Universities keep private info from Patriot Act
HALIFAX - A controversial U.S. law designed to fight terrorism has reached into the halls of Canadian academia, with universities finding ways to keep electronic data about their students out of American hands.
Some provinces have passed legislation designed to protect private information from sweeping powers outlined in the U.S. Patriot Act, which compels American companies to turn over virtually any information that the U.S. government requests.
Universities have had to spend money switching to computer servers strictly on Canadian soil, and have changed their relationships with online tools that detect plagiarism or help with research. They have also prevented professors from carrying laptops containing student information across the border.
"What it's done is added an additional layer of bureaucracy for us," says Charles Crosbie, a spokesman with Dalhousie University in Halifax.
"And people aren't happy with that, obviously, but it's something that we're obliged to do."
The U.S. Congress approved the Patriot Act shortly after the terrorist attacks on Sept. 11, 2001. It gives the government wide-reaching powers to investigate terrorism, often with little judicial oversight.
The Nova Scotia legislature passed a law aimed at shielding information from the Patriot Act late last year. Under the provincial law, public bodies are largely prevented from storing any private electronic information in the United States. If they run afoul of the law, institutions can face fines of up to $500,000.
Dalhousie University - which lobbied against the legislation, arguing restrictions could adversely affect cross-border research - has had to renegotiate contracts for some of its computing services and in some cases switch providers altogether.
For example, the university used a New York-based service that creates virtual classrooms for distance learning. The servers that run the software had to be moved to Canada, which cost the university more than $15,000, said Phil O'Hara, who works in the university's IT department.
And if professors have any information about students on their computers, such as names or university ID numbers, they can't bring them across the border unless it's absolutely necessary for their work, said Crosbie.
British Columbia revised its privacy legislation to deal with the Patriot Act in 2004, placing restrictions on the ability of public organizations to contract computing work to companies outside Canada. The law also imposes restrictions on travelling with computers containing personal data.
Both Nova Scotia and B.C. have exemptions to allow data required for research to be shared with schools in other countries, including the United States.
Ian Forsyth, the privacy co-ordinator for Simon Fraser University in Burnaby, B.C., said aside from a restriction on where data can be stored, there have also been headaches when U.S.-based software companies need to provide remote support for their programs.
The province revised the legislation after the initial law appeared to ban the practice outright. The university has since had to establish extensive security protocols before remote support occurs, and carefully monitor such access.
Alberta's laws are far less restrictive. The government updated its privacy laws last year to expressively forbid companies operating in the province from disclosing information to foreign courts. The changes were made amid concerns that U.S. companies could be compelled to turn over data even if servers were located in Alberta.
When it comes to data storage, a provincial commission recommended public bodies use Canadian servers whenever possible, but it's still up to their discretion.
"In Alberta, we tend to take a more pragmatic approach all around," said Jo-Ann Munn Gafuik, the University of Calgary's privacy co-ordinator. "Instead, they said think carefully before you make those decisions."
Libraries at a number of universities across Canada - even in provinces that don't have legislation dealing with Patriot Act issues - have also made changes to how they store information due to similar concerns.
Many schools use a piece of software called RefWorks, which helps students keep track of research materials and quickly create citations, but the service was operated out of the United States.
Dozens of schools worked together last year to set up servers in Canada to run RefWorks.
Another popular software for universities that is making changes because of the new laws is Turnitin.com, an online anti-plagiarism program that compares students' papers with various sources.
Turnitin.com founder John Barrie said the American company plans to set up Canadian servers by the end of the month to allay concerns about where the data is stored.
He said it hasn't appeared to be a major concern for schools that already use the service, but he said some universities may have put off signing up because they are worried about breaking provincial laws.
"Even though our sales in Canada have been stellar, we do believe that the presence of the Patriot Act has held up some business," he said from the company's California offices, adding that the move will likely result in higher fees.
"The only net effect of that, I believe, is to increase the cost of our service to Canadian users."