Canadians are concerned about the protection of their private data, according to a 2016 Survey of Canadians on Privacy undertaken by the privacy commissioner of Canada. A reported 90 per cent of Canadians expressed some level of concern about data privacy and 74 per cent of Canadians felt they have less protection of their personal information now than they did just a decade ago.
Canadians are right to be concerned.
The recent Facebook and Cambridge Analytica scandal revealed the shocking use of personal data gleaned from millions of Facebook users and sold to a third party for the purpose of swaying international government elections. The Canadian whistleblower at the heart of the scandal, Christopher Wylie, referred to the incident as the “canary in the coal mine” in his recent appearance in front of a House of Commons committee: “Cambridge Analytica is the beginning, not the end.”
At a recent open caucus meeting of the Senate, data experts came together to discuss the imperative of enhancing the statutory protections of private data in Canada. What was clear is that government policies and legislation aren’t keeping up with advancements in technology.
It’s time we did more.
Canada’s federal privacy laws operate on a complaint-only basis with a general framework for consent unlike the European Union (EU), which has strict, proactive privacy regulations safeguarded by the General Data Protection Regulation (GDPR).
Canada needs to model itself on the human rights approach to privacy that the EU has adopted.
Our broad consent laws enable our personal data to be used in myriad of second and tertiary ways without our knowledge or permission.
Daniel Therrien, the privacy commissioner of Canada, emphasized that “Canadian trust is at risk” - and not just consumer trust but trust in our democratic processes. He pointed out that his office lacks powers to enforce compliance with existing privacy laws - and that privacy issues are not unique to Facebook: “Self-regulation has shown its limits.”
An all-party parliamentary committee agrees.
The recently tabled parliamentary report Towards Privacy By Design reviewed PIPEDA. It recommends significantly increased enforcement powers for the privacy commissioner, specifically broader audit powers, discretion about which complaints to pursue, and the ability to make orders and impose fines for those who do not comply with privacy legislation.
We fully agree. “We need to give the law some teeth,” as Dr. Avin Levin of Ryerson University put it.
Levin emphasized that the protection of Canadians’ private data is “a question of law and political will.” It’s in our power to do something about it but we can’t continue to sit on our hands.
He recommended that companies like Facebook should be liable for harm caused by content posted on their platforms. “Those waiting for the free market to regulate the Internet and social media companies will probably be waiting forever,” Levin said.
Adam Kardash, partner with the legal firm Osler, Hoskin and Harcourt LLP, cautioned against unduly stifling innovation in business.
One area received wide consensus: It’s time that political parties are included in our privacy legislation.
Political parties are exempt from PIPEDA. They are free to collect, store and use private data, including political viewpoints, and can micro-target voters and follow their own code of conduct without oversight.
That’s not good enough.
Bill C-76 was introduced recently to tighten rules around elections, including measures for campaign spending and foreign advertising. But it does not address privacy issues or consent for the collection, use and storage of personal voter information.
That needs to change. In the short-term, Bill C-76 could be amended to bring federal political parties under PIPEDA.
The government should also consider implementing several of the important recommendations out of the all-party committee report, including giving the privacy commissioner powers of enforcement.
In the longer term, Canada should look to the European Union as a model for more comprehensive and proactive powers to safeguard Canadians’ data privacy.
The technology demands that we catch up. And as Sen. Serge Joyal put it, “We must also make sure the legislation is not outdated the moment it is adopted.”
Troy Media columnists Art Eggleton and Raymonde Saint-Germain are members of the Canadian Senate.