City of Edmonton goes Google Apps – (Part 2/2) Privacy Issues, USA Patriot Act, FOIP Act

Apr 15 update: Here is an excerpt from an Apr 15th Guardian article “Web freedom faces greatest threat ever, warns Google’s Sergey Brin – Exclusive: Threats range from governments trying to control citizens to the rise of Facebook and Apple-style ‘walled gardens’” (emphasis added)

“[Google co-founder Sergey] Brin acknowledged that some people were anxious about the amount of their data that was now in the reach of US authorities because it sits on Google’s servers. He said the company [Google] was periodically forced to hand over data and sometimes prevented by legal restrictions from even notifying users that it had done so.”

The above excerpt is a very powerful statement that should make foreign (to US) decision makers in the private and public sectors think carefully of what they get themselves into by putting data, especially sensitive data, onto Google’s cloud. As we can see from the latest Supreme Court of Canada decision rejecting current Canadian loose wiretap law, the court has made it clear that accountability and effective judicial oversight are very important matters in Canada.

***

The focus of part 2/2 of this article series will be on the privacy related issues of City of Edmonton going with Google Apps. (See part 1/2 of this series for the financial and technology impacts.)

Keywords: The Freedom of Information and Protection of Privacy Act, USA Patriot Act, Privacy Impact Assessment, Office of the Information and Privacy Commissioner of Alberta, Office of the Privacy Commissioner of Canada

Summary: After extensive preparation by City of Edmonton to go with Google Apps, it is puzzling and questionable why city of Edmonton FOIP office (reporting to Edmonton city council, and working closely with Edmonton Chief Information Officer) has NOT yet decided to submit a privacy impact assessment under The Freedom of Information and Protection of Privacy Act to the Office of the Information and Privacy Commissioner of Alberta and the Office of the Privacy Commissioner of Canada to seek the two Offices of the Privacy Commissioners’ advices and recommendations.

The FOIP Act, USA Patriot Act, and the case of University of Alberta

First of all, a little bit of information about The Freedom of Information and Protection of Privacy Act (the FOIP Act) (emphasis added),

“[the FOIP Act] was passed by the Alberta Legislature in June 1994. It came into effect on October 1, 1995. The FOIP Act provides individuals with the right to request access to information in the custody or control of public bodies while providing public bodies with a framework within which they must conduct the collection, use and disclosure of personal information.“

Given the FOIP Act focus re the “collection, use and disclosure of personal information“, it leads me to a serious concern in seeing City of Edmonton going with Google Apps and wondering how will the USA Patriot Act impact Canadians? At the moment, Google has no dedicated data center located in Canada, and Google stores its data in data centers primarily located in United States. Dr. Jonathan Schaeffer, University of Alberta Vice Provost and Associate Vice President (Information Technology), responsible for moving the university to Google Apps for Education, has painted an informed picture in this article, (emphasis added)

“The decision to go Google took almost two years to be realized. First, we had to investigate all our options, including providing a single system on campus (e.g., Microsoft) and using a local provider (e.g., Telus). Second, having decided on Google, we did our due diligence by doing a privacy impact assessment and getting it accepted by the Office of the Information and Privacy Commissioner of Alberta. Third, we had to negotiate a contract with Google that respected Alberta’s and Canada’s laws. Google houses its data in data centers that are primarily located in the United States. The U.S. Patriot Act acts as a lightening rod for some people. It took 1.5 years to come up with an agreement that satisfied our legal team (both internal and external the university), security team, and privacy officer. Only after going through all these steps were we comfortable with signing an agreement with Google.”

In a phone interview with Wayne Wood, Communications Director, Office of the Information and Privacy Commissioner of Alberta, Wood explained that, in Alberta,