Consent and Privacy: Look at the Past, Prepare for the Future

Karl Delwaide and Antoine Guilmain (Fasken Martineau)^{Footnote 1 Footnote 2}

October 2016

Note: This submission was contributed by the author to the Office of the Privacy Commissioner of Canada’s Consultation on Consent under PIPEDA.

Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.

---

Summary

A meeting was held in Montréal on February 23, 2015, concerning the Office of the Privacy Commissioner of Canada’s strategic priorities (“Office”). Following that meeting, Karl Delwaide submitted several points for consideration to the Office regarding the application of the Personal Information Protection and Electronic Documents Act (“PIPEDA”), in particular with respect to consent and transparency issues. His comments are set forth in the submission attached hereto, and take into account the following principles:

1. The importance of finding a “balance” between protecting one’s privacy and the need of an organisation to collect, use, or disclose personal information (“PI”) about individuals in the course of their legitimate business activities.
2. We do not encourage additional restrictions that would increase the burden on organizations, or that would even (except for limited exceptions) go so far as to prohibit asking (or obtaining) consent in certain circumstances, which often fall within the scope of legitimate business activity.
3. We believe that the PIPEDA (and other similar provincial laws) already contain consent parameters useful in the age of information technology:
   1. Consent is based on an obligation to inform that must be executed in a clear and transparent manner. However, an individual who consents cannot be merely “passive”; he also has an obligation to inform himself. We do not feel that it is appropriate to treat the person as a “victim” or a “child”;
   2. Given the principles underlying Canadian bijuralism, civil law notions may be useful here and already exist to govern the notion of consent. We will discuss the obligation to inform imposed on organizations that collect, use, or disclose PI, but also every person’s obligation to inform himself;
   3. The underlying principles of the PIPEDA (and other similar provincial laws) already impose limits on consent: the regulators’ decisions underscore that consent (as broad as it may be) once obtained cannot defeat the principle that information collected, used, or disclosed must be necessary for the objectives/purposes that were clearly explained to individuals;
   4. The “necessity” criterion is also well-known and circumscribed by regulators when applying PI privacy laws: in general, the collection, use, or disclosure of information must be “indispensable” (as opposed to “useful”);
   5. We therefore propose a framework approach that combines control, simplification, and transparency but that is not unduly burdensome. In our opinion, the underlying issue is the fact that it is sometimes difficult to actually identify that to which we are consenting. A multi-page consent form with lots of verbiage can be rather “indigestible”. We submit that there is an advantage in simplifying so that the circumstances of consent are clearly stated and comprehensible. We propose that the Office be vested with the authority to impose a simplified consent form that would have to set out in no more than two pages a) the purposes for collecting, using, and disclosing the PI, b) the consent sought for each one, c) a statement as to why this is necessary and d) the presence or absence of “cookies” or other such elements. The summary in question should appear as soon as the request for consent is “published”. The goal is to provide the individual with a brief portrait of what is explained at length in the other pages of the consent form. It’s simply a matter of applying the well-known adage that “what we understand well we express clearly; and the words to say it flow easily!”

Respectfully submitted.

Karl Delwaide and Antoine Guilmain, lawyers.

Montreal, August 4, 2016.

The full submission is available in the following language(s):

French (PDF document)

Note: As this submission was provided by an entity not subject to the Official Languages Act, the full document is only available in the language provided.