|
 
|
 |
|||||||
|
|||||||
| HOME | The Acts | Regulations | Directory of Records | Directory of Institutions | | |||||||
 OCIPO |
 |
Corporate Operating Policy on Internet Tracking TechnologiesDownload this document: [PDF] [Word] This document was last updated: August 3, 2004 Table of ContentsBACKGROUND
INTERNET TRACKING TECHNOLOGY SCENARIOS
BACKGROUNDPrivacy is a serious concern for Internet users. This operating policy provides ministries and agencies with policy direction on mandatory requirements concerning tracking technologies and the collection of personal information from users of government web sites and web services. "Internet Tracking Technologies" is a broad category that includes new tools that have become available in the online environment, such as 'cookies', that can be used without raising privacy concerns if designed in certain ways, but could also be used to invade people's privacy if designed another way. The same requirements will continue to apply as government increasingly uses portal technology to manage its on-line presence. Building public trust in government Internet sites is critical to increasing the use of government online services and products. PURPOSEThe purpose of this corporate operating policy on internet tracking technologies is to define mandatory requirements, provide operational guidance and define responsibilities concerning tracking technologies on government web sites and web applications. This policy supports the Government's legal obligations to protect privacy under the Freedom of Information and Protection of Privacy Act (FIPPA). APPLICATION AND SCOPEThis operating policy applies to:
This operating policy does not apply to:
PRINCIPLESInformed Consent - Web sites, web services and portals must be designed to enable visitors to find out how the institution plans to use information in tracking technologies, such as permanent cookies, and to choose whether or not to accept the mechanism. Openness - Visitors must be able to know what information about them is being collected and how the information will be used, stored and discarded. Transparency - Passive and/or hidden forms of information collection are prohibited except for authorized law enforcement activities. Accountability - Proposals that include using internet tracking technologies to collect personal information or the aggregation of personal information associated with a tracking technology require due diligence to be done on the business need and legal authorization for that activity. MANDATORY REQUIREMENTSGovernment organizations must require in contracts with third party service providers and their sub-contractors that they operate in accordance with this policy. To ensure consistency between the handling of electronic information and paper equivalents, all information collected electronically will be treated the same as the equivalent information collected and stored by traditional means (eg. in person, facsimile or mail). Web sites, web services and portals that collect personal information must show that they have legal authority for that collection as required by section 38(2) and 39(1) of the Freedom of Information and Protection of Privacy Act (FIPPA). The user must be given the opportunity to decide whether to agree with the service's request to use internet tracking technologies and agree to supply personal information on a per-service basis. New web site, web service or portal: Government organizations proposing to establish a new web site, web service or portal that collects or publishes personal information must conduct a Privacy Impact Assessment to demonstrate compliance with FIPPA and program statutes using MBS PIA Guidelines before launching the site or service. The PIA must be submitted to the program owner for review of the privacy implications prior to launching the site or service. The PIA should, at the discretion of the program owner, be reviewed with the Ontario Information and Privacy Commissioner (IPC) prior to launching the site or service. If the legal authority for the collection of personal information via the web site is not clear, this must be highlighted in the Privacy Impact Assessment to alert senior executives to the need for a course of action that clearly establishes the legality of the proposed collection and manner of collection. Existing web sites: Government organizations that propose substantive changes in the collection, use or disclosure of personal information on an existing web site (such as aggregation of information previously held in separate databases or the creation of common directory services) must complete a Privacy Impact Assessment. The PIA must be submitted to the program owner for review. The PIA should, at the discretion of the program owner, be reviewed with the Ontario Information and Privacy Commissioner. Government organizations must include a privacy link on the main page of the institution to the corporate online Privacy Statement . Ministries and agencies must also include the privacy link on every page where personal information is collected. The corporate Privacy Statement can be found at: www.gov.on.ca/mbs/english/common/privacy.html In addition, they may provide a customised privacy statement. A ministry or program Privacy Statement may complement the corporate Privacy Statement by adopting the corporate policy and listing specific types of data collected by the agency for which exceptions apply. Privacy policies and practices and Notices of Collection must be fully disclosed prior to asking individuals to give their personal information. The Privacy Statement must provide a complete and accurate description of how personal information will be used. As government organizations design web sites, web services and portals, they must ensure that personal information that is collected by programs can be easily retrieved to be able to respond to an individual's request to access his or her personal information as permitted by FIPPA. Electronic transactions via government web sites shall be protected by security safeguards appropriate to the sensitivity of the information involved in the transaction and the risks to both the client and the government. Government web sites, web services and portals must not leave behind personal information on the user's computer, eg. in a cache or cookie, upon termination of a session. Similarly, the site or service must not leave behind information that could be used to triangulate with other information that may be available thus revealing personal information about the user. In web developer terms, this means personal information must not be stored on the client side. Both the client side and server side must be cleaned up when the user leaves. The deployment of internet services typically involves interlocking agreements between the government and software vendors, system providers and/or third party service providers. In such out-sourced arrangements there is a risk that unauthorized access to personal information could occur or the data could be used for secondary (commercial) purposes or be disclosed inappropriately to another party. As noted in the section above on privacy law compliance, government organizations must require in contracts that third party service providers and their sub-contractors operate in accordance with the requirements of this policy. These contracts and agreements shall address at a minimum:
INTERNET TRACKING TECHNOLOGY SCENARIOSWhen an individual visits a web site, information called "traffic data" is automatically exchanged between their computer and the web server to enable the communication to occur, but the traffic data does not in itself identify the individual. Traffic data typically contains:
Identity may become evident, however, if the web site host uses an internet tracking technology to establish a mechanism for gathering information about the user over several sessions, or if the host associates the traffic data to other information in its custody, or if the user provides identifying information for example by filling out a form. In the near future, the information in traffic data may expand to include location data that reveals the latitude, longitude and altitude of the user's terminal equipment, to their direction of travel, and the level of accuracy of the location information. In addition, as the world migrates to the next generation Internet Protocol IPv6, the potential to strongly associate the IP address to an identifiable individual is expected to increase. The European Commission has, in fact, already adopted the position that IP addresses attributed to Internet users are personal data and must be protected1. This section identifies five typical scenarios where individuals may interact with a government web site, web service or portal for different purposes. After a description of the scenario, requirements to prevent unwarranted tracking of individuals are presented. The requirements are not meant to be exclusive to a particular scenario because a given web site may involve one or more features that could be perceived by users to be excessively intrusive. The general requirements noted above also continue to apply in these scenarios. 1. User pull - A web site visitor downloads content off the site and supplies no personal information. There is no program or service delivery need for the government to identify users or track user choices over multiple sessions. Some users may choose to have the web site remember their preferences for subsequent visits to the web site, others may not. Requirements:
2. Program push - The web site owner sends messages to the user via e-mail notice or by other mechanisms after gathering contact information from the individual. Requirements:
3. Transactional activities - Users provide information via the web site or web service to receive a product or service from the government organization. The transaction may or may not involve a fee or payment. Electronic transactions present the greatest risks for tracking of individuals or creating customer profiles because they typically require the creation and use of reference numbers, aggregating Personal Information and transactional data at a portal level, linking transactional data to information in server access logs, and collecting personal information for authentication purposes. Requirements:
4. Forums - A government organization may establish an online open forum for engaging citizens and government officials in discussions on a proposed new policy or to solicit comments. Participants in the forum may be registered or un-registered. Other names for forums include: discussions, chat rooms, messaging windows, bulletin boards and electronic town halls. Requirements:
5. Integrated Services - "Integrated Services" refers to government initiatives that propose to implement one or more electronic service channels for single window access to multiple government programs. The integrated service may require the personal information previously collected for distinct legislative programs to be collected through a single Service Provider on behalf of several ministries. There is a wide range of possible approaches to integrating services for multiple government programs. There is an aspect of tracking and collecting information about individuals in integrated services that could raise privacy concerns, especially if the service provider employs components and mechanisms that aggregate or widen potential uses of personal information, such as: single sign-on, shared directories, data warehousing, data matching and data mining. The MBS Privacy Impact Assessment Guidelines identify the following potential privacy risks from integrated services:
Requirements:
RESPONSIBILITIESDeputy heads are responsible for:
Corporate Chief Information Officer The Corporate Chief Information Officer is responsible for:
Corporate Chief and Cluster Chief Information Officers Corporate Chief and Cluster Chief Information Officers are responsible for:
Assistant Deputy Ministers are responsible for:
Program Managers are responsible for:
Manager, Access and Privacy Office, MBS The Manager is responsible for:
The Management Board of Cabinet is responsible for:
DEFINITIONSAcceptable Use Policy - An Acceptable Use Policy (AUP) sets forth the principles that govern the client's use of the Web-based service provided by the government. The AUP may be designed to, for example, encourage polite and civil communication, encourage respect for others, and/or protect clients from irresponsible, abusive or illegal activities. The AUP identifies the actions that the government considers to be Prohibited Actions, meaning those actions that will lead to denial of access or impediment of service, and enforcement activities. Access Logs - An access log is a list of all the requests for individual files that people have requested from a Web site. These files will include the HTML files and their imbedded graphic images and any other associated files that get transmitted. The access log (sometimes referred to as the "raw data") can be analyzed and summarized by another program. Anonymous Identifier - an identifier that lacks individuality or distinction or recognizability; a unique identifier that cannot be traced back to an identifiable individual. Banner - A banner is either a graphic image that announces the name or identity of a site (and often is spread across the width of the Web page) or is an advertising image. Advertisers sometimes count banner "views", or the number of times a banner graphic image was downloaded over a period of time. Browser (User Agent)- A software program for viewing web pages. Popular browsers include Internet Explorer and Netscape. Cookie (HTTP State Management Mechanism) - A small file containing state information that passes between an origin server and the user agent (browser) and that gets stored by the user agent on the computer. Cookies provide a mechanism that allows users and servers that wish to exchange state information to place HTTP requests and responses within a larger context called a "session". Cookies come in two types: session or permanent. Session cookies only exist temporarily in the user's computer memory and expire upon the termination of the connection with the server. Session cookies might be used to create, for example, a "shopping cart", in which users selections can be aggregated before purchase. Permanent cookies are placed on the user's computer on the hard drive and expire at a time selected by the server manager. Permanent cookies might be used to store the user's preferences for the display of information on the web site that created the cookie. Data Matching - A computerized comparison of 2 or more databases of personal information that were originally collected for different purposes. The computer (data) matching program creates or merges files on identifiable individuals to identify matters of interest. Data matching is facilitated by storing personal information in centralized databases (see Data Warehousing) or by linking unrelated databases. Data Mining - Sorting through data to identify patterns and establish relationships. Data Warehousing - A data warehouse is a central repository for all or significant parts of the data that an enterprise's various business systems collect. Electronic Mail - means any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient and includes messages sent using a short message service. ESD Privacy Standard - The Electronic Service Delivery Privacy Standard (ESD PS) was developed by Ministry of Government Services in consultation with ministries and the Ontario Information and Privacy Commissioner. The Standard provides additional policy and operational direction required to address potential privacy risks which could arise from the bundling of service delivery channels. Adherence to the ESD PS is mandatory for all Ontario Government ministries and agencies which participate in any manner in the design and operation of the government's new service delivery model known as Electronic Service Delivery. Hyperlink - Synonymous with "Hypertext Link". Hypertext is the organization of information units into connected associations that a user can choose to make. An instance of such an association is called a link or hypertext link. Hypertext was the main concept that led to the invention of the World Wide Web, which is, after all, nothing more (or less) than an enormous amount of information content connected by an enormous number of hypertext links. Internet Service Provider - An ISP (Internet service provider) is a company that provides individuals and other companies access to the Internet and other related services such as Web site building and virtual hosting. An ISP has the equipment and the telecommunication line access required to have a point-of-presence on the Internet for the geographic area served. Intranet Site - An intranet is a private network that is contained within an enterprise. It may consist of many interlinked local area networks and also use leased lines in the Wide Area Network. The main purpose of an intranet is to share company information and computing resources among employees. An intranet can also be used to facilitate working in groups and for teleconferences. IP Address - Internet Protocol address. A number that uniquely identifies a computer connected to the Internet. Each packet of information transmitted on the Internet contains information about where it was sent from (source IP address) and the address to which it is to be delivered (destination IP address). Java Script - JavaScript is an interpreted programming or script language from Netscape. It is somewhat similar in capability to Microsoft's Visual Basic, Sun's Tcl, the UNIX-derived Perl, and IBM's Rexx. JavaScript is used in Web site development to do such things as: Automatically change a formatted date on a Web page; Cause a linked-to page to appear in a popup window; Cause text or a graphic image to change during a mouse rollover. Location Data - Location data may refer to the latitude, longitude and altitude of the user's terminal equipment, to the direction of travel, to the level of accuracy of the location information, to the identification of the network cell in which the terminal equipment is located at a certain point in time and to the time the location information was recorded. Notice of Collection - Section 39(2) of FIPPA requires notices to be given to individuals where personal information is collected, eg. on forms, unless notice is waived by the responsible minister. The notice must inform the individual to whom the information relates all of the following: a) the legal authority for the collection; b) the principal purpose or purposes for which the personal information is intended to be used; and c) the title, business address and business telephone number of a public official who can answer the individual's questions about the collection. Portal - A web site featuring a suite of commonly used services, serving as an anchor, starting point, or gateway to a collection of web sites or services. Variations include general portals and niche portals. Privacy Statement - A Privacy Statement (also known as Privacy Policy) is a public document explaining the organization's policies and practices pertaining to the collection, use and disclosure of personal information. Unlike Notices of Collection, Privacy Statements are not legally required to be presented whenever personal information is collected, but it has become an industry best practice. Privacy Statements provide clients with more information than is necessary in the Notice of Collection, such as how the organization uses cookies and how information is protected. Program Identifier - A unique identifier issued by an Ontario government organization, eg. Ontario Health Insurance Plan number, Ontario Education Number. Program Owner - In provincial ministries, an Assistant Deputy Minister (ADM), or in agencies an equivalent ranking senior official, who is responsible for making major decisions on a program. Pseudonymous Identifier - a fictitious name or number that does not obviously relate to an identifiable individual, but the linkage to the personal information of an individual can be made if necessary by an authorized individual. Sensitive Information - medical or financial information, information that may be injurious to the reputation of the individual or the government if it was seen by the wrong individual. Single Sign-On - In any client/server relationship, single sign-on is a session/user authentication process that permits a user to enter one name and password in order to access multiple applications. The single sign-on eliminates future authentication prompts when the user switches applications during that particular session. Single sign-on is also a term used in electronic commerce transactions where consumer financial information is centralised on one server to limit the number of times the consumer needs to enter credit card numbers or other sensitive information used in billing. Substantive Change - having substance, involving matters of major or practical importance to all concerned. In the MBS PIA Guidelines, examples of proposals deemed to be "substantive changes" from existing practices (and hence require a PIA) include proposals that involve significant collection, use or disclosure of personal information, multi-program front-end program integration, broadening of target populations, a significant shift toward indirect collection of personal information, additional system linkages, and proposals that involve enhanced accessibility. Traffic Data - Traffic data (also called "Clickstream Data") means any data processed for the purpose of conveyance of a communication on an electronic communications network. Unique Identifier - A unique identifier is any identifying number, symbol or other particular assigned to the individual. Universal Identifier - An unique identifier that can be used for authentication purposes by multiple entities or to develop profiles on individuals, eg. Social Insurance Numbers. User - "User" means any natural person using a publicly avsailable electronic communications service, for private or business purposes, without necessarily having subscribed to this service. Web site "visitor" is synonymous with user. Web Beacon - A Web beacon, also known as a web bug, is a file object (usually a graphic image such as a transparent GIF) that is placed on a Web page or in an e-mail message to monitor user behaviour or protect copyrighted material, functioning as a kind of "spyware". Unlike a cookie, which can be accepted or declined by the user via their browser settings, a Web beacon arrives as just another GIF on the Web page. A Web beacon is typically made invisible to the user when its colour is matched to the page background it and by making it very small, eg. 1 pixel. Web Bug - see "Web Beacon" Web Domain - On the Internet, a domain consists of a set of network addresses. This domain is organized in levels. The top level identifies geographic or purpose commonality (for example, the nation that the domain covers or a category such as "government"). The second level identifies a unique place within the top level domain and is, in fact, equivalent to a unique address on the Internet (an IP address). Lower levels of domain may also be used. Strictly speaking, in the Internet's domain name system (DNS), a domain is a name with which name server records are associated that describe sub-domains or host. For example, "whatis.com" could be a domain with records for "www.whatis.com" and "www1.whatis.com," and so forth. Web Services - Automated resources accessed via the Internet. Web services are software-powered resources or functional components whose capabilities can be accessed at an internet URL. Standards-based web services use XML to interact with each other, which allows them to link up on demand. Web Site - A Web site is a related collection of World Wide Web (WWW) files that includes a beginning file called a home page. A company or an individual tells you how to get to their Web site by giving you the address of their home page. From the home page, you can get to all the other pages on their site. Endnotes
|
|