Privacy expert resigns from smart city project
Cavoukian cites concern over Sidewalk Labs policy on personal data
One of the world’s leading privacy experts has stepped down from her advisory role with Sidewalk Labs, Google’s sister company, which is preparing to build a data-driven neighbourhood at the foot of Parliament St.
It’s a development one tech expert characterized as “a major blow to the legitimacy of the project.”
Ann Cavoukian, former information and privacy commissioner of Ontario, tendered her resignation letter on Friday, writing that the proposed protection of personal data “is not acceptable.”
Cavoukian believes the plan for the Quayside smart-city development does not adequately protect individual privacy, and data collected from sensors, surveillance cameras and smartphones must be de-identified at source.
“Just think of the consequences: If personally identifiable data are not de-identified at source, we will be creating another central database of personal information (controlled by whom?), that may be used without data subjects’ consent, that will be exposed to the risks of hacking and unauthorized access,” she wrote in her letter to Sidewalk Labs.
“As we all know, existing methods of encryption are not infallible and may be broken, potentially exposing the personal data of Waterfront Toronto residents! Why take such risks?”
The planned collaboration between Sidewalk Labs and Waterfront Toronto imagines a city of the future on 12 acres of the eastern waterfront at Parliament and Queens Quay.
The project would be so datarich that it has been fraught with concern about what would happen to that collected information. Three advisers have previously stepped back from the project citing privacy concerns.
Cavoukian’s resignation came less than a week after Sidewalk Labs published its digital governance proposals, a 41-page document that sought to put people’s privacy fears to rest by detailing how data collected in Quayside would be managed by an independent civic data trust, and not owned or controlled by Google.
While Sidewalk Labs said it would de-identify data, it couldn’t guarantee what third parties would do.
The proposals were given to Quayside’s digital advisory panel three days before it met to approve them on Thursday, leading several members to call for a delay to allow more time to consider privacy before moving forward with the project.
It was only at the meeting that Cavoukian realized “de-identification at source” was not a guarantee. “When Sidewalk Labs was making their presentation, they said they were creating this new civic data trust which will consist of a number of players — Sidewalk, Quayside, Waterfront Toronto and others — and that Sidewalk Labs would encourage them to de-identify the data involved that was collected but it would be up to the group to decide,” she told The Star Saturday. “That’s where I just said no.” Cavoukian said she hopes her resignation will “ignite a discussion” on how to proceed with the Quayside smart city while protecting data and says she remains optimistic that de-identification at the source will be put in place.
David Fraser, a privacy lawyer advising Sidewalk Labs, was surprised Cavoukian’s resignation came when it did.
“Her resignation seems to me a little premature because she would be very influential with (the civic data trust) once it’s established,” he said.
Fraser said the proposal to establish a civic data trust is “revolutionary.”
“This is about giving control to the body,” he said. “(Sidewalk Labs) didn’t parachute in and say, ‘This is what we’re going to do.’ They parachuted in and said, ‘What are we going to do?’
“Nobody has yet dictated how that data trust makes its decisions. It’s going to decide itself.”
Still, there are those who see the Cavoukian resignation as a significant setback to the project.
“Sidewalk Labs is at the centre of a debate about data and data protection. The resignation of Cavoukian is clear evidence that we don’t have proper regulatory infrastructure to deal with these new smart city initiatives,” said Fenwick McKelvey, an associate professor in communication Studies at Concordia University who studies internet policies and governance.
“Her resignation, especially because she was participating in good faith, is a major blow to the legitimacy of the project.”
Chantal Bernier, legal adviser to Waterfront Toronto, said the project is sparing no effort to identify and address privacy issues.
“We are still identifying every privacy risk to which we will apply every privacy protection available to us,” Bernier said in an email.
In a written statement, Sidewalk Labs spokesperson Dan Levitan said: “Sidewalk Labs has committed to implement, as a company, the principles of Privacy by Design. Though that question is settled, the question of whether other companies involved in the Quayside project would be required to do so is unlikely to be worked out soon, and may be out of Sidewalk Labs’ hands.”