Lawson, however, says on that issue Stoddart’s office has trod carefully. A few years ago, she asked the office of the privacy commissioner to look into an American web site, abika.com, that was, according to court documents, allegedly selling information about Canadians, including background checks, psychological profiles, cellphone numbers, and criminal records. Lawson, who paid $119 for a report on herself, filed a complaint under the Personal Information Protection and Electronic Documents Act alleging the company gave out information on Canadians without their permission.

Stoddart’s office, though, declined to probe the case, arguing it didn’t have jurisdiction to take action against companies outside Canada even though the complaint had merit. In response, Lawson took the commissioner to Federal Court, which ruled that while privacy legislation doesn’t specifically authorize her to investigate such matters, it doesn’t preclude her from doing so either. Further, the judge noted that while probing the case might be difficult, especially when the alleged violator declines to respond or co-operate, that doesn’t mean it’s not worth a try. The commissioner could also attempt to locate the company’s Canadian operations, the judge wrote.

It was the second time Lawson had launched a court challenge against the privacy commissioner over a cross-border matter, something she argues exemplifies the office’s cautious approach. At the same time, Lawson disagrees with Stoddart’s point that contracts between Canadian companies and the entities they outsource to can mitigate the risks of data breaches since a foreign government — under the U.S. Patriot Act, for example — can override those agreements through the guise of national security. As a result, she’d like to see Stoddart adopt a blacklist of countries that don’t offer comparable privacy protection to Canadian laws.

Stoddart has identified changes she would like to see to federal privacy legislation to improve protections. In particular, she recommended several amendments to the Privacy Act, which governs the actions of government departments. Much of the advice focuses on how departments manage privacy issues, especially in light of information-sharing practices that have developed among law enforcement agencies following the Sept. 11, 2001, terrorist attacks. The Canada Border Services Agency should consider its practice of verbally sharing information with other countries and track how often it does so, Stoddart’s office recommended. She also addressed the issue of mandatory reporting of data breaches to her office, something neither government agencies nor private companies have to do now. “There are some irritants in PIPEDA that should be ironed out,” she says, noting the act is to come up for review next year.

Still, Lawson would like the government to go a few steps further in reforming privacy legislation. First, she wants authorities to lessen the financial risks people who take privacy cases to Federal Court face when they lose and find themselves liable for costs. As well, she feels the court process should protect complainants’ personal information, something that doesn’t happen even though privacy is usually what the case is all about.

Lawford, too, would like to see Stoddart have the authority to, in some cases, prohibit the transfer of sensitive information to outsourced companies overseas. “That could be an outcome, but we’re not there because when she had a chance to ask for order-making powers, she didn’t,” he says, referring to her remarks before a parliamentary committee reviewing PIPEDA a few years ago.

Stoddart, though, does have her hands full with the constantly emerging ways Canadians find their privacy in jeopardy. Just recently, her officials met with representatives of Google Inc. over that company’s plans to introduce interest-based advertising, which essentially allows marketers to target consumers based on what they do on the Internet, including the web pages they visit. “Clearly, behavioural advertising generally is again another challenge,” she says, noting that while companies may vow to collect information in a way that masks who the user is, such protections don’t always work out as planned. “[Y]ou have data spills inadvertently. You have data breaches. You have organized crime being interested.”

One of the biggest issues, however, involves balancing the need to protect privacy with the desire by law enforcement agencies to probe cases that technology has rendered increasingly complex. Even in cases that appear to be legitimate intrusions for the purposes of law enforcement, Stoddart remains cautious. She praises Alberta privacy commissioner Frank Work’s victory in that province’s courts against a bar that challenged restrictions on the scanning of driver’s licences. The club owners argued collecting the information would help prevent violence in bars, but Work ruled the bar didn’t prove that doing so would stop the problem and ordered it to stop. Recently, the courts upheld that conclusion.

It’s on such stances against a so-called “surveillance society” that people like Lawford praise Stoddart’s performance despite concerns over her actions against the private sector. In the end, however, Stoddart herself acknowledges the conflicts inherent in privacy protection. Even she doesn’t follow all the advice privacy advocates put out there. She doesn’t do anything different with her garbage, for example, despite stories about how vulnerable it can be to intruders. And while she worries about financial institutions sending out pre-approved cheques to their customers, she’s not yet ready to heed recommendations to lock her mailbox.