PRIVACY INNOVATION IN CANADIAN LAW, TECHNOLOGY, AND CORPORATE CULTURE

I invite you and other privacy leaders to join me in co-authoring a privacy-affirmative position paper, the Privacy Accord. This statement will propose new relationships between government, technology entrepreneurs, and corporate and business leaders to strengthen and enhance privacy in Canada and around the world.

WHY THIS PRIVACY ACCORD IS NEEDED

Privacy under Attack

Government and healthcare agencies, financial institutions, and corporations store massive amounts of personal data. Yet 90% of Canadians are concerned about their privacy: 73% feel they have less protection of their personal information than 10 years ago, and 56% are not confident that they have enough information to know how new technologies affect their privacy (Office of the Privacy Commissioner of Canada, 2014). Rapid changes in technology and communications are altering the ways we interact, and much of our private information is slipping out of our hands. In social media forums, we can instantly share personal details with a public of our own choosing. Such sharing is part of the developing cultural norm. What is less easy to control is what happens to the data tracked from our Internet use. As more and more of our interactions and transactions take place online, more and more of our personal information is finding its way onto the Internet.

Major Internet corporations such as Google and Facebook track consumers’ activities online, creating identity profiles of consumer preferences in every area of life, by analyzing browsing history, consumption patterns, status updates, and email content. As this data is shared amongst corporations, and with government security agencies, personal privacy faces an unprecedented challenge. There is little real transparency: consumers routinely agree to terms and conditions so lengthy that it isn’t practical to read them. Few citizens are aware of the level of data sharing that takes place between major corporations, and with federal agencies.  As larger and larger volumes of data are collected and aggregated by big data initiatives, it is becoming more difficult to define precisely what is considered personal information.

The advent of the Internet of Things adds another dimension of complexity to the sharing of personal information. In this new paradigm, informed consent is more important than ever. Yet legislation lags behind technological innovation, and organizational culture is still reorienting itself to respond to these new privacy challenges.

In this rapidly-changing technological environment, it is crucial for privacy leaders to find innovative new ways to bolster privacy, and to communicate these recommendations clearly to government, corporations, and the general public.

THE ECONOMIC POTENTIAL OF PRIVACY PROTECTION

Privacy is a relatively untapped resource in Canada. Working with government and the private sector, privacy leaders can help raise the profile of privacy protection by spelling out its economic potential. Privacy-focused strategic alliances between government, major corporations, and innovation agencies can offer significant benefits to their various stakeholders. Privacy commissioners and data protection authorities could play a pivotal role in inviting these stakeholders to the table.

Who Benefits?

When government agencies (federal, provincial, and municipal) and corporations invest in startups working on privacy innovation:

• They are contributing to economic growth: New companies, new jobs, new Canadian innovation.
• Corporations are investing in their own economic future: As well as ensuring they are fully compliant with privacy legislation, the innovations that corporations adopt will give them a competitive edge in a challenging market.
• Individuals’ personal information is better protected: All Canadians benefit from a climate in which issues of privacy and informed consent are given priority.

DATA PROTECTION LEGISLATION

Prioritizing Privacy: The EU Approach

Current data protection laws in Canada, like those in the US, are vertical (sector-specific). By contrast, the European Union and many of its constituent states follow a horizontal model. This allows for a more mature, integrated approach to the protection of personal information. With more data sharing across organizational boundaries, sector-specific laws are becoming increasingly difficult to apply, and many initiatives now require extensive consultation to establish relevant privacy obligations. Data sharing across jurisdictions raises further complications; in Canada, some provinces have similar privacy laws, both in the realms of commerce and healthcare, but others have very divergent legislation. The EU has irreversibly committed itself to data protection reform, and this pending legislation offers much that Canada could consider emulating.

Some ideas and practices Canada should consider adopting from the EU:

• A horizontal legal approach: allowing for streamlined provision and enforcement of data protection.
• Mutual responsibility for privacy of shared data: in which both the primary service provider who first collected the data and third parties with whom that data is shared are held responsible for enforcing privacy provisions. A shared responsibility model reflects greater privacy maturity by shifting from an exclusive focus on adequate policy and agreements to ensuring effective implementation through monitoring and governance of all data holders.
• National regulation of multinational corporate activity: The EU approach to data sharing across jurisdictions is based on territories, which means that foreign companies must comply with the laws of the countries in which their customers reside. The pending legislation will give national regulators the power to assess the legal compliance of multinational companies’ codes of conduct. Codes of conduct must contain satisfactory privacy principles and effective implementation tools, and demonstrate that they are binding. By contrast, Canadian citizens have little recourse to protect the privacy of their personal information held by American multinational companies (which include most cloud computing service providers), since under the US Patriot Act all information collected by American companies is subject to US government surveillance.
• Validating compliance: While current Canadian law requires privacy impact assessments for all initiatives handling personal information, the content of these assessments is defined only in terms of compliance with general principles. The pending EU legislation, on the other hand, defines very specific criteria for privacy impact assessments. Similarly, while North American laws require only that organizations create risk mitigation plans, the EU Regulation makes corporate rules and policies binding, and through auditing and monitoring holds organizations accountable for their publicly and internally published policies.
• Data breaches: In line with a greater focus on privacy risk management and enforcement, the new EU Regulation will require that companies (inside or outside Europe) holding information pertaining to EU citizens should notify citizens in the case of data breaches. The pending Regulation requires that companies notify regulators of breaches within 24 hours, and affected individuals within 72 hours, particularly if the breach increases the risk of identity theft, humiliation, or damage to reputation. North American laws only mandate notifying local regulators of breaches at the company’s earliest convenience, which in practice means within two or three months, and notifying individuals within a similar time frame if there is a risk of harm to individuals as a result of the breach.

Under the new EU legislation, fines for large data breaches will be a proportion (currently 2%) of the company’s gross revenue. Most North American laws define a set amount for fines, averaging a few hundred thousand dollars, which is insignificant for large companies. For companies to take privacy seriously, fines for violations must be set as a proportion of revenue.

• Crowd consent: As in the US, citizens in Canada can only launch complaints through the provincial or federal privacy commissioner. This makes it much more difficult to launch class action suits and otherwise advocate for privacy as a citizen collective. The new EU Regulation will allow individual citizens to exercise their right to protect their personal data, including the right to be removed from databases and the right to transfer their data elsewhere. Citizens can appeal individually or through any agency, organization, or association that works to protect their rights and interests. While North American laws do not offer any specific recourse, the pending EU Regulation guarantees the right to compensation for damages in the case of a privacy breach involving a single or multiple data custodians.

Since the EU Court of Justice struck down the former EU/US “Safe Harbor” agreement, Canadian companies with transnational business interests wishing to avoid legal complexities would be well advised to bring their privacy policies in line with EU standards.

Personal Content Privacy

Personality rights are an evolving field in Canadian jurisprudence. The provinces of British Columbia, Manitoba, Newfoundland and Labrador, and Saskatchewan have enacted privacy legislation dealing with personality rights, and Canadian common law also recognizes a limited right to personality. Such rights can also be found in the Civil Code of Quebec. Recent technologies create new possibilities of recording audio and video – strengthening and expanding such legislation will help keep privacy protection in step with these technological advances.

TECHNOLOGICAL INNOVATION

While recent technological advances have often undermined personal privacy, emerging technologies can strengthen and protect an individual’s activity online. Investing in privacy-bolstering technologies is a smart business move. The erosion of online privacy is of significant concern to the public: for example, 90% of polled US citizens say that having control over what information is collected about them is important (Pew Research Center, 2015). The further development of privacy-bolstering technologies would thus be responding to the concerns of a significant majority of Internet users, who desire greater control over their personal data.

Here are just some of the ways in which future technological development could support information privacy:

Investing in Data Liberation Technologies

Such technologies allow users access to data while masking or erasing the identity of the data source, utilizing de-identification techniques such as tokenization or anonymization. Optimally used with automated risk analysis tools, de-identification allows both ongoing utilization of data and protection of individual privacy.

Investing in Personal Content Privacy

Most current privacy technologies focus on the protection of text records. Given the proliferation of recording technologies (such as smartphone cameras, Google Glass, or drones) future privacy-bolstering technologies will need to adapt to different kinds of content, and an individual’s rights therein. For example:

• Video privacy: Does an individual consent to be photographed or filmed? If not, privacy-bolstering technology could allow the image to be masked or erased.
• Audio privacy: Does an individual consent to be recorded? If not, privacy-bolstering technology could allow the relevant part of the recording to be masked or erased.

And, more generally:

• Personal control: Privacy-bolstering technology could allow an individual to manage, maintain, track, and destroy documents, images, audio, or content in general even after it is released through email or posted on the Internet.

Investing in Defensive Online Security

Programs that block tracking software tend to be accessed by the technologically savvy rather than the average computer user. Such technologies need to become more visible, and easy to use, perhaps bundled with other defensive tools such as anti-virus programs.

Investing in Crowd Consent

Big data offers many opportunities for market research and social analysis, but these can raise privacy concerns. For example, if a statistic shows a particular demographic to be more susceptible to a given disease, or have a higher crime rate, that information could be used by insurance companies to penalize a consumer. Limited protections are in place in healthcare – researchers must have their statistics cleared by the Research Ethics Board before publishing – but as yet no technologies have been developed to allow individual consent.

CORPORATE INVESTMENT: THE PRIVACY ADVANTAGE

Within corporate culture, data protection is often seen negatively, as another unfortunate overhead. Protection of private information is understood as a threat to profit, draining resources to avoid the risk of a security breach and the attendant liabilities. Yet privacy-bolstering technology is also a business opportunity. Far from being a liability, privacy can be a powerful opportunity for companies to differentiate themselves as leaders in corporate responsibility and service to the public.

Meeting a Clearly-expressed Social Need

As citizens and as consumers, individuals consistently express concern over their lack of control and consent when it comes to privacy. Just one example: according to a 2014 poll by Microsoft, as many as 83% of Americans agree with the US Supreme Court decision that police should get a warrant before searching an individual’s cellphone.

Gaining a Competitive Advantage

Corporations and businesses choosing to develop protocols that protect rather than undermine privacy will differentiate themselves from their competitors. Consumers are often faced with a choice between very similar products and services. Adopting a pro-active privacy strategy positions a business to appeal to the many consumers for whom data protection is an issue.

Transparency

Negative publicity related to privacy issues can be highly damaging to companies, while positive communications on privacy matters can greatly enhance a company’s reputation. Companies that are open about how they gather, manage, and use personal information are better able to offer a sense of security and trust to customers and partners. By integrating effective privacy practices across their enterprise, providing information that addresses people’s concerns about privacy, and engaging the public and government in discussing privacy issues, companies can become known as leaders committed to protecting individual privacy.

Streamlining Efficiency

Investment in de-identification technologies, automated risk analysis tools, and other techniques of data protection will help smooth the interface between data users and individuals. With proper safeguards in place, market researchers can access the data they require without compromising individual privacy. More focused research means more accurate prediction of consumer preferences, and thus more effective marketing strategies.

Privacy as a Customer Service

As yet, few major companies are pro-active about privacy. Many put minimal protections in place and then suffer the consequences when a data breach occurs As the hack of Target’s Canadian operations demonstrated, as well as any legal penalties, these consequences include a massive loss of customer goodwill, and the attendant loss of revenue. Even major corporations whose data has remained secure rarely invest in privacy innovation, or engage with privacy as a customer service.

NEXT STEPS

Privacy as we know it is at a crossroads. Can data protection flourish in this brave new world of technological change, or will it decay? Economic, legal, technical, and corporate innovation will all be crucial in helping to direct the future of data protection in Canada. That is why I am asking you to co-author the Privacy Accord.

I am actively seeking your participation. As a data protection authority, your experience, insight, and expertise will bring great value to this project. Once the Privacy Accord has been finalised, we will promote it to private industry. Members of the investment community have already expressed interest in participating. Then, we will approach federal, provincial, and municipal regulators across the country.

I do hope you will join me in this exciting new venture to promote privacy and informed consent in Canada. Please let me know:

• Whether you would be interested in co-authoring the Privacy Accord
• Whether your communications staff could help with preparing and promoting the Accord
• Whether you would like further information before making a decision

I am looking forward to hear from you.