With Canada's national privacy law now nearly four years old, the Canadian privacy community has begun to assess the law's strengths and weaknesses. A recent ruling from the Privacy Commissioner of Canada's office involving an inadvertent e-mail disclosure provides a good case study for why the law's fundamental principles remain sound but that enforcement - both in terms of the Commissioner's approach and in limitations found in the law - remain a persistent shortcoming.

The case involved an unnamed Canadian loyalty program that mistakenly revealed the e-mail addresses of 618 people when it sent an e-mail message about a contest. The error was a relatively common one - rather than hiding the names in the e-mail message, the e-mail operator placed all the addresses in the "to" field. The company quickly sent an apology to the affected parties, but eleven recipients still chose to launch a complaint with the federal privacy commissioner.

The assistant privacy commissioner, who assumed responsibility for the complaint, concluded that it was "well founded." Canada's privacy legislation requires consent before the disclosure of personal information and it also compels organizations to provide adequate security safeguards to protect the personal information they collect. In this particular case, the e-mail addresses constituted such personal information. Despite the existence of a privacy policy and some security safeguards, the loyalty program failed to comply with both the disclosure and security principles and thus ran afoul of the law