Consent and privacy

participated in the development of codes of practice that align with the requirements of data protection
principles or laws. Depending on the legislation in place, these are either voluntary best practices developed
by industry or are developed by DPAs to serve as an enforcement tool.
For example, in the UK, the Information Commissioner can encourage the development of codes of practice,
or initiate one, following consultations with industry and the public. In Australia, credit reporting bureaus can
develop codes of practice to be registered by the Commissioner. A breach of a registered code of practice can
be investigated by the Commissioner.
In the U.S., the White House Consumer Privacy Bill of Rights promotes the idea of enforceable codes of
conduct for specific markets or business contexts in order to provide consumers with more consistent privacy
protections by standardizing privacy practices within sectors.
In Canada, paragraph 24(c) of PIPEDA mandates the OPC to encourage organizations to adopt instruments
such as policies and codes of practice in line with PIPEDA requirements. We have not yet fully explored this
provision. When it comes to consent, some might argue that codes of practice in particular sectors could
provide an added measure of predictability and consistency for companies in terms of understanding their
obligations around meaningful consent and appropriate limits on data processing. It might also be argued that
codes of practice would offer greater clarity for individuals that their information is being processed in a
transparent and fair manner in line with their expectations.
Questions for Reflection
1) Could sectoral codes of practice indeed enhance consent and/or privacy
protection?
2) How should they be enforceable?
3) Who should be involved in developing sectoral codes? Who should be
responsible for overseeing compliance with sectoral codes?
b) Privacy Trustmarks
Privacy seals, like codes of practice, can be a useful accountability mechanism for organizations to help ensure
compliance with privacy laws and to demonstrate a commitment to privacy. Like codes of practice, these can
be operated by privacy regulators or organizations, depending on the jurisdiction.
In France, la Commission nationale de l’informatique et des libertés (CNIL) operates an accountability seal
program for companies that comply with the CNIL’s standard for what accountability means in practice. The
U.K. ICO recently introduced a privacy seal program 88 whereby the ICO will endorse third party operators to
deliver the program. The operators will then be responsible for the day-to-day management of the program.
U.S.-based TRUSTe is one of the best known privacy seal programs. It has been operating since 1997 and
primarily certifies websites. In Europe, EuroPriSe offers certification to manufacturers and vendors of IT
_____________________________________________________________________________________________________
30 Victoria Street – 1st Floor, Gatineau, QC K1A 1H3 • Toll-free: 1-800-282-1376 • Fax: (819) 994-5424 • TDD (819) 994-6591
www.priv.gc.ca • Follow us on Twitter: @privacyprivee
21