is of outmost importance to protect individual privacy rights particularly in light of technology advances the definition of personal or personally identifiable information in the Alberta PIPA Act was deemed to too broad and as such encroached upon the equally important right of freedom of expression. The court was particularly concerned about the absence of reasonable limits on what is deemed to constitute personal or personally identifiable information. The court reasoned “that People do not have a right to keep secret everything they do in public, such as crossing picket lines. There is no recognized right to withhold consent to the dissemination of information about unpleasant conduct. Holding people accountable for what they do or do not do in public is a component of the right to free expression.” The court concluded that “While the protection of personal information is important, it is no more important than collective bargaining and the rights of workers to organize.”

This decision may prompt similar challenges with respect to other provincial privacy legislations as well as the Federal PIPEDA legislation. Furthermore this decision brings into focus the role that Information Management plays in the formulation, implementation and measurement of the efficacy relating to the collection, use, disclosure and disposition of personal and personally identifiable information. There are increasing complexities associated with harmonizing competing values in an effort to balance competing interests domestically and also as part of international or cross border obligations relating to the transfer of personal information.  For example the European Union’s Directive on Data Protection prohibits member states from transferring personal data unless the requesting party provides adequate levels of protection in accordance with the provisions of the Directive.  Information Management professionals need to be increasingly more familiar with the complexities associated with multi -jurisdictional privacy regimes, legislation and regulations in order to implement effective business processes to support the collection, use, disclosure and disposition of personal data. Further compounding the challenges faced by IM professionals is the dynamic nature of a constantly evolving privacy landscape.

---

[1] http://www.teresascassa.ca/index.php?option=com_k2&view=item&id=96:fresh-questions-about-the-constitutionality-of-pipeda?&Itemid=80.  The recent Supreme Court decision in Re Securities Act held that a purported national securities regime was unconstitutional as it encroached upon provincial jurisdiction under section 92(13). The federal government was unable to establish that absence of a national securities regime would undermine consistent administration of securities regulations which the provinces acting alone could not achieve thereby falling within the trade and commerce clause of the Constitution Act. A similar legal argument may be advanced with respect to the constitutionality of PIPEDA.

[2] The Province of Quebec initially challenged but then later abandoned its action. However in light of the Supreme Court of Canada decision in Re Securities Act a possible avenue may opened up to future constitutional challenges to PIPEDA.

Read more

Practical Tools for Measuring the Impact of Social Media Use

A recent AIIM study [1]  found that 51% of respondents consider social media to be an important factor that may contribute to improved customer service levels and productivity.   For example, 48% of organizations surveyed indicated that deployment of social media technologies resulted in improved internal processes such as better collaboration across different functional groups.

 

While the application of social media in corporate environments is in the early adoption phase there are best practices and tools to assist in the measurement of their value add.   Of particular note is the AIIM Report on “How to Conduct a Social Business Assessment” and the related AIIM social business roadmap[2].  Together these reports provide a framework for how to effectively implement and operationalize the assessment of the value of social media, what information to gather and how to analyze it.  The social media road map lays out a structured approach consisting of eight (8) steps “to help organizations effectively develop social business processes.” These steps include emergence, strategy, development, monitoring, participation, engagement, governance and optimization.   

In the emergent phase the use of social media tends to grow in the absence of formal policy.  Nonetheless, its adoption should be encouraged: “Management should provide visible support through public acknowledgement and recognition, for example by publishing good ideas on the intranet or even by providing material rewards.”  Experimentation in the form of prototyping is useful to “determine whether there is value to its use beyond the novelty or “coolness” factor.”

The strategy and development phases should encompass an assessment of the organizational objectives for the integration of social media technology within legacy IT applications such as identifying target audiences – internal and external, establishing intended outcomes such as direct and indirect benefits measured in terms of increased revenue, decreased operating costs, increased productivity and improved job satisfaction.  The impact of social media should also be taken into consideration.  Will its use foster improved knowledge sharing among employees?  Will it be embraced by management as use of social media tends to challenge traditional organizational hierarchies?  Equally important is an understanding of how the application of social media will impact brand equity with external stakeholders?  How its use will engender improved customer relationships and perceptions about the company?  An overarching consideration is the need for clearly articulated and communicated social media governance that should include social media policy, terms of use, security and privacy considerations.

The challenge in measuring social media effectiveness lies in the monitoring and optimization phases.  What are the relevant metrics?  Are there hard metrics to measure or they are mainly soft metrics such as sentiment analysis, brand perception, customer or constituency satisfaction?   Is there a hard ROI associated with social media?  For instance customer life time value (CLV) measure not only the financial benefits associated with a single purchase but the likelihood of additional services or referrals by a customer as a result of more persistent engagement through the application of social media technologies.  Another useful metric is new customer value (NCV) by tracking conversions from click through to sales.  Or you may measure customer service value (CSV) that tracks customer sentiments monitor responses and interactions.  Social media ROI is then a function of the return on investment which is the sum of life time customer value, new customer value and customer service value less total spend on social media divided by total spend on social media.

The AIIM report concludes that “Organizations need to approach social business processes and technologies formally and methodically in order to ensure their success, just as with any other management project or process.”

---

[1] http://www.aiim.org/Research/Industry-Watch/Social-Business-2011

[2] http://www.aiim.org/Social-Business-Roadmap

Read more

Open Government: Toward Greater Transparency and Improved Constituency Services

Consistent with the principles espoused by the Open Government Partnership (OPG) [1] the Government of Canada is committed to cultivating greater transparency by focusing on three key strategic pillars:

• Open Information designed to make it easier for constituents to find and access information by streamlining document and records management life cycle processes and by empowering citizens with single point of access to heterogeneous information sources such as publications, web pages and data from laptops, mobile devices and from tablets; 
• Open Data, the objective of which is to provide government published datasets in a manner that may be repurposed for both academic research and commercial purposes; and
• Open Dialogue, the focus of which is to cultivate interactions with constituents by leveraging the ephemeral nature of social media technologies as a means to seek input to and gage constituency sentiments relating to government policies.

Recently the Government of Canada published its Action Plan on Open Government[2] which outlines the go forward strategy for “fostering the principles of open government”. The Action Plan will be reinforced with a Directive on Open Government which is expected to be effective in fiscal 2012-2013. The strategic outcome of the Directive on Open Government is to “provide guidance to 106 federal departments and agencies on what they must do to maximize the availability of online information and data, identify the nature of information to be published, as well as the timing, formats, and standards that departments will be required to adopt. The clear goal of this Directive is to make Open Government and open information the 'default' approach.” 

Delivering on the promise of this ambitious agenda requires a coordinated effort that encompasses legal, policy and technology considerations. For one “open data” implies that its availability is unencumbered by privacy and security restrictions.   Addressing this issue is one of the principal tenets of the Action Plan on Open Government by providing a shared services-based document and records management platform designed to promote better record classification, declaration, retention and disposition best practices. Second, use of “open data” requires a licensing regime which empowers third parties to re-purpose content published by the Government of Canada.  The absence of such a licensing framework may create legal challenges as Copyright law protects original expression of ideas and under certain circumstances also protects the arrangement of raw data that requires some level of skill in compilation.[3]  Removing such restrictions fosters innovation by virtue of which such information may be leveraged for the public good. In fact, the Action Plan on Open Government contemplates the implementation of a “universal Open Government License” that obviates the potential legal impediments in leveraging published Government of Canada information.  It is interesting to note that very recently Canada Post launched a law suit for alleged copyright infringement by www.geocoder.ca, a website that provides geocoding services based  crowd-sourced database relating to Canadian postal codes.  The statement of defence is based on the argument that postal codes are facts and as such are not copyrightable.   Having clarity under which published Government of Canada information may be re-used is integral to the long term viability of the Open Government initiative.

Another interesting dimension of the Open Government initiative is one of economics.  Some studies suggest that there should be some form of cost recovery associated with providing such breadth of data for general consumption by corporations, and by citizens.   However the prevailing consensus is that the effort and costs associated with administering such a scheme would far outweigh  revenue streams that may be realized.  In fact such a scheme may well serve as a deterrent to accessing such information.  A far better approach is to encourage unfettered usage as it may stimulate innovation and thereby increased corporate and individual tax revenues collected by the Government from secondary publishing and associated services provided by the private sector.

Open Government may have profound transformative implications – that is democratization of information that has the potential to empower citizens to engage more directly in the policy formulation process on the one hand and stimulate private sector innovation by leveraging the data on the other hand. It may also have efficiency implications in “outsourcing” service access and delivery to constituents thereby reducing delivery costs while improving constituency service levels. Equally important is the network effect associated with open data. Metcalf’s Law states that the power of the network increases exponentially with each additional node added to the network. The positive implications of the network effect are evident in examples such as the human genome project[4].  The opportunities inherent in the Open Government initiative are enormous as unfiltered data may be transformed into meaning and applied in innovative ways in the form of knowledge and wisdom. The Open Government initiative is a step in the right direction although some argue it should go farther and faster.[5]

 

---

[1] http://www.opengovpartnership.org/open-government-declaration.  In September 2011 Canada is committed to join OGP.

[2] http://open.gc.ca/open-ouvert/ap-patb-eng.asp

[3] CCH Canadian Limited v. Law Society of Upper Canada, [2004] 1 SCR 339, 2004 SCC 13 is authority for the proposition that arrangement or repurposing of data such as directories and tabular information may be protectable under copyright.

[4] http://www.ornl.gov/sci/techresources/Human_Genome/home.shtml

[5] http://eaves.ca/2012/04/13/canadas-action-plan-on-open-government-a-review/

Read more

Minimizing e-Discovery Costs

The volume of Electronically Stored Information (ESI) continues to grow unabated. How does 2.7 zettabytes[1] sound? That is the estimated volume of electronically stored information globally. Such information spans web sites, social media, email, document repositories, databases, file systems and shared drives.

Electronically stored information is discoverable regardless of format and location. [2] Virtually all jurisdictions in Canada have incorporated The Sedona Canada Principles Addressing Electronic Discovery (the “Sedona Canada Principles”).[3] For example rule 29.1 of the Ontario Rules of Civil Procedure requires parties to identify, collect, preserve and produce ESI that may be relevant and material in a pending litigation.[4]

The cost of ESI production can be prohibitive. It is estimated that the average cost to defend a corporate lawsuit exceeds $1.5 million per case. Moreover, failure to produce ESI may result in adverse inferences. In such cases courts may grant a preservation order in the event that the moving party has reason to believe that relevant and material evidence may be destroyed the litigation hold notwithstanding.[5]

Effective document and records management best practices are of paramount importance for mitigating ESI related production costs. An Electronic Document and Records Management System (EDRMS) is an integral element of mitigating e-discovery risks. Equally important is implementation, communication and enforcement of a consistent set of policies and methodologies associated with the management of ESI. A universally accepted framework is the Electronic Discovery Reference Model (EDRMS)[6]. The model consists of an end-to-end lifecycle that encompasses identification, preservation, collection, processing, review, analysis, production and preservation of ESI.

Implementation of a robust ESI preservation strategy has many financial benefits as well may provide a shield against “fishing expeditions” by opposing counsel. For example the ESI guidelines provide that “a party may satisfy its obligation to preserve, collect, review and produce electronically stored information in good faith by using electronic tools and processes such as data sampling, searching or by using selection criteria to collect potentially relevant electronically stored information.”

Technology plays an important role in helping organizations minimize ESI production costs. A study by the eDiscovery Institute[7] outlines a number of technological approaches that can significantly reduce ESI production volumes by as much as 92%. These steps include the use of hashing algorithms to identify duplicate files, the use of standardized meta-data and classification models[8], use of email threading software to identify patterns relating to initiating, forwarding, replying and attaching documents to emails.

An emerging ESI tool is what is generally referred to as predictive coding. Traditionally discovery is a linear and time consuming process of lawyers visually and manually reviewing many thousands of documents that may be deemed to be responsive or privileged. Predictive coding is a technology that automates the review process through the application of advanced semantic analysis of text and meta-data within sample documents analyzed by the software The system then “learns” how to accurately categorize and classify a larger universe of documents as responsive, non-responsive and privileged. A recent US judgment[9]affirmed the value of predictive coding as” more accurate -- and 50 times more economical -- than exhaustive manual review.”

A particularly useful and comprehensive review of eDiscovery jurisprudence in Canada may be found at:

www.gowlings.com/resources/.../burket_surveyediscovery.pdf.

---

[1] According to International Data Corporation, the total amount of global data is expected to grow to 2.7 zettabytes during 2012. This is 48% up from 2011.[2] The Canada Evidence Act defines an electronic record or document as“data that is recorded or stored on

any medium in or by a computer system or other similar device.”

[3] https://thesedonaconference.org/publication/The%2520Sedona%2520Canada%2520Principles

[4] http://www.oba.org/en/publicaffairs_en/e-discovery/model_precedents.aspx

[5] So called Anton Piller Order a remedy give to the moving party “should have inspection so that justice can be done between the parties… (and)…there is a grave danger that vital evidence will be destroyed”.

[6] http://www.edrm.net/resources/edrm-stages-explained

[7] http://www.ediscoverydaily.com/2011/02/ediscovery-best-practices-judges-guide-to-cost-effective-ediscovery.html

[8] In the context of the Canadian Federal Government compliance with Treasury Board IM and RK policies and directives are relevant.

[9] http://newsandinsight.thomsonreuters.com/Legal/News/ViewNews.aspx?id=40579

Read more

Legal Considerations Impacting Use of Social Media: A Double Edge Sword

While social media can be a powerful tool to foster customer and constituency engagement the absence of clear guidelines relating to their use may have unintended legal consequences.  A study by Gartner[1] shows that legal implications notwithstanding many organizations lack effective social media policies.   The report cautions that “by the end of 2013, half of all companies will have been asked to produce material from social media websites for e-discovery, so enterprises need an overall governance strategy for all applications and information, and this strategy should include content created on social media.”

Social media is deemed to be a discoverable source of information just as any other form of electronically stored information (ESI).  Accordingly, organizations should take steps to identify, capture, control and preserve social media content in the same manner as they manage other sources of content particularly if such information is considered to be an information resource of business value.  However, the principal challenge with social media is that its use is largely ephemeral in nature and the boundaries between personal and corporate uses may be blurred.

So what are the possible legal ramifications associated with inappropriate use of social media? They may be wide ranging consequences that encompass copyright infringement, defamation, invasion of privacy, violation of labor laws and in some cases criminal liability.

Canadian courts have affirmed discoverability of social media provided that it is material and relevant evidence. For example, the Ontario Superior Court decision in Leduc v. Roman the defendant in a negligence claim sought a production order to examine plaintiff’s Facebook page to rebut his claim of injury that “might have some relevance to demonstrating Plaintiff’s physical and social activities, enjoyment of life and psychological well-being.”  Not only is social media content discoverable it is now also an approved process to serve notice of claim.  A recent decision of the Alberta Queen’s Bench in Knott Estate v. Sutherland held sending notice of action to defendant’s Facebook profile was valid.

Copyright infringement is a common cause of action relating to the use of social media.  User generated content by cutting and pasting is a common practice which in some cases may constitute an infringement of the copyrights owner’s exclusive rights to control the use and reproduction of the copyrighted material.  And there are clever tools[2] that track the use of licensor’s visual content through the use of advanced crawling and recognition technology.

Of particular import is the use of social media in a manner that may be defamatory.  A recent case in point is the decision of the British Columbia Labor Relations Board in Lougheed Imports Ltd where it was held that the dismissal of two employees based on derogatory comments on their Facebook page was valid on the ground that their Facebook friends consisted only of co-workers. As such the use of Facebook was deemed to be workplace related and not personal use.

Inappropriate use of social media by employers may lead to claims of discrimination.  Research shows that over 20% of Canadian companies surveyed check social media sites when screening prospective job applicants.

There are other more sinister exploitation of social media with tragic consequences as evidenced in the very recent case of a Rutgers University student who was convicted of videotaping a roommate kissing another man and then tweeting about it to other students which led to the roommate’s suicide.

In a broader context protecting the privacy of personal and personally identifiable information is one of the most challenging aspects associated with the proliferation of social media technology as collection of such information represents a bonanza for on line advertisers.  An example is the recent decision by Google to combine information gathered across all of its service offerings to provide a more comprehensive profile of its subscribers.  By virtue of the new privacy policy subscribers do not have the option to opt out.  Privacy advocates argue that “there is no way a user can comprehend the implication of Google collecting across platforms for information about your health, political opinions and financial concerns.”

The Gartner report suggests that "Social media content is like all other content that is created by companies and individuals and is subject to the same rules, laws and customs….Policymakers need to keep policies simple when it comes to what should and should not be done online. A good rule of thumb is that whatever the company code of conduct is for in-person encounters, and whatever the rules are for general good behavior and common sense apply in the online world as well."

---

[1] http://www.gartner.com/it/page.jsp?id=1550715

[2] http://www.picscout.com/

Read more

Special ARMA IT Videocast: What IT Professionals Must Know About Records Management Capabilities in SharePoint

The 2011 AIIM survey shows that nearly 40% of respondents are now deploying Microsoft SharePoint 2010 as an enterprise-wide Content Management (ECM) platform. The same respondents were also asked of their strategy for managing records using Microsoft SharePoint 2010. 35% of the respondents indicated that they had no long term preservation strategy, 25 % use it as a front end to an existing ECM system such as Open Text, EMC and IBM as they tend to have more robust and complete records management functionality, and only about 15% use Microsoft SharePoint 2010 native records management functionality. There may be several reasons for this – enhanced Records Management functionality is relatively new having been recently introduced in the 2010 release, implementation takes time to accelerate and to a large extent Microsoft SharePoint is still considered a collaborative platform that tends to augment already in place ECM systems. However, organizations are looking to consolidate their ECM platforms. Increasingly Microsoft SharePoint is considered a viable enterprise ECM solution. But just how robust is Microsoft SharePoint 2010 to support records management? To address this issue ARMA and Bruce Miller of www.rimtech.ca have collaborated in the development of a special videocast: What IT Professionals Must Know About Records Management capabilities in SharePoint 2010. The video can be accessed at  http://www.arma.org/IT/.

Read more

BI Think Tank Summary, February 7, 2012

With a vision of Continuous Improvement in how CORADIX tries to positively influence the Business Intelligence (BI) situation in the Federal Government, we asked some of our top BI consultants to a brainstorming think tank on the issues of identifying obstacles to success.

 

With over 200 years of experience in the room (we are not that old, but there was quite a few people present), this is a summary of what we came up with in no particular order.

• The method of procurement used requires you to understand the problem, before you actually do, in many cases.
• There is a religious belief that the dominant ERP’s have all the answers.
• BI programs don’t really exist – they just call them that?
• Systems are not designed to report.
• BI is not considered an influencer.
• Business is very separate from IT departments, and they do not communicate very well with each other.
• Managers are not trained to think of the whole systems development life cycle.
• Boundaries are a big problem.
• Definition of metadata is a huge problem.
• Clients don’t give requirements; they give their version of a solution.
• Clients don’t know how to express themselves/their requirements.
• There is a need for better client sponsorship of BI programs.

We discussed the emergence of Agile BI from products such as Endeca, QlikTech, Tableau, and how these tools provide quick win solutions, and are succeeding in response to conventional BI programs that are failing. But, we mostly agreed that we could take advantage of this technology to enhance conventional systems. By empowering the user, we help to promote the importance of good quality data amongst the business users, and allow them to become better educated on their real requirements.

There was also a unanimous agreement on the need for the famous “purple people” coined in Wayne Eckerson’s presentation at theTDWI chapter meeting, describing the mix of a business savvy IT people, or IT savvy business people to cross the communication chasm between IT and business.

We identified the realities of dealing with federal government organizations – like getting executive sponsorship on long term projects from executives that are frequently on the move from one Department to another.

Please let us know if these are touching some of your buttons or if you have other ones we have overlooked.

Read more