-Hi, I'm Martin Rust, with the Security and Policy Institute for Professional Development,
here at the University of Ottawa.
My guest this afternoon is Sheila FitzPatrick.
Sheila is the worldwide data and governance counsel for a company called NetApp, a significant
technology organization doing a lot of business with the federal government of Canada and
other governments.
In that context, we've been talking a little bit about national security and privacy and
legislation and what lawmakers are working with.
And I wanted to spend some time this afternoon talking about that balance between those two
things and maybe we can start with the big picture and the current landscape, where you
see things today.
-Sure.
It's obviously one of the hottest topics today.
It's really how you deal with the whole issues around complying with data privacy and data
sovereignty laws which you know are very big in Canada and elsewhere in the world, the
U.S. probably being the least restricted when in comes to data privacy laws and data sovereignty
laws.
Our laws are really based on a more industry standard as opposed to Canada, which is more
based on the European laws, which is the protection of personal information and the right to privacy
versus the real freedom of information.
And one of the areas that we're seeing a lot of conflict is because of all the cyberattacks
that are occurring and also, you know, terrorist activity going on around the world that government
and private sector is concerned about.
How do we protect our infrastructure, yet balance our obligation to protect people's
personal information.
And there becomes a conflict there because at what point do the laws or the legislation
become so intrusive that it's actually interfering with people's privacy rights and at what point
do you have to look at the risk continuum in terms of, do we comply with our cyber obligations
to report to the government that there's been a cyberattack?
What data's been exposed?
If you expose that data, are you then violating the data privacy obligations that you have
under Canadian law, or are you going to risk not complying with your cyber reporting obligations?
That becomes a world risk, that you have to look at.
-So, just to step back for a quick second, help me understand a little bit better the
difference between the U.S. environment and the Canadian environment.
-Sure.
That's pretty easy to differentiate between.
If you look at the Canadian environment, you have data privacy laws.
You have them at several levels.
You have two at the federal level.
You have the privacy act that pertains to government entities, so any of your ministries
and your government authorities and organizations have to comply with the privacy act.
The private sector has what's called PIPEDA, so the protection of personal information,
but it applies primarily to the private sector.
You then have sectorial laws and provincial laws.
So, British Columbia and Nova Scotia have two of the strict privacy laws that really
focus in on the protection of individuals' personal data and the requirement to maintain
that data within the province.
So you wouldn't want to store that data or transfer that data outside of B.C. or Nova
Scotia.
You're a little bit safer keeping it within Canada, but even laws say you can't move it
out of Canada, which gets a little difficult.
But the real problem comes in when you move that data to the U.S.
That's because the U.S. really doesn't have anything that's equivalent to what you see
in Canada.
The privacy laws in the U.S. are usually based on industry, so if you're a regulated industry
like the government or healthcare or financial institution, you're going to have a little
bit more legislation around the protection of data, but that data is normally confidential,
business related data.
It's not necessarily the personal data of an individual, unless it's healthcare information.
And then, the U.S. has HIPAA, which is our health care portability act, which protects
personal data related to health, but that's about it.
So there's a real difference between protecting all of the personal data that relates to an
individual versus just protecting very specific information.
-It's an issue that's very relevant today and, certainly, Canadians are wrestling with
what personal information they want to provide and, certainly, to which organization and
which level of government to provide it.
So, thank you for that.
-You're welcome.
-I'm Martin Rust, with the Security and Policy Institute for Professional Development, here
at the University of Ottawa.
My guest this afternoon is Sheila FitzPatrick, the worldwide data governance and privacy
counsel for NetApp.
Thank you.
-Thank you.