Discussion on the Protection of Personal Information
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Remarks at presentation before the Senate Open Caucus
May 30, 2018
Ottawa, Ontario
Address by Daniel Therrien
Privacy Commissioner of Canada
(Check against delivery)
Allegations about the misuse of the personal information of 50 million Facebook users are a serious wake-up call that highlights a growing crisis for privacy rights. Not only is consumer trust at risk, so too is trust in our democratic processes.
Now, it’s plain to see that personal information may be analyzed for far more insidious purposes than marketing.
My office has launched a formal investigation into Facebook. We must of course be impartial and cannot pre-judge our findings. The allegations nonetheless shine a spotlight on weaknesses in our privacy laws.
Canadians want to enjoy the many benefits of the digital economy, but they rightly expect they can do so without fear that their rights will be violated and their personal information will be used against them. They want to trust that rules, legislation and government will protect them from harm. Self-regulation is clearly not sufficient. Even large tech companies now openly recognize this.
Canada’s privacy laws are falling behind and are no longer up to that task. Modern laws are urgently needed to protect us, as both citizens and consumers.
At the moment, for example, federal political parties are not subject to privacy laws. This is clearly unacceptable. Canada must take action in the face of serious allegations that democracy is being manipulated through analysis of the personal information of voters. Bringing parties under privacy laws would be a step in the right direction.
Another factor is that information about our political views is highly sensitive and therefore particularly worthy of privacy protection. This is recognized in several jurisdictions, including Europe, NZ and BC. I have heard federal politicians say that they accept that political parties should be subject to privacy laws, in the same way companies and government departments are. Others, including Ministers Brison and Gould apparently, are concerned that this would impede communications between parties and electors. The government seems to think that the situation of political parties is different from that of companies. This is an interesting proposition, but I have not yet seen any evidence to that effect. It is possible that such evidence exists, but it has not yet been put forward. What we know, however, is that democracy appears to still thrive in countries where parties must comply with privacy laws.
The precise law where privacy rules should be found does not much matter. It could be the Elections Act, PIPEDA or another Act. What matters are that internationally recognized privacy principles (not policies defined by parties) be included in domestic law and that an independent third party, potentially my Office as we have expertise, have the authority to verify compliance.
Privacy risks are also growing in the business world. Personal information is central to new online business models, and advances in the use of Big Data and artificial intelligence, which are necessary for Canada’s economic development.
Trust needed to allow the digital economy to flourish hinges on having an appropriate legal framework.
First and foremost, a modern law would better protect Canadians. But it would also offer companies the legal certainty they need in an increasingly complex environment, a certainty they do not have when relying on a notion of consent that is so stretched as to become meaningless.
We need legislation that ensures Canadians provide meaningful, informed consent for the collection and use of their personal information. But consent will not always be possible in the new world, where data may be used for multiple purposes not always known when it is collected. In these situations, organizations have an important role in responsibly managing personal information.
With that in mind, the law should allow my Office to go into an organization to independently confirm that the principles in our privacy laws are being respected – without necessarily suspecting a violation of the law. These inspection powers exist in other regulated industries; why isn’t our personal information worthy of the same protection?
The time has also come to provide my office with the power to make orders and issue fines – helping us to more effectively deal with those who refuse to comply with the law.
I’m very pleased that a Parliamentary committee recently issued a report calling for comprehensive changes to the federal private sector privacy law. I call on the government to act on that report.
An overwhelming majority of Canadians are concerned about how the digital revolution is infringing on their right to privacy. Recent events will only reinforce these concerns. Canadians deserve better. They deserve privacy laws adapted to the realities of the 21st century.
- Date modified: