Government must update legislation in a way that addresses today’s technology and prepares for future changes. And political parties can’t be exempt
By Sen. Art Eggleton
and Sen. Raymonde Saint-Germain
Canadians are concerned about the protection of their private data, according to a 2016 Survey of Canadians on Privacyundertaken by the privacy commissioner of Canada. A reported 90 percent of Canadians expressed some level of concern about data privacy and 74 percent of Canadians felt they have less protection of their personal information now than they did just a decade ago.
Canadians are right to be concerned.
The recent Facebook and Cambridge Analytica scandal revealed the shocking use of personal data gleaned from millions of Facebook users and sold to a third party for the purpose of swaying international government elections. The Canadian whistleblower at the heart of the scandal, Christopher Wylie, referred to the incident as the “canary in the coal mine” in his recent appearance in front of a House of Commons committee: “Cambridge Analytica is the beginning, not the end.”
At a recent open caucus meeting of the Senate, data experts came together to discuss the imperative of enhancing the statutory protections of private data in Canada. What was clear is that government policies and legislation aren’t keeping up with advancements in technology.
It’s time we did more.
Canada’s federal privacy laws operate on a complaint-only basis with a general framework for consent unlike the European Union (EU), which has strict, proactive privacy regulations safeguarded by the General Data Protection Regulation(GDPR).
As Dr. Valerie Steeves of the University of Ottawa told the open caucus, the EU’s GDPR is informed by a commitment to privacy as a “human right” and is not just a collection of legal restrictions. PIPEDA, Canada’s Personal Information Protection and Electronic Documents Act, by contrast, emphasizes “consent” – but, she argues, “consent should be the floor, not the ceiling” when safeguarding Canadians’ privacy.
Canada needs to model itself on the human rights approach to privacy that the EU has adopted.
Our broad consent laws enable our personal data to be used in a myriad of second and tertiary ways without our knowledge or permission. “Once we move into a big data environment, consent becomes a weak tool,” Steeves stressed. We also need “algorithmic transparency” as big data companies use information in ways we may not have even conceived of yet.
Daniel Therrien, the privacy commissioner of Canada, emphasized that “Canadian trust is at risk” – and not just consumer trust but trust in our democratic processes. He pointed out that his office lacks powers to enforce compliance with existing privacy laws – and that privacy issues are not unique to Facebook: “Self-regulation has shown its limits.”
An all-party parliamentary committee agrees.
The recently tabled parliamentary report Towards Privacy By Design reviewed PIPEDA. It recommends significantly increased enforcement powers for the privacy commissioner, specifically broader audit powers, discretion about which complaints to pursue, and the ability to make orders and impose fines for those who do not comply with privacy legislation.
We fully agree. “We need to give the law some teeth,” as Dr. Avin Levin of Ryerson University put it.
Levin emphasized that the protection of Canadians’ private data is “a question of law and political will.” It’s in our power to do something about it but we can’t continue to sit on our hands.
He recommended that companies like Facebook should be liable for harm caused by content posted on their platforms. “Those waiting for the free market to regulate the Internet and social media companies will probably be waiting forever,” Levin said.
Adam Kardash, partner with the legal firm Osler, Hoskin and Harcourt LLP, cautioned against unduly stifling innovation in business. In responding to the idea for “opt-in consent,” he cautioned that for legitimate business activities that use data analytics, opt-in consent would often be “wholly impractical, if not impossible to implement.”
One area received wide consensus: It’s time that political parties are included in our privacy legislation.
Political parties are exempt from PIPEDA. They are free to collect, store and use private data, including political viewpoints, and can micro-target voters and follow their own code of conduct without oversight.
That’s not good enough.
Bill C-76 was introduced recently to tighten rules around elections, including measures for campaign spending and foreign advertising. But it does not address privacy issues or consent for the collection, use, and storage of personal voter information.
That needs to change. In the short-term, Bill C-76 could be amended to bring federal political parties under PIPEDA.
The government should also consider implementing several of the important recommendations out of the all-party committee report, including giving the privacy commissioner powers of enforcement.
In the longer term, Canada should look to the European Union as a model for more comprehensive and proactive powers to safeguard Canadians’ data privacy.
The technology demands that we catch up. And as Sen. Serge Joyal put it, “We must also make sure the legislation is not outdated the moment it is adopted.”
Sen.Art Eggleton is a member of the Canadian Senate from Toronto. He serves as chair of the Standing Committee on Social Affairs, Science and Technology. Sen. Saint-Germain is deputy facilitator of the Independent Senators Group. She was appointed to the Senate in 2016, after two terms as the Québec ombudsman and a distinguished career in the public administration.
© Troy Media
The views, opinions, and positions expressed by all columnists and contributors are the author’s alone. They do not inherently or expressly reflect the views, opinions and/or positions of NetNewsLedger.
