It’s time privacy laws advance with technology

Sen. Raymonde Saint-germain and Sen. Art Eggleton say Canada should take human rights approach to issue.

Canadians are concerned about the protection of their private data — so found a 2016 Survey of Canadians on Privacy undertaken by the Privacy Commissioner of Canada.

Canadians are right to be concerned. The recent Facebook and Cambridge Analytica scandal revealed the shocking use of personal data gleaned from millions of Facebook users and sold to a third-party for the purpose of swaying international government elections.

At a recent open caucus meeting of the Senate, data experts came together to discuss the imperative of enhancing the statutory protections of private data in Canada. What was clear is that current government policies and legislation are not keeping up with advancements in technology.

It’s time we did more. Canada’s federal privacy laws operate on a complaint-only basis with a general framework for consent unlike the European Union (EU), which has strict, proactive privacy regulations safeguarded by the General Data Protection Regulation (GDPR).

As Dr. Valerie Steeves of the University of Ottawa told the open caucus, the EU’S GDPR is informed by a commitment to privacy as a “human right” and is not just a collection of legal restrictions. PIPEDA, Canada’s Personal Information Protection and Electronic Documents Act, by contrast, emphasizes “consent” — but, she argues, “consent should be the floor, not the ceiling.”

Canada needs to model itself on the human rights approach to privacy that the EU has adopted. Our broad consent laws enable our personal data to be used in myriad second and tertiary ways without our knowledge or permission.

“Once we move into a big data environment, consent becomes a weak tool,” Steeves stressed. We also need “algorithmic transparency” as big data companies use data in ways we may not have even conceived of yet.

Daniel Therrien, the privacy commissioner of Canada, emphasized that “Canadian trust is at risk” — and not just consumer trust, but trust in our democratic processes. He pointed out that his office currently lacks powers to enforce compliance with existing privacy laws — and that privacy issues are not unique to Facebook: “Self-regulation has shown its limits.”

The recently tabled Parliamentary report, Towards Privacy By Design, which reviewed PIPEDA, recommends significantly increased enforcement powers for the privacy commissioner, specifically, broader audit powers, discretion for which complaints to pursue and the ability to make orders and impose fines for those who are not compliant with privacy legislation.

“We need to give the law some teeth,” as Dr. Avin Levin of Ryerson University put it.

Levin emphasized that the protection of Canadians’ private data is “a question of law and political will.” It’s in our power to do something about it, but we can’t continue to sit on our hands. He recommended that companies like Facebook should be liable for harm caused by content posted on their platforms.

“Those waiting for the free market to regulate the internet and social media companies will probably be waiting forever.”

One area received wide consensus. It’s time political parties are included in our privacy legislation.

Political parties are currently exempt from PIPEDA — free to collect, store and use private data and can micro-target voters and follow their own code of conduct without oversight.

That’s not good enough.

Bill C-76 was introduced recently to tighten rules around elections, but it does not address privacy issues or consent for the collection, use and storage of voter information. That needs to change. In the short-term, Bill C-76 could be amended to bring federal political parties under PIPEDA. The government should also consider implementing several of the important recommendations out of the all-party committee report, including giving the privacy commissioner powers of enforcement.

In the longer term, Canada should look to the European Union as a model for more comprehensive and proactive powers to safeguard Canadians’ data privacy.

Sen. Raymonde Saint-germain is deputy facilitator of the Independent Senators Group. She was appointed to the Senate in 2016, after two terms as the Quebec ombudsman and a career in the public administration.

Sen. Art Eggleton is a member of the Canadian Senate from Toronto. He serves as chair of the Standing Committee on Social Affairs, Science and Technology.