Privacy commish vows more ‘proactive enforcement’

OTTAWA — The Office of the Privacy Commissioner (OPC) will not wait for the government to give it order-making and monetary enforcement powers to move toward proactively raising complaints instead of passively waiting for them to enter the door, it said in its annual report Thursday. “We want to shift the time and resources that we spend more — not exclusively, but more — towards proactive enforcement, meaning that we will initiate complaints ourselves based on trends that we see concerns that we see of a systemic nature,” privacy commissioner Daniel Therrien said in response to a question by The Wire Report in a media briefing Thursday. The annual report reiterated the OPC’s need to have order-making and monetary enforcement powers, suggesting they are crucial to protect the privacy of Canadians and would align the country with the practices of the United States and the European Union. It’s a request the privacy commissioner has previously made to the House standing committee on access to information, privacy and ethics. “The ombudsman model has been unable to make Canadians more confident that their privacy is protected and that they have a say in what happens to their personal information,” the report said. “A complaints-driven system does not give a complete picture of where privacy deficiencies may lie.” According to a survey highlighted by the report, 92 per cent of Canadians have expressed concern about their privacy. That survey was commissioned by the OPC and completed by Phoenix Strategic Perspectives Inc. The sample size was 1,500 across Canada and accurate within plus or minus 2.5 per cent, 19 times out of 20. To address this, the OPC suggested enforcement powers, while making consent information more easily accessible and transparent to protect the privacy of Canadians. However, the report noted that some scenarios wouldn’t lend themselves to consent, including where large amounts of data are collected from new technologies, including the Internet of Things (IoT). “In this age of big data, the Internet of Things, artificial intelligence and robotics, it is no longer entirely clear to consumers who is processing their data and for what purposes,” the report said. "For individuals, the cost of engaging with modern digital services means accepting, at some level that their personal information will inevitably be required to be collected and used by companies in exchange for a product or service.” Over the past few months, a House ethics committee studying the Personal Information Protection and Electronic Documents Act (PIPEDA) has heard from both Therrien himself and other witnesses about the whether to increase the powers of the OPC. While other witnesses backed the suggestion, the Canadian Wireless Telecommunications Association (CTWA) suggested the move would affect relationships with the OPC. But this won’t be the first time the OPC has initiated complaints. Therrien said during the media briefing, held after his report was tabled in Parliament, that it has happened before, at the rate of once or twice a year. He also said his plan to put more effort and resources into more proactive investigations comes at a cost. Therrien said this does not mean it will be abandoning the ombudsman model of receiving and addressing complaints, but some fact-specific individual complaints may be pushed aside if it has to address issues that have the biggest impact on the greatest number of Canadians. In other words, he wants to put more effort into tackling the big systemic issues. Here, Therrien said his office would need additional funds to both implement both a reactive and proactive system. He didn’t specify how much, but only said a “relatively modest increase in our budget.” If it doesn’t get additional funding, and because it receives many complaints, it may have to pick and choose its battles as it implements this new proactive approach, he noted. Where individuals may be left without remedy, the report recommended a private right of action for PIPEDA. He added that individual consumers are “rarely well-placed” to identify privacy problems, and while his office isn’t currently ideally placed either, they are better positioned to do so. “We’re better placed often to detect these systemic issues...so we’ll be able to get at the more important systemic issues than to only respond to complaints made by individuals,” Therrien said. Therrien said the overall solution can’t just be to trust companies to be more accountable. Rather, it’s a combination of more accountability, better information so that citizens can consent but also to vest more powers in an independent regulator to oversee these actions. “It is not enough for the government to say that privacy is important while taking no systemic measures to protect it,” the report noted. “An overwhelming majority of Canadians are concerned about how the digital revolution is infringing on their right to privacy. They do not feel protected by laws that have no teeth and organizations that are held to no more than non-binding recommendations.” In the meantime, the commissioner said the office has previously named non-compliant companies and will continue to do so if it is in the public interest. Thursday’s report is also asking Parliament to further explore the issue of publicly available information — whether information online is fair game to obtain and use — which was a point of contention that was brought up when national security Bill C-59 was tabled in June. The report also addressed new consent exceptions where such a requirement may be impractical. Those situations include “search engines indexing web sites and presenting search results to Internet users where appropriate” and the aforementioned analytics, IoT and other data driven applications where “commercial and societal interests align.” Organizations would have to demonstrate, on request, certain criteria including the necessity of requiring personal information, the impracticality of obtaining consent and that the societal benefits clearly outweigh any privacy intrusions, the report said, adding exceptions should generally be a last resort. In light of recent judgments involving the notion of a right to be forgotten, the report also noted that the OPC will be taking a policy position on online reputation that will be shared with Parliament before the end of the year. Overall complains accepted by the office under PIPEDA declined slightly, from 332 last year to 325 this year. Therrien told media the office finds the decline “very surprising, if not alarming.” That could be because Canadians are reporting less, he suggested, and while it could be because there are fewer incidents, “I doubt that a lot,” he added. — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Privacy commish vows more ‘proactive enforcement’

News | September 21, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Privacy commish vows more ‘proactive enforcement’

News | September 21, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Beanfield appoints Winnie Leung as CFO

‘Outdated’ regulatory tools unsuitable for online environment, streamers tell CRTC

Local providers key to broadband rollout, CanWISP told

Telesat, feds announce new Gatineau campus

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us