@Info.Policy: On privacy, U.S. should look to the north
Connecting state and local government leaders
IT and personal privacy concerns go hand in hand. As technology gets more powerful and pervasive, it impinges on privacy. This is nothing new.
IT and personal privacy concerns go hand in hand. As technology gets more powerful and pervasive, it impinges on privacy. This is nothing new.The 1890 Harvard Law Journal article by Louis Brandeis and Samuel Warren that led to the creation of the legal right to privacy was written in response to new technology. The authors were upset about cameras that could take pictures without formal posing by the subject. Imagine what they would think of the Internet, face recognition and cell phones.How do we get a grip on the relentless march of technology? We might begin by looking to the north. Canada's Quebec province has always been a leader in privacy. It was the first jurisdiction in North America to pass a comprehensive privacy law covering both public and private sectors.Quebec is again breaking new ground with a law establishing a legal framework for security of data communications, legal status of documents regardless of medium, rules for document communications and certification services for identification. Three other provisions relating to biometrics are also novel.First, the law provides that a person cannot be required to submit for identification purposes to a process or device that affects the person's physical integrity. So, unless covered by an exception for public health or law enforcement, no one can be required to be connected to a tracking device.Second, the law sets rules for biometric identification. Use of biometrics must be voluntary, and the amount of data recorded for identification purposes must be kept to a minimum. The information cannot be used for any other purpose and must be disclosed to the subject upon request. The law requires the government to destroy records when no longer needed.Third, the creation of a biometric database must be disclosed to the Quebec Privacy Commission, which can issue rules, or suspend or prohibit the database.The law is a good start toward establishing legal standards for use of biometrics. It is hard to know exactly what the law means in practice, but the requirement that biometric authentication be voluntary seems to prohibit the use of face recognition cameras in many locations. That is probably a good thing.Although we are not exactly anonymous on the street or in a mall, that doesn't mean a facility owner or police department should be able to track us and record our activities.Another important question about any identification technology is, What happens to the transaction records? When you use your cell phone, for example, someone has a record of who, what, when and where. The resulting database becomes a valuable and scary proposition. What kind of society will we have if we allow anyone to maintain such information and use it without restriction?The word Orwellian comes to mind.The public and private sectors will have to wrestle with these problems in the future. Quebec has given us a head start.
Robert Gellman is a Washington privacy and information policy consultant. E-mail him at rgellman@cais.com.
Robert Gellman
Robert Gellman is a Washington privacy and information policy consultant. E-mail him at rgellman@cais.com.
NEXT STORY: Editorial Cartoon