30th Anniversary of the OECD Privacy Guidelines
Remarks by Jane Hamilton, Industry Canada
OECD
Paris, France (March 10, 2010)
 Pleased to be part of this panel and speak to you today about the OECD
Privacy Guidelines from an Industry Canada perspective.
 That is to say, from the perspective of the Government Department in Canada
that developed, and now continues to administer, Canada’s private sector
privacy legislation.
 The OECD Privacy Guidelines are the definitive benchmark against which
virtually all subsequent instruments have measured themselves to
demonstrate soundness and credibility and Canada, proudly I might add, is
part of that tradition.
 The Guidelines, which are technology neutral, easy to understand and flexible,
served as the basis for Canada's federal private sector privacy law and
subsequently its provincial private sector privacy laws.
 This demonstrates that the objective of the Guidelines to establish a cohesive,
well-aligned set of privacy “”rules” internationally, adapted well to the realities
of countries that also face challenges related to the free flow of data at the
sub-state level, in our case, at the level of Canadian provinces and territories.
 Also of interest, is the way our legislation evolved. Namely, moving from a
national standard developed on a consensus basis by a multi-disciplinary
stakeholder group, to a legislative approach that had the support and buy-in of
those original stakeholders.
 This is further evidence of the flexibility of the Principles-based approach
encompassed in the Guidelines, in that they can form the basis for a standard,
as well as national legislation. Going forward, preserving these attributes in
the Guidelines will be key.
 In addition to assisting government in this way, the flexibility built into the
OECD Guidelines allows organizations to adapt their requirements to their
own needs and circumstances. This means that they can take practical and
cost-effective approaches to meeting their obligations. A very important
consideration from the perspective of the marketplace.
 At the same time, the Guidelines put control in the hands of consumers.
Page 1 of 3
 This consumer empowerment is a key policy objective in our national
legislation as well. Consumers are empowered under the principles of
“Individual Participation” (which provides for access) and “Use Limitation”
(which requires consent).
 On the subject of consent, there is widespread recognition that increasingly
complex data flows and new service offerings are putting pressure on the
notion of consent……..(we heard from Justice Kirby that this will be an
important element of the Guidelines to revisit in light of the new pressures on
the concept of consent).
 Within Canada, individual control continues to be highly valued and we
continue to work towards ensuring that consent is not “symbolic” or “fictitious”
(in the words of Justice Kirby).
 In the 30 years since the Guidelines have been in place, dramatic advances in
technology have fundamentally changed the way data is collected, used and
shared……..And yet, the Guidelines remain relevant.
 They contain key principles that allow countries to build on, and expand as
required, to address national values and priority policy objectives. For
example, the accountability principle means that Canada's privacy regime
extends to third-party service providers that may be located outside our
borders. Again, a matter of key importance to Canadians.
 The concept of accountability is increasingly attracting attention internationally
as an enforcement mechanism for privacy protection but as I understand
others on this panel will be delving into that subject in a little bit more detail, I
will leave my remarks there on that particular subject.
 The Guidelines continue to withstand the test of time. In contrast, laws are
more evergreen instruments that are periodically adjusted to address new
issues.
 Canada is currently in the process of its first parliamentary review of its
privacy legislation. We have heard (from stakeholders and the Parliamentary
Committee that reviewed the law), that our Act is working well and that only
some fine-tuning of the legislation is required. This attests to the
effectiveness and continued relevance of the legislation.
 However, the review presents the opportunity to do improve the effectiveness
of the legislation and to further clarify certain obligations for business. By way
of example, like the Privacy Guidelines, Canada’s privacy law includes a
safeguarding principle.
Page 2 of 3
 To further expand upon this principle, we are proposing amendments to
include data breach notification requirements. The legislative approach we
plan to take will be risk-based with a view to not being overly prescriptive.
 We expect that the safeguarding principle will be the subject of much
discussion in the assessment of the OECD Privacy Guidelines and the everincreasing need for organizations to improve on security practices and
procedures … (which is so dear to the hearts of the WPISP members in the
room today).
 The next five-year review of our legislation will soon be upon us. Our federal
Privacy Commissioner will be holding consultations to assess the impact of
new technologies and these discussions will help inform this next review. The
changing business models and dramatic increases in global data flows have
started an international stocktaking trend and these various processes
(particularly the current review of the OECD Guidelines) will also be
informative.
 Of particular interest to Canada is the work the OECD is undertaking to better
understand the extent to which personal information is integrated into
business models and its contribution to economic activity, company
performance, and the Internet economy as a whole. The intention here is to
not view the economic dimensions of privacy protection in isolation, but rather
in conjunction with a wide range of other considerations related to privacy
protection. (e.g., in the context of democratic values as Justice Kirby
reminded us).
 As such, we fully support the planned roundtable on the “economics” of
privacy next December and look forward to the discussion and debate that will
take place at that time.
 We view the Guidelines as having played a significant role in the development
of Canada's privacy law for the private sector as well as having a continuing
impact despite major changes in the marketplace.
 It is important to maintain these high-level flexible Guidelines to guide
countries as they continue to seek to adopt internationally aligned approaches
to privacy protection and encourage the free flow of data that is now required
for trade and economic growth.
Page 3 of 3