privacy issues

[Tim Campbell]

I recently asked for opinions in how to deal with an issue (relative does
not want information listed in reports), and have been amazed at the fervent
debate and positions.

Not only was I trying to understand my legal position (in disclosing
information on a website), I was also trying to understand my position of
genealogical accuracy vs. personal sentiments.

Thus, after much study (and following the thread and discussions) I have
come to the following conclusions:
1. I want to be a good guy, and avoid getting people upset,
2. In Canada, pursuant to the Personal Information Protection and Electronic
Documents Act (PIPEDA; snippets quoted below), an individuals NAME (as well
as other information) is PRIVATE information, and cannot be disclosed
without consent,
3. The act noted only applies to living people,
4. Banks use your mothers maiden name for security reasons,
5. My genealogy program, and the software used on my website, have
provisions to hide information,
and 6. although there may be doubt that a case of identity theft occurred
due to information being obtained from a website, I dont want to be involved
if it does.

I will continue to pursue this passion, and will do all I can to balance
accuracy and privacy issues.
----------------------------------------------------------
Canada's new private sector privacy law is called the Personal Information
Protection and Electronic Documents Act (PIPEDA).

"Personal information" under the Act means information about an
"identifiable individual." For example, "personal information" includes your
name.

The Act gives you control over your personal information by requiring
organizations to obtain your consent to collect, use or disclose information
about you.

The law gives you the right to:
*complain about how an organization handles your personal information if you
feel your privacy rights have not been respected.

The law requires organizations to:
*obtain your consent when they collect, use or disclose your personal
information;
*have personal information policies that are clear, understandable and
readily available.

What is not covered by PIPEDA?
*Any organization that collects, uses or discloses personal information
solely for journalistic, artistic or literary purposes.
*An individual's collection, use or disclosure of personal information for
personal purposes, such as genealogical research shared with other family
members.

[Charani]

On Wed, 5 Apr 2006 19:30:27 -0400, Tim Campbell wrote:

8>< snip

*An individual's collection, use or disclosure of personal
information for personal purposes, such as genealogical research
shared with other family members.

The key phrase there is "genealogical research *shared with other
family members*.

Putting the information on the net isn't just sharing the information
with other family members. It's sharing it with the world.

I think you've taken a sensible, courteous, responsible course of
action. You can always add information periodically, after all )

[Lesley Robertson]

"Tim Campbell" <[email protected]> wrote in message
news:[email protected]...

4. Banks use your mothers maiden name for security reasons,

Only if you give it to them. Since my family history appears in a couple of
places, I gave my UK bank the surname of one of my grandmothers. Trouble is
that I can't remember which one, and am always reduced to saying "it's
either XXX or ZZZ"..... Thus far, the bank staff have simply been amused!
Lesley Robertson

[Steve Hayes]

On Wed, 5 Apr 2006 19:30:27 -0400, "Tim Campbell" <[email protected]> wrote:

I recently asked for opinions in how to deal with an issue (relative does
not want information listed in reports), and have been amazed at the fervent
debate and positions.

If it hadn't been for the fervent debate, it wouldn't have been an issue,
would it?

The Act gives you control over your personal information by requiring
organizations to obtain your consent to collect, use or disclose information
about you.

The law gives you the right to:
*complain about how an organization handles your personal information if you
feel your privacy rights have not been respected.

The law requires organizations to:
*obtain your consent when they collect, use or disclose your personal
information;
*have personal information policies that are clear, understandable and
readily available.

Quite -- note that it refers to organisations, not family members. My name may
be "private", but that doesn't mean that my wife or my children have to seek
my explicit permission whenever they want to mention my name to other members
of the family.

What is not covered by PIPEDA?
*Any organization that collects, uses or discloses personal information
solely for journalistic, artistic or literary purposes.
*An individual's collection, use or disclosure of personal information for
personal purposes, such as genealogical research shared with other family
members.

Well that just about covers the legal side, doesn't it?

But it doesn't stop it from being an issue in forums like this, though!



--
Steve Hayes from Tshwane, South Africa
http://www.geocities.com/Athens/7734/stevesig.htm
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

[Robert G. Eldridge]

On Thu, 6 Apr 2006 08:23:15 +0100, Charani <[email protected]> wrote:

On Wed, 5 Apr 2006 19:30:27 -0400, Tim Campbell wrote:

8>< snip
*An individual's collection, use or disclosure of personal
information for personal purposes, such as genealogical research
shared with other family members.

The key phrase there is "genealogical research *shared with other
family members*.

Putting the information on the net isn't just sharing the information
with other family members. It's sharing it with the world.

I think you've taken a sensible, courteous, responsible course of
action. You can always add information periodically, after all )

I think you have read too much into what is after all just an example.

Tim also included in what wasn't covered by the Personal Information
Protection and Electronic Documents Act:

*Any organization that collects, uses or discloses personal
information solely for journalistic, artistic or literary purposes.

Therefore, by my reading, the use and disclosure of personal
information, including names, for literary purposes, such as
publishing genealogical studies on the Internet wouldn't be covered.

A persons personal purpose could be is the study and publishing of
genealogical studies, for example as I do.

--
Robert G. Eldridge Toronto NSW Australia
http://www2.hunterlink.net.au/~ddrge/
Now researching ELDRIDGE families world wide
1000's at my Web site * Wanted * Any Eldridge related information

[J. Hugh Sullivan]

On Wed, 5 Apr 2006 19:30:27 -0400, "Tim Campbell"
<[email protected]> wrote:

I recently asked for opinions in how to deal with an issue (relative does
not want information listed in reports), and have been amazed at the fervent
debate and positions.

Not only was I trying to understand my legal position (in disclosing
information on a website), I was also trying to understand my position of
genealogical accuracy vs. personal sentiments.

Thus, after much study (and following the thread and discussions) I have
come to the following conclusions:
1. I want to be a good guy, and avoid getting people upset,
2. In Canada, pursuant to the Personal Information Protection and Electronic
Documents Act (PIPEDA; snippets quoted below), an individuals NAME (as well
as other information) is PRIVATE information, and cannot be disclosed
without consent,

So, has anyone here ever given the telephone company permission to
list his name?

Do they have a Brown's Directory in Canada?

Most of our names are on Zaba Search, Switchboard and other internet
sites - who gave them permission?

When you are introduced do you give permission or is it assumed?

May I effectively sue all the companies/people who use my name to send
me unwanted mail? I do understand that my name is not "occupoant". But
is my address also private?

Would I have to show my ID with my name on it to a Canadian Customs
Officer?

I wonder what would happen if a PoW in Iraq refused to give his name
based on some privacy act.

So tell me, does "private" mean about the same thing as "illegal" when
used with immigrant, i. e., absolutely nothing?

3. The act noted only applies to living people,
4. Banks use your mothers maiden name for security reasons,

...not if you are wise enough to use another name. And most security
requests now allow for the use of several responses with a question to
remind you what you used.

The law seems so unenforceable that, if a man, could be used to guard
a harem.

Hugh

[T.M. Sommers]

Charani wrote:

On Wed, 5 Apr 2006 19:30:27 -0400, Tim Campbell wrote:

*An individual's collection, use or disclosure of personal
information for personal purposes, such as genealogical research
shared with other family members.

The key phrase there is "genealogical research *shared with other
family members*.

Putting the information on the net isn't just sharing the information
with other family members. It's sharing it with the world.

You have to read the text of the actual act to really know what
it means. The English version is at:
http://laws.justice.gc.ca/en/p-8.6/93196.html.

Here are some excerpts. My comments in square brackets.

PART 1
PROTECTION OF PERSONAL INFORMATION IN THE PRIVATE SECTOR

2. (1) The definitions in this subsection apply in this Part.

"commercial activity" means any particular transaction, act or
conduct or any regular course of conduct that is of a commercial
character, including the selling, bartering or leasing of donor,
membership or other fundraising lists.

"organization" includes an association, a partnership, a person
and a trade union.

"personal information" means information about an identifiable
individual, but does not include the name, title or business
address or telephone number of an employee of an organization.

[Section 4(1) is complete.]
4. (1) This Part applies to every organization in respect of
personal information that

(a) the organization collects, uses or discloses in the course of
commercial activities; or

(b) is about an employee of the organization and that the
organization collects, uses or discloses in connection with the
operation of a federal work, undertaking or business.

(2) This Part does not apply to

(b) any individual in respect of personal information that the
individual collects, uses or discloses for personal or domestic
purposes and does not collect, use or disclose for any other
purpose; or

(c) any organization in respect of personal information that the
organization collects, uses or discloses for journalistic,
artistic or literary purposes and does not collect, use or
disclose for any other purpose.

[I don't know what Schedule 1 is, but what follows is obviously
the operative part of the Act.]
7. (1) For the purpose of clause 4.3 of Schedule 1, and despite
the note that accompanies that clause, an organization may
collect personal information without the knowledge or consent of
the individual only if

(c) the collection is solely for journalistic, artistic or
literary purposes;

(d) the information is publicly available and is specified by the
regulations;

(2) For the purpose of clause 4.3 of Schedule 1, and despite the
note that accompanies that clause, an organization may, without
the knowledge or consent of the individual, use personal
information only if

(c) it is used for statistical, or scholarly study or research,
purposes that cannot be achieved without using the information,
the information is used in a manner that will ensure its
confidentiality, it is impracticable to obtain consent and the
organization informs the Commissioner of the use before the
information is used;

(c.1) it is publicly available and is specified by the
regulations; or

(3) For the purpose of clause 4.3 of Schedule 1, and despite the
note that accompanies that clause, an organization may disclose
personal information without the knowledge or consent of the
individual only if the disclosure is

(f) for statistical, or scholarly study or research, purposes
that cannot be achieved without disclosing the information, it is
impracticable to obtain consent and the organization informs the
Commissioner of the disclosure before the information is disclosed;

(h) made after the earlier of

(i) one hundred years after the record containing the information
was created, and

(ii) twenty years after the death of the individual whom the
information is about;

(h.1) of information that is publicly available and is specified
by the regulations;

[End of excerpts.]

First, note that the act does not apply to non-commercial
activities, so an amateur genealogist could put personal
information on a free web page without violating the act. But if
that same amateur put that same information in a book and charged
for that book, it might be a violation.

Professional genealogists might be in trouble, though. Unless
genealogy is a journalistic, artistic or literary purpose (and I
think it would be), or genealogical information is specified by
regulation, it is illegal to even collect genealogical
information without consent. It is also illegal to disclose
information about events more recent that 20 years after the
people involved died, or 100 years after the event for the living
or the more recently dead. Note that while it is permissible to
disclose ancient information, it is not permissible to collect it.

Of course, I am not a lawyer, and this is not legal advice.

--
Thomas M. Sommers -- [email protected] -- AB2SB

[Steve Hayes]

On Thu, 06 Apr 2006 15:21:49 -0400, "T.M. Sommers" <[email protected]> wrote:

(2) This Part does not apply to

(b) any individual in respect of personal information that the
individual collects, uses or discloses for personal or domestic
purposes and does not collect, use or disclose for any other
purpose; or

So that exempts my family tree and my Christmas card list

(c) any organization in respect of personal information that the
organization collects, uses or discloses for journalistic,
artistic or literary purposes and does not collect, use or
disclose for any other purpose.

I note that they don't specifically include academic or historical research.
Perhaps that is included under "literary", There is a lot of personal
information available at

http://www.dacb.org

and I have contributed some of it. The guy in charge of the project is a
Canadian.





--
Steve Hayes from Tshwane, South Africa
http://www.geocities.com/Athens/7734/stevesig.htm
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk