Addressing privacy issues: New standards set to become law by 2004. (Guest Columnist).

How many of us are actually comfortable with the thought of giving information out to Web merchants, organizations, and businesses over the Internet? According to multiple sources, under 10 per cent of Internet users are confident giving out personal information.

Fortunately, the federal government is creating standards for electronic commerce which businesses need to follow to ensure success. These standards are in motion to become law by 2004.

People who actually do follow through and share personal information online either do so reluctantly or give false information, which is of little, if any, value.

The Personal Information Protection and Electronic Documents Act (PIPEDA) was the first to become law on May 1, 2001. The act addresses the privacy issue facing today's online community stating that any business found selling personal information about its users without the users' knowledge will be subject to fine.

PIPEDA was developed in three stages:

Stage 1

Federally-regulated private-sector and out-of-province exchanges of personal information:

* Starting on Jan. 1, 2001 the law applies to personal information of clients and employees in the federally regulated private sector such as airlines, banking, broadcasting, interprovincial transportation and telecommunications.

* The law also applies to all organizations that disclose personal information for consideration outside a province or the country.

Stage 2

Health information:

* On Jan. 1, 2002 the law will also apply to personal health information for the organizations and activities already covered in the first stage.

Stage 3

Commercial use of personal information within individual provinces:

* On Jan. 1, 2004 the law will extend to every organization that collects, uses or discloses personal information in the course of a commercial activity within a province, regardless of whether or not the organization is a federally-regulated business.

So how can businesses prevent privacy legislation retaliation from customers? Have a privacy policy in place and terms-of-use statement that can be viewed by each user at anytime. Either your lawyer or a professional information technology company familiar with the process of creating privacy policies can write one for your organization.

Security

Security is one of the most publicized issues surrounding e-business. So how can you avoid hacking and lost data? One. Get a merchant account from your bank to accept online payment.

Two, Get a digital certificate from a provider such as Verisign or Thawte. Digital certificates provide encryption up to 128-bit PKI. 128-bit encryption will take 78,000 computers 13 billion times the age of the universe to crack (cryptography policy framework-Industry Canada, Feb-98)...I think you are safe!

You can check and see if a site is secure by checking if a lock symbol is down on the right-hand corner of the browser or if the site is http:// instead of the regular http://. To view the certificate go to file, properties, and view certificate in order to get the details of the certificate issuer and recipient. However, the big issue around security is internal hacking. More than half of hacking is done internally in any organization.

Restriction of access by use of assigned passwords will provide sufficient protection against internal hacking. To protect your database from internal hacking contact an IT company or networking specialist and explore your options.

Privacy protection and security are only a small part of the problem that people are facing when trying to conduct business over the Internet. Other concerns such as contract formation and redress, information provision, logistics and communication need to be addressed in order for consumers, users, and businesses to gain confidence in the digital economy.

Darren Contardo, director of industrial relations for EB Verify Inc.