Privacy watchdog `frustrated' by out-of-date policies

Canada lags behind allies, report warns

OTTAWA • The federal privacy commissioner says he is “frustrated” that the federal government isn’t better protecting Canadians’ right to privacy while more and more services are going digital because of the COVID-19 pandemic.

In his latest annual report published Thursday, Privacy Commissioner Daniel Therrien came out swinging against Canada’s privacy laws, which he considers to be significantly obsolete.

“The law is simply not up to protecting our rights in a digital environment. Risks to privacy and other rights are heightened by the fact that the pandemic is fuelling rapid societal and economic transformation in a context where our laws fail to provide Canadians with effective protection,” his 20192020 annual report reads.

During a news conference Thursday, Therrien said that ultimately, Canadians are the ones losing out if their private data isn’t well protected by the government in the new digital era.

“I’m frustrated for Canadian citizens,” the commissioner said. “I’m also concerned that the conditions for a strong foundation for digital economies in Canada are not there at this point.”

Though he has long argued for changes to federal privacy laws, Therrien says the pandemic has further highlighted the numerous blind spots in current privacy legislation.

A few examples he cited were the lack of privacy protection when a government partners with a private entity to deliver a service, or the fact that Privacy by Design is not a default consideration when the government orders new software or apps.

Even hypersensitive private information exchanged through services that are increasingly delivered online may not be as well protected as Canadians think.

“Telemedicine creates risks to doctor-patient confidentiality when virtual platforms involve commercial enterprises. E-learning platforms can capture sensitive information about students’ learning disabilities and other behavioural issues,” Therrien warns in his report.

The commissioner also seemed thoroughly unimpressed by recent declarations by the Trudeau government about privacy protection, particularly during the design of the contact-tracing app COVID Alert.

“During our discussions about COVID alerts, government officials made the remarkable statement that current federal privacy laws do not apply to this app. This assertion certainly gives one pause. An extremely privacy-sensitive initiative is defended by the Government of Canada as not subject to its privacy laws,” Therrien noted.

“Privacy is considered by the government as a good practice, but not a legal requirement. How long can this go on?” he continued, before adding that the government ultimately settled on a COVID Alert concept that satisfies his office’s privacy concerns.

He also confirmed that he has downloaded the app, and encouraged Canadians to do the same.

“The measures put in place to protect private data are very good, and I do not think there are any major privacy risks,” Therrien said.

Canada’s legal lag in protecting its citizens’ private information is particularly stark when compared to most of the country’s allies.

According to a comparison done by the Office of the Privacy Commissioner over the last year, Canada lags behind a host of countries when it comes to reforming privacy laws, including all the European Union, the United Kingdom, Australia, and even developing countries such as Brazil and Argentina.

Contrary to all those other countries, Canada does not define privacy as a human right, nor does it give its privacy commissioner order-making powers or the ability to administrate monetary penalties to organizations breaking privacy laws.

“It is more than time for Canada to catch up to other countries and, significantly, to follow the lead of provincial governments. All Canadians deserve strong privacy protections,” he said.

Therrien also told reporters that most excuses he hears from the government for not strengthening privacy laws are fig leaves.

“The most apparent reason for the government to take its time in acting appears to be a concern that privacy legislation might impede innovation and economic growth, Therrien said.

“My point is that it is exactly the reverse. The status quo is that 90 per cent of Canadians are concerned that their privacy is not protected. This is not conducive to trust.”

Last year, Therrien said that his office accepted 761 complaints under the Privacy Act, 82 per cent of which his office deemed well-founded.

The annual report also says it received 341 breach reports from 34 federal government institutions, over twice the amount reported the year before (155).

Despite the increase in reporting, Therrien’s office says it is very concerned that a vast majority of privacy breaches in the federal government still go unreported, considering that barely 14 per cent of the roughly 250 organizations that are subject to the Privacy Act reported an issue last year.

The report singled out the Canada Border Security Agency, the Department of National Defence, Global Affairs Canada and Veterans Affairs Canada, which hold significant volumes of personal data but reported few or no breaches last year.

“We continue to believe that the number of privacy breaches reported to our office represents only the tip of the iceberg. Action is needed to address systemic under-reporting,” the report warns.

CANADIANS DESERVE STRONG PRIVACY PROTECTIONS.