How To Do A Privacy Assessment

Multi-Application Smart Cards:
How to do a Privacy Assessment
A Joint Project of
The Information and Privacy Commissioner/Ontario
and
The Advanced Card Technology Association of Canada

Information and Privacy
Commissioner/Ontario

Advanced Card
Technology Association
of Canada

August 2000

The Advanced Card Technology Association of Canada and the Information and PrivacyCommissioner/Ontario gratefully acknowledges the work
of Catherine Johnston, Keith Saunders (MAOSCO) and the Office of the
Information and Privacy Commissioner/Ontario in preparing this report.
Note: This paper is an update to the 1997 publication, Smart, Optical and
Other Advanced Cards: How to do a Privacy Assessment.
This publication is also available on the IPC Web site.

Information andPrivacy
Commissioner/Ontario
80 Bloor Street West, Suite 1700
Toronto, Ontario M5S 2V1
416-326-3333
1-800-387-0073
Fax: 416-325-9195
TTY (Teletypewriter): 416-325-7539
Web site: http://www.ipc.on.ca

Advanced Card Technology
Association of Canada
831 Miriam Road
Pickering, Ontario L1W 1X7
905-420-3520
Fax: 905-420-2729
Web site: www.actcda.com
Email: info@actcda.com

Table ofContents
Foreword ................................................................................................................... 1
Chapter 1 — The Basics ............................................................................................ 2
What Is Privacy? ........................................................................................................... 2
Why IsPrivacy Important? ........................................................................................... 2
The Impact of Computer Technology on Privacy .......................................................... 3
What Is the Role of This Document? ............................................................................ 5

Chapter 2 — Privacy Protection Principles................................................................. 6
Recognition and Respect for Privacy ............................................................................. 7
Openness ..................................................................................................................... 7
Purpose Specification................................................................................................... 7
Collection Limitations .................................................................................................. 8
Notification .................................................................................................................. 8
Use............................................................................................................................... 8
Right of Access ............................................................................................................. 8
Right of Correction ...................................................................................................... 9
Accuracy ...................................................................................................................... 9Disclosure .................................................................................................................... 9
Retention and Disposal................................................................................................. 9
Security ...................................................................................................................... 10
Aggregation................................................................................................................ 10
Accountability ............................................................................................................ 10
Contractual Agreements ............................................................................................. 10
Anonymity and Psuedonymity...