Study on the State of Disruptive Technologies

Submission to the House of Commons Standing Committee on Industry, Science and Technology

June 18, 2015

Mr. David Sweet, M.P.
Chair, Standing Committee on Industry, Science and Technology
House of Commons
131 Queen Street, 6^th Floor
Ottawa, ON K1A 0A6

Dear Mr. Chair:

I would like to commend the House of Commons Standing Committee on Industry, Science and Technology for its timely study on the state of disruptive technologies. The Office of the Privacy Commissioner of Canada recognizes that the development and application of new technologies holds great promise for Canada’s economic growth, and would like to make the following submission to your study.

As Canada’s Privacy Commissioner, I am charged with protecting the privacy rights of Canadians and with enforcing Canada’s federal privacy laws, including the Privacy Act, which covers the personal information handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s private sector privacy law.

The purpose of PIPEDA is to establish rules to govern the use and disclosure of personal information in a manner that recognizes the right to privacy of individuals and the need of organizations to collect, use or disclose personal information. PIPEDA defines personal information as “information about an identifiable individual”, meaning that information is personal when there is a possibility that an individual could be identified through the use of that information, alone or in combination with other information.

PIPEDA outlines key privacy principles that organizations should adhere to, including the requirement for organizations to obtain knowledge and consent to collect, use, or disclose personal information, limiting use and disclosure for the purposes identified at the time of collection, and applying appropriate safeguards to protect personal information. Organizations must also be accountable for their personal information handling practices.

While some of the technologies discussed throughout your study may not always involve personal information as defined in PIPEDA some will, and several witnesses have rightly noted that these technologies do have the potential to affect privacy and alter the ways in which personal information is collected, used, or disclosed. Canadians are increasingly concerned about their privacy and are choosing to do business with organizations that are sensitive to those concerns.

According to our latest public opinion poll,^{Footnote 1} 81% say they would choose to do business with a company specifically because it has good privacy practices. And more than half would choose to do business with a company because it does not unnecessarily collect personal information. Much of this heightened concern stems from the increased privacy risks posed by emerging technologies.

With that in mind I would like to bring to your attention some of the work that my Office has undertaken to better understand new technologies and to raise awareness about their implications on Canadians’ privacy. In 2010 my Office provided our views on privacy, trust and innovation to the Government’s Digital Economy Consultation.^{Footnote 2} In order to promote trust and an innovative economy, we recommended, among other things, that privacy be integrated into the development of new technologies, that digital and privacy literacy be promoted, and that small and medium sized enterprises, particularly technology innovators, should be provided with the necessary tools and guidance to better understand privacy and protect Canadians’ personal information.

Since then we have conducted exploratory work in a number of emerging technological areas including predictive analytics,^{Footnote 3} wearable computing,^{Footnote 4} and drones.^{Footnote 5} In the coming months, we also plan to release several reports on the Internet of Things – a term used to describe how everyday objects, equipped with wireless sensors, can send and receive information to and from the Internet. We have also issued joint guidance with the Offices of the Information and Privacy Commissioners of Alberta and British Columbia aimed at Canadian companies that develop mobile applications^{Footnote 6} and choose to store their information in the cloud.^{Footnote 7}

Research funded through our Contributions Program has led to increased privacy awareness about transformations in the automobile industry,^{Footnote 8} the development of de-identification standards for personal health information in the age of Big Data,^{Footnote 9} and, the identification of core elements for an optimal privacy governance framework for the storage and sharing of genomic data in the cloud.^{Footnote 10}

On the international stage, we are not the only jurisdiction that has a keen interest in how new technologies can impact personal information handling practices.

For example, in May 2014 the White House issued a paper entitled Big Data: Seizing Opportunities, Preserving Values^{Footnote 11} and earlier this year the Federal Trade Commission released a report entitled Internet of Things: Privacy and Security in a Connected World.^{Footnote 12}

As privacy issues related to emerging technologies are a global matter in an age of transborder data flows, my Office has undertaken collaborative initiatives with our international counterparts to protect the privacy rights of Canadians and promote confidence in the digital economy in Canada. For example, my Office along with international data protection authorities from around the world have signed declarations on big data, privacy in the digital age, and global enforcement cooperation.^{Footnote 13}

As our Office sets forth on implementing our new privacy priorities,^{Footnote 14} we aim, among other things, to enhance the privacy protection and trust of individuals so that they may confidently participate in the digital economy. We want to ensure privacy remains protected in a manner that gives individuals meaningful control over their personal information while at the same time respecting innovation, particularly among small and medium sized enterprises, which form the vast majority of Canadian companies.

Strong privacy practices, such as limiting personal information collection to that which is necessary to fulfill legitimate business purposes, obtaining meaningful consent, and safeguarding personal information, can also make companies more attractive to do business with in the global marketplace.

To this end we have been encouraged by efforts to move Bill S-4 (Canada’s Digital Privacy Act) forward, which amends PIPEDA to strengthen provisions around consent and to introduce breach notification. We look forward to it receiving royal assent and its coming into force. Yet, there is still more that we can do to better protect the privacy of all Canadians as the development and application of new technologies continues to have an impact on ourselves, our society and our economy. This will be a focus of my Office’s work in the coming months and years.

I would like to thank the Committee for considering our submission to its study on the state of disruptive technologies and would be pleased to make myself available to appear before the Committee should it choose to undertake a similar study in the 1st Session of the 42nd Parliament.

Sincerely,