More emphasis on transparency needed in PIPEDA: professor

OTTAWA — Any amendments to Canada’s privacy law for the private sector should include measures to enhance transparency, which include the privacy commissioner naming bad actors in investigations and mandating organizations report details of personal information being disclosed to law enforcement without consent, a University of Ottawa law professor is arguing. As of right now, “the number of exceptions for collection, use or disclosure without consent is growing without adequate counterbalancing measures to preserve some kind of transparency,” Teresa Scassa, Canada Research Chair of information law and policy at the university, said of the Personal Information Protection and Electronic Documents Act (PIPEDA) during a presentation at a symposium hosted by the Ottawa Law Review Wednesday. PIPEDA is currently under review by the government. It has a number of provisions that allow for the disclosure of personal information without knowledge or consent of the individual. Those instances include disclosures to government institutions that relate to such issues as national security or the enforcement of laws in the country. “There are a lot of questions you can ask about that,” Scassa, who is working on a paper on the topic, said in a follow-up interview. “Maybe it is important if our information is being shared with law enforcement and national security by all of these companies we do business with; maybe it is important that we have the much broader disclosure and sense, that’s not just voluntary, of how often this is happening, and who’s doing it and who’s asking for it?” In 2015, Innovation Canada — then called Industry Canada — put out guidelines for voluntary transparency reporting on lawful access released by telecom companies, but imposed some limits on the disclosure. A year later, privacy commissioner Daniel Therrien said he was looking for more companies to comply with those rules or he would seek ways to enforce it in legislation. Scassa pegs the number of exceptions to consent to disclosure of info in the act at 25, including the 10 that were added following the 2015 Digital Privacy Act amendments, which contained fines for non-compliance with data breach notification rules. She added that only five have a notice requirement after personal information is disclosed without consent. “That level of transparency is largely lacking,” she said. Late last month, the House ethics committee released its recommendations for amendments to PIPEDA. While it affirmed consent as the the core principle of PIPEDA and suggested further measures to strengthen that, including having an opt-in consent by default — meaning users would explicitly choose to disclose their info — and more transparency when it comes to the use of algorithms that process big data, there are also a number of outstanding exceptions to consent. The report highlighted areas for further study regarding those exceptions, including the use of publicly available information, aggregate data collection that ensures the impossibility of an individual being identified, personal information sharing without consent for “financial crime” generally, and for “legitimate business interests,” which the committee is asking the government to clarify. “There’s no discussion of transparency or how we’re going to make sure that these exceptions are not abused or that we understand the scope of the impact of them are,” Scassa said, although she noted that the committee is recommending “many good things” with respect to data protection. For example, a right to access personal information collected by organizations exists in PIPEDA, but Scassa said she’s seen instances where companies have used arguments of “confidential commercial information” linked to algorithms to deny access to that information. They can say “if we disclose that personal information, then our algorithm can be reverse engineered so we have to take away that because of our proprietary rights, and there’s an exception for that in the legislation,” she said. She added that there are also many parts of PIPEDA that have, and include avenues for, transparency, but they may need to be “addressed or buttressed or looked at again.” For example, while there is transparency with regard to how the office of the privacy commissioner conducts investigations, with the exception of certain high profile cases, it will generally not name names, Scassa said. This is despite the legislation stipulating that the commissioner "may make public" names in its investigation. Naming names would allow “consumers to make more informed choices about what companies they want to share information with, but that’s not transparent,” she said during the presentation. “I’m critical of, not just , but the way in which PIPEDA has been approached,” Scassa said, “which is to think of the consent part as doing the weight of giving notice and that’s all we need in terms of transparency, when there’s all of these other ways in which we need to think about transparency within the legislation and ways in which we need to address it.” In May, the European Union will enforce its General Data Protection Regulation (GDPR) guidelines, and Canada will need to update its privacy laws to maintain adequacy under the new rules. Incidentally, Scassa noted the GDPR gives transparency “a great deal more play.” — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

More emphasis on transparency needed in PIPEDA: professor

News | March 9, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

More emphasis on transparency needed in PIPEDA: professor

News | March 9, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Ethics committee calls for overhaul of Privacy Act to protect public servants’ data

Telesat deal good for Canada, Champagne tells INDU committee

Two years in, balancing change and privacy the main task for Philippe Dufresne

Tories shake-up membership of House of Commons committees

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us