Your Privacy: How Safe from U.S. Probes?

[Editor's update: As predicted in this story, the Privacy Commissioner has concerns that new legislation may not go far enough to protect privacy of British Columbians. Read the report and summary here.]

 Will the USA Patriot Act crack open the electronic files the provincial government keeps on us all?  Joyce Murray, the minister responsible for privacy, has reassured citizens that our data is locked behind electronic firewalls that snoops south of the border will never penetrate.  But the privacy commissioner, who releases a comprehensive, independent investigation of the matter on Friday, sounded sceptical in a letter to Murray last week, now posted on his website.

Congress passed the USA Patriot Act  after the terrorist attacks in 2001.  Its powers are sweeping, and potentially international in scope, according to Micheal Vonn, the policy director of the B.C. Civil Liberties Association.  That's because the Act allows the government to seize "any tangible thing—and that includes entire databases of information—from a U.S. company."  

Act shrouded in secrecy 

B.C. is in the midst of a privatization boom.  The government has outsourced many functions, but the privatization of parts of the Medical Services Plan and PharmaCare has drawn the most attention.  Two multimillion-dollar American firms—EDS and MAXIMUS—have been at the centre of the concern about privacy and the Patriot Act, simply because they will be handling massive databases of personal information, and because they are based in the U.S.  Under the Patriot Act, information managed by a company operating in B.C. but with links to an American firm is vulnerable to seizure, Vonn said.

Murray, however, disputes the strength of the American ties.  In an interview with The Tyee, she said, "With our outsourcing, we are only signing contracts with Canadian companies. I mean we're already requiring that the outsourcing company is a Canadian company."  In its submission to the Loukidelis review, however, MAXIMUS describes itself as "A United States-based company whose mission is 'Helping Government Serve the People'.  We have international subsidiaries," it says, "MAXIMUS provides health benefit operations in sixteen projects in the United States, and seeks to provide such services in the Province of British Columbia."

Calibrating the degree of that risk is almost impossible, however, because secrecy shrouds every aspect of the Patriot Act, Vonn said.  "The U.S. government won't release any information about the provisions of the Patriot Act we're concerned about."   Under the Patriot Act, you'll never know if information is being collected about you—or why—and it's impossible to know how often the Act has been used, and for which reasons.

Likewise, the identities of judges sitting on the secret courts convened to hear applications for information made under the Act are confidential, as is the location of the court.  And companies, organizations and individuals ordered to hand over private data must keep this order under wraps, and are forbidden to reveal it even to their lawyer.

'Arguing in a blackout'

Jameel Jaffer, a lawyer with the American Civil Liberties Union and an expert on the Act, said a person could be charged with contempt of court, if they let slip that the FBI has required them to produce confidential data.  Congress is currently debating a law that could result in a ten-year sentence for anyone breaking the gag orders prescribed by the Act.

When Jaffer submitted an access to information request to answer such basic questions as how often the Act had been used, he received a pile of papers, but the material he said, was largely blacked out.  The documents "don't tell you very much at all, beyond the basic fact that the laws are being used."

Murray, however, remains confident that the FBI will never have access to citizens' health records and other private data.  She says at least one professor of public policy quoted in the media supports the view that "the fear is hugely overblown, and that the United States law enforcement agencies are very aware that there are proper channels for the sharing of information." She says the same professor deemd it unlikely the FBI "would undertake what's known to be unpopular going around those existing arrangements, and that was our analysis as well."

Vonn takes a less sanguine view.  Because the provisions of the Patriot Act remove it from the public eye, and because there is no case law concerning it, Vonn contends the government has little evidence to go on when it reassures the public that private information will stay that way.  "We're all arguing in a blackout here," she said. 

Divided opinions 

The privacy commissioner waded into this swamp last summer, soliciting submissions from interested parties.  He was swamped with dozens of reports from across the country and around the world outlining the potential risks to public information held by American owned or operated companies.  Some of these submissions are posted on the privacy commissioner's website, and generally they fall into two broad categories.

There are those who say confidential information held by American companies in Canada is beyond the long arm of the Patriot Act, with the appropriate safeguards in place. This list includes U.S. Department of Homeland Security, the B.C. government, Maximus, Microsoft, and EDS.  Unions, non-profit organizations, academics, and civil liberties lawyers were less confident that the Patriot Act would not reach into the databases of companies contracted by the province to do its work.

Murray didn't wait

Before Loukidelis could reach any conclusions about the problem, the government pre-empted him.  On October 7, Murray introduced Bill 73, the Freedom of Information and Protection of Privacy Amendment Act.  In the House the minister said the legislation was "in response to concerns raised about the USA Patriot Act and to ensure that the personal information of British Columbians continues to enjoy the highest protection of any personal information in Canada."

Loukidelis tartly responded to the Murray, reminding her in a letter posted on his website that the review of the Patriot Act and outsourcing would be released on October 29.  He also had some questions and comments for the minister.  "As I read s. 23(2), Bill 73's new personal information protection rules do not apply to any outsourcing contract, in the case of a ministry of the government, entered into October 12, 2004, five days after Bill 73 received first reading."  He asked which contracts had been signed by the government, which services have been let, whether the service provider has links to U.S. corporations, the kinds of information that is involved, the terms of the contract, and provisions for ensuring B.C.'s privacy rules are complied with.

Loukidelis isn't saying if Murray ever got back to him with answers.  His media liaison, Judy Durrance, said all would be revealed at a press conference, to be held after Loukidelis posts his report online at 10 a.m.   Murray's spokesperson, Liz Bicknell, said the minister "doesn't normally share correspondence," and that it would be "more full" to wait till Friday to comment.

Judith Ince is on staff at The Tyee.