The possible implications of the problem are explored by University of Ottawa law professor Michael Geist in the article that appears below. This article is reproduced with the kind permission of Professor Geist who retains copyright in the article.

Geist: U.S. Patriot Act's long reach
Feb. 20, 2006. 07:47 AM
MICHAEL GEIST


While law schools may differ, thousands of law students (and prospective students) share one common experience  the Law School Aptitude Test. The LSAT is a standardized test used by most North American law schools in their admission process to evaluate candidates' likelihood of law school success.

While the predictive reliability of the test has been the subject of controversy, in recent days the LSAT has attracted attention for a different reason. As students file into testing centres in the U.S., Canada, Europe, Asia, and Africa, they are required to provide a thumbprint, used to crack down on fraudulent test-takers.

The biometric data is transferred to the United States and retained by the Law School Admissions Council, the organization that administers the test.

Test takers in B.C. and Alberta have raised objections to the mandatory thumb-printing, expressing concern sensitive personal information could find its way into the hands of U.S. law enforcement. Empowered by provisions in the U.S. Patriot Act, authorities could compel the LSAC to surrender the data.

Patriot Act fears stem from the secretive nature of the law since authorities can compel disclosures with minimal oversight and without opportunity for the affected person to challenge the disclosure.

Critics also point to the statute's potential misuse. Those fears were exacerbated last week with reports U.S. counter-terrorism databases contain an astonishing 325,000 names.

There has been swift reaction to the thumb-printing story, with the federal, B.C., and Alberta privacy commissioners joining forces in a combined privacy investigation. The Canadian Council of Law Deans, which represents law schools across the country, has expressed concern over the practice, acknowledging that the data could be subject to a Patriot Act request. The Council raised questions about whether the practice might violate federal and provincial privacy statutes.

For its part, the LSAC has agreed to co-operate with the privacy investigations, though it appeared surprised at the controversy. It notes that it has collected thumbprints for 31 years, only retains the data for five years, and that the practice has not generated many objections in the past.

In seeking to assuage fears over the Patriot Act issue, the LSAC reports that it has never disclosed thumbprint information in response to a subpoena. While that may reassure some concerned students, the truth is that the law prohibits the LSAC from notifying any person that has had their personal information disclosed. In other words, the LSAC is blocked from disclosing any disclosures they may have made.

Not only are the assurances subject to some doubt, the issue itself points to concerns that extend far beyond just the LSAT.

First, the LSAT is not the only widely administered standardized test that collects biometric information such as thumbprints. The GMAT and MCAT, used for business and medical school admissions collect thumbprints (the GRE, a graduate school test, snaps a digital photograph of the test-taker instead). Together, more than 400,000 students worldwide take the LSAT, GMAT, and MCAT each year.

Second, while the standardized tests have garnered the lion's share of attention, the schools have been reticent to admit that full student records  including admission information, grades, papers, and other evaluations  could conceivably also be made subject to a U.S. Patriot Act request.

The U.S. courts have been willing to extend the reach of national law beyond their borders provided the foreign entity maintains sufficient connections such that it meets a "personal jurisdiction" test.

In the case of Canadian universities, the combination of exchange study programs, fundraising initiatives, and student recruitment drives could meet the jurisdiction test. For Canadian students, this suggests that their data is already at risk  long after the LSAT, GMAT or MCAT has been forgotten.

In the bigger picture even more personal information could be the target of a Patriot Act request. Financial information, much of which is already transferred to the United States for processing, may be caught, as is health data, such as prescription records, that are held by companies with U.S. connections.

The federal privacy commissioner considered this issue last year as part of an investigation into complaints against a major bank's practice of transferring customer data to the United States. The commissioner concluded the bank had complied with Canadian privacy laws, while conceding the current statute is ill-equipped to deal with this emerging concern.

In order to address the issue, Canada would need to establish a "blocking statute" which creates a specific legal obligation that prevents an organization from complying with both U.S. and foreign law. For example, Canada attempted to enact a blocking statute in response to the U.S. Helms-Burton law that established restrictions on trade with Cuba.

The concern over the LSAT may ultimately result in reforms to the test-taking procedures. In the meantime, prospective Canadian law students are experiencing their first real law lesson months before setting foot in the classroom.

Michael Geist holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law. He can reached at mgeist@uottawa.ca
or online at

http://www.michaelgeist.ca