How to dismantle a privacy bomb

The latest push to modernize Canada’s privacy laws has unfortunately produced a dangerous piece of legislation that heavily favours the private sector at the expense of individual privacy interests. Contrary to the claims made by Sara Clodman in the Canadian Marketing Association’s recent Hill Times article—namely that with Bill C-27, “Canada has taken a principles-based and risk-weighted approach”—the government has instead created a high-risk bomb that risks destroying Canadians’ privacy. We must face the fact that “innovation” and consumer privacy interests in the digital age have few principles and goals in common. To acknowledge this is not cynicism; it is reality. Digital apps, platforms, and services that capture our attention with exceptional ease are built on a vast power imbalance between consumers and the private sector. Consumers now face a rising tide of social, democratic, and competitive harms resulting from the increasing scale of data breaches, targeted dissemination of misinformation, and the market dominance of the largest data aggregators. There is immense economic value in consumer and citizen data, but tapping into this seemingly bottomless reserve should not come at the cost of our individual and collective privacy interests. Policymakers must also be critical of industry voices that boldly claim to know what consumers “expect” or “understand” about how their personal information is used. Often, these expectations are created and shaped by the industry itself. The dizzying growth of the data economy is at least partly attributable to how companies have carefully engineered digital platforms to encourage user apathy towards privacy practices, and to obfuscate the true extent to which personal data is collected, used, and disclosed. Evidence-based policy and legislation requires the government to undertake primary research such as surveys and focus groups to establish consumer privacy expectations and concerns. The bill, if passed in its current form, will be a massive boon for businesses, but at a huge cost to consumers. There are almost too many problematic aspects of the bill to list, but the most dangerous provisions concern individual consent and knowledge. The new general exceptions to consent for so-called “business activities” and “legitimate interests” under Section 18 of Bill C-27’s Consumer Privacy Protection Act (CPPA, found in Part 1 of the bill) are far too permissive. In effect, they allow businesses to collect and use any consumer information without their consent or even knowledge. Next, the new “de-identification” and “anonymization” provisions under the bill are additional trapdoors through which personal information will disappear. Section 20 enables businesses to “de-identify” personal information without the individual’s consent or knowledge—that is, to “modify personal information so that an individual cannot be directly identified from it,” though a risk of re-identification remains. A few obligations still apply to de-identified data, but if businesses want to avoid the CPPA altogether, they can simply anonymize personal information. Under the bill, to “anonymize” means to “irreversibly and permanently modify” personal information so that the individual cannot be directly or indirectly identified from the information by any means—an increasingly difficult standard to meet in today’s data economy. Bill C-27 is a dangerous piece of legislation that policymakers must defuse before irreversible damage is done, writes PIAC staff lawyer Yuka Sai. Photograph courtesy of Yuka Sai The use of de-identified and anonymized data can also cause harm without it ever being re-identified. Artificial intelligence systems operating on immense volumes of de-identified or anonymized data can perpetuate and worsen social biases through discriminatory profiling and predictive modelling. The federal privacy commissioner’s office warned in 2020 recommendations that automated decision-making processes can be used to “influence, micro-target, and ‘nudge’ individuals’ behaviour without their knowledge.” Knowledge is critical to empower individuals to raise concerns about potentially unfair or biased treatment resulting from the use of de-identified or anonymized personal information. The CPPA takes this knowledge away from consumers. In stark contrast, Article 22 of the European Union’s General Data Protection Regulation (GDPR) provides EU residents with specific rights to: Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning an individual or similar effects; Obtain human intervention on the part of the data controller; Express the individual’s point of view; and Contest the decision. Bill C-27 does not provide these rights. That omission raises the risk that the European Commission will not renew Canada’s “adequacy status” under EU law to allow transfers of EU citizens’ data to and from the EU. Adequacy was last granted to Canada in 2001, well before the GDPR came into force—but now that adequacy is likely to be reassessed soon. Fundamentally, the GDPR is founded on an explicit recognition of privacy as a human right that is necessarily balanced against any processing of personal info under the GDPR. In Canada, legislators have always stopped short of recognizing personal privacy as a right. Bill C-27 would further entrench a market-oriented framework, rather than foster a rights-based one. The new Artificial Intelligence and Data Act (AIDA), laid out in Part 3 of Bill C-27, is significantly under-developed and utterly fails to address the huge potential of systemic harms resulting from AI systems. AIDA’s provisions leave too much discretion to the private sector to self-qualify their AI systems as “high impact,” or not, according to criteria to-be-established by the governor-in-council. The decision as to whether an AI system is “high impact” is key because obligations only apply to “high-impact” AI, while all other AI uses are deemed to be harmless and therefore largely unregulated. Bill C-27 is a dangerous piece of legislation that policymakers must defuse before irreversible damage is done. The bill lets businesses in Canada negligently or purposely push the limits of its excessively permissive provisions, particularly those exempting businesses from obtaining consent and knowledge. Parliament can tinker, but this bomb has been designed to blow a hole in consumer privacy rights. The best course would be to dispose of it entirely and start from scratch. Yuka Sai is a staff lawyer at the Public Interest Advocacy Centre, where she conducts research and intervenes in consumer interest issues, including privacy and telecommunications. The Hill Times

How to dismantle a privacy bomb

If Bill C-27 is passed in its current form, it will be a massive boon for businesses, but at a huge cost to consumers.

Legislation that keeps up with AI may require special committee with expert panel, says NDP critic

Privacy czar’s Home Depot investigation exposes weaknesses in Ottawa’s new privacy bill

Canadians’ privacy could take a serious hit this coming legislative session

Legislation that keeps up with AI may require special committee with expert panel, says NDP critic

Canada needs a modern, national health data architecture

To address online harms, Canada must commit to digital media literacy

A cure for multiple sclerosis could be just around the corner

Renewable energy is the way to go, says letter writer

Supporting local broadcasters is critical for our democracy

Privacy bill achieves Canada’s priorities

Politics This Morning: Diving into the feds’ new privacy bill

Harmonization with provinces will be key when introducing new data privacy legislation, say privacy experts

Data-protection bill needs to be on parliamentary agenda this session, says privacy-law expert

Bill C-11 was the gift that needed returning

News

Get free news updates

Opinion

Submit a guest opinion article

resources

Advertise

subscribe

get help

How to dismantle a privacy bomb

If Bill C-27 is passed in its current form, it will be a massive boon for businesses, but at a huge cost to consumers.

Get The Weekend Point of View Newsletter