Time for a renovation of Canada’s privacy laws

The federal government must introduce a mix of legislation and policies to better protect Canadians and their personal information. On the legislative front, this must start with reforming Canada’s commercial privacy legislation. The Personal Information Protection and Electronic Documents Act (PIPEDA) was passed into law in 2001. It established the federal privacy commissioner as an ombudsperson, not a regulator, with the effect that companies which mishandle personal information can (and do) ignore the commissioner’s recommendations. While the law also theoretically empowers individuals to learn what information organizations collect about them, the Citizen Lab’s research has shown that companies often refuse to share all the information they possess about requesters and that they often demand high fees before disclosing data to the requester. These limitations, and many others, demand a renovation of Canada’s privacy laws. Sadly, Bill C-11, which was introduced in the last Parliament, contained numerous serious deficiencies. To begin, the bill would have weakened consent requirements. As Professor Teresa Scassa has written, sections of C-11 “can only be seen as enhancing consent if you conceive of consent as a burden that should be largely eliminated.” C-11 also failed to adequately restrict how so-called "de-identified" data could be used. As drafted, organizations could have used de-identified data to develop biased algorithms that might discriminate against the very individuals whose de-identified data was used to train the algorithms. Organizations would not genuinely have been made more accountable for how they obtained or used personal information under the proposed legislation or for how they applied algorithms to our data. They also could have continued charging high fees when individuals asked for copies of their information. Finally, while the legislation would have enabled the privacy commissioner to levy penalties on organizations which misused Canadians’ personal information, the administrative mechanisms could stretch out to five to eight years. That’s hardly a system of timely justice. The government must remedy C-11 deficiencies by taking critics’ comments into account before reintroducing it in the next Parliament. Simultaneously, the government must develop stronger policies to encourage private organizations to take cybersecurity more seriously while reducing its own dangerous stockpiles of computer vulnerabilities to reduce the risks to Canadians’ personal information. One of the fastest ways to protect Canadians’ information could involve forcing organizations to meet higher baseline cybersecurity standards as a condition of contracting with the federal government. In doing so, Canada would be following in the footsteps of the American government and could learn from America’s successes and missteps. Such a mandate would ensure that contractors appropriately secure the personal information they handle. While little discussed, the Government of Canada develops and acquires computer vulnerabilities and exploits. Such vulnerabilities can be, and often are, independently discovered by non-state actors; no government holds a monopoly on finding particular computer vulnerabilities. To date, Canadians have little insight into when vulnerabilities are retained for operational use versus when they are disclosed to get the vulnerabilities patched. Even the National Security Agency and Central Intelligence Agency (which abide by more public disclosure policies) have previously lost control of their vulnerability stockpiles. This led to billions of dollars in financial damage, to say nothing of the harm experienced by individuals who had their personal information exposed in associated data breaches. Canada’s own cyber stockpile is a ticking time bomb that is just waiting to detonate. At a minimum, the government should better explain how it obtains and develops, and decides to retain or disclose, computer vulnerabilities, perhaps taking inspiration from the United States. The privacy commissioner, as the Canadian government’s foremost expert on the sensitivity of personal information, should be prominently involved in decisions to retain or disclose computer vulnerabilities, as should other relevant government agencies and commercial and civil society organizations. The most invested stakeholders should be at the table to ensure that Canadians, and their personal information, aren’t being put at risk by the government’s hoarding of computer vulnerabilities. These are starting points to ensure that Canadians, and their personal information, are better protected from malignant activities. They won’t solve all of our privacy and security problems but would represent a good start towards improving the privacy and security of Canadians’ personal information in the next Parliament. Dr. Christopher Parsons is a senior research associate with the Citizen Lab at the Munk School of Global Affairs and Public Policy, University of Toronto. His research focuses data privacy, data security, and national security. The Hill Times

Time for a renovation of Canada’s privacy laws

One of the fastest ways to protect Canadians’ information could involve forcing organizations to meet higher baseline cybersecurity standards as a condition of contracting with the federal government.

Government’s efforts to introduce privacy rules for federal political parties wholly inadequate and totally cynical

Legislation that keeps up with AI may require special committee with expert panel, says NDP critic

Canadians’ privacy could take a serious hit this coming legislative session

Government’s efforts to introduce privacy rules for federal political parties wholly inadequate and totally cynical

Canada needs a modern, national health data architecture

To address online harms, Canada must commit to digital media literacy

A cure for multiple sclerosis could be just around the corner

Renewable energy is the way to go, says letter writer

Supporting local broadcasters is critical for our democracy

How to dismantle a privacy bomb

‘Rights-based’ approach needed to modernize privacy laws, says next privacy commissioner Dufresne

Departure of privacy commissioner will not impact tabling of new privacy legislation, says Champagne

Bill C-11 was the gift that needed returning

Data-protection bill needs to be on parliamentary agenda this session, says privacy-law expert

News

Get free news updates

Opinion

Submit a guest opinion article

resources

Advertise

subscribe

get help

Time for a renovation of Canada’s privacy laws

One of the fastest ways to protect Canadians’ information could involve forcing organizations to meet higher baseline cybersecurity standards as a condition of contracting with the federal government.

Get The Policy Briefings Newsletter