A discussion on privacy: priorities, challenges and opportunities
Remarks at the Access to Information and Privacy community meeting
January 25, 2023
Ottawa, Ontario
Address by Philippe Dufresne
Privacy Commissioner of Canada
(Check against delivery)
Good morning, everyone.
Thank you for that kind introduction and for inviting me to speak to you today. It is a pleasure to be here, and I am really looking forward to our discussion following my remarks.
I want to start by acknowledging and thanking you all for the amazing work that you do in service of Canada and Canadians each day. The contributions of this community are vitally important, as is your commitment to accountability, transparency, and the protection of privacy in the work that you do, which builds trust in our democratic institutions. This has never been more important than it is now.
I was appointed Privacy Commissioner of Canada in June 2022. My mandate is to protect and promote individuals’ privacy rights in the public and private sectors, and to ensure that organizations respect their privacy obligations. My Office investigates complaints, provides advice to government departments and private sector organizations, reports publicly on compliance with privacy laws, promotes public awareness of privacy issues, and provides advice and recommendations to Parliament on law reform and privacy matters of public interest and importance.
This week we celebrate ‘Data Privacy Week’, and it is an opportunity for us all to consider the impact that technology is having on our privacy rights, and the importance of valuing and protecting personal information.
It is a pivotal time for privacy and access to information, and we share many of the same challenges and opportunities considering the changes in our legal, technological, and societal landscapes.
In this context, my appointment as Privacy Commissioner was, for me, a logical progression in my career as a lawyer and senior executive committed to promoting and protecting the fundamental rights of Canadians, while at the same time ensuring that pragmatic and important objectives are also achieved.
This approach also applies to the world of privacy and will be particularly relevant when dealing with matters related to the increasingly central role that technology plays in our world, our lives, and our economy.
Technology offers tremendous potential for public- and private-sector innovation, and for improving the lives of Canadians. Ensuring that as a world-class public service we can use these innovations while protecting privacy will be critical to our success as a free and democratic society, and a key challenge for Canada’s institutions in the coming years.
In order to do so, Canada’s federal public and private sector privacy laws need to be modernized to respond and adapt to these societal and technological changes, and to keep pace with legislative developments in other jurisdictions both domestically and internationally.
Protecting privacy is one of the key challenges of our time. I fully intend to meet this challenge and in doing so, I will apply the three elements of my vision for privacy that I presented during my confirmation hearings before the House of Commons and the Senate last year. They are:
- Privacy as a fundamental right;
- Privacy in support of the public interest and Canada’s innovation and competitiveness; and
- Privacy as an accelerator of Canadians’ trust in their institutions and in their participation as digital citizens.
These three pillars reflect the reality that Canadians want to be active and informed digital citizens, able to fully participate in society and the economy without having to choose between this participation and their fundamental privacy rights.
In short, privacy is fundamental. It supports important public and private interests, and it builds necessary trust.
Today, I would like to talk to you about what these three pillars mean to me as Privacy Commissioner, and what they mean for Canadians, starting with the first pillar – privacy as a fundamental right.
Privacy as a fundamental right
In 2019, my Office and our international colleagues in the Global Privacy Assembly declared in a resolution that “privacy is a precondition for citizens’ other freedoms as well as a keystone right for democracy…”.
This description of privacy as a necessary condition for the existence of other fundamental rights is consistent with the Supreme Court of Canada’s long-standing interpretation of privacy law as having quasi-constitutional status and with international legal instruments such as the 1948 Universal Declaration of Human Rights that have recognized the right to Privacy.
Treating privacy as a fundamental and quasi-constitutional right means treating it as we do other human rights. As a priority.
It means that privacy must be legally protected, with a strong, fair and enforceable legal and rights-based regime. A regime that offers meaningful remedies to prevent and address violations and that acts as an incentive for institutions to create a culture of privacy.
Let me repeat that. A culture of privacy. Privacy by design, where it is considered, valued, and prioritized. Privacy that is embedded at the outset of innovation, not as an afterthought or a regulatory irritant.
As the professionals responsible for access to information and privacy in the federal government, you are at the forefront of privacy protection in Canada. Each department has a mandate and a mission to fulfill, and your job is to ensure that as they do, they are also meeting their obligations with respect to privacy. As the internal advisors to the government, and given your considerable expertise, you are best placed to identify and assess privacy implications. Privacy Impact Assessments, or PIA’s as they are known, are an essential tool for integrating privacy considerations into new programs, policies, and technologies to ensure the protection of personal information. You play a critical role in that process, and my Office is here to support you in it. In fact, we have just released a bulletin on our website today describing five ways that a PIA can be improved, and I would invite you to have a look at it.
To create a culture of privacy means limiting the collection, use, retention and disclosure of personal information to what is demonstrably necessary and proportional to achieve an organization’s purposes. It also means adequately training those dealing with that information on the importance of protecting privacy, and having monitoring mechanisms in place to ensure that policies are being followed on an ongoing basis.
While consent is an important element of privacy law, citizens cannot be solely responsible for the protection of their privacy. The governments must also be accountable for the way they use information.
Indeed, as a litigator, I was often involved in matters where courts had to determine which side had the responsibility to do something or present evidence. One of the ways that courts made this determination was by assessing which party was best equipped to fulfill the task or to provide the necessary information, and which party was the most vulnerable or in need of protection.
Personal privacy is not a right we should have to surrender in the name of innovation or profit, or even in the name of the public interest.
In cases of conflict – and these will be rare – between privacy rights and private or public interests, privacy will prevail. I say that these cases will be rare because by creating a culture of privacy and protecting personal information at the front end, we will be able to avoid most conflicts and achieve both privacy and the desired public or private interests.
Privacy in support of the public interest and Canada’s innovation and competitiveness
This brings me to the second element of my vision – privacy in support of the public interest and Canada’s innovation and competitiveness, which recognizes the positive impact of privacy protection and rejects the false choice between privacy and innovation. I believe that Canada can be an innovation hub and a model of good government while at the same time protecting the personal information of Canadians.
We can and we must have privacy while fostering the public interest. It is not a zero-sum game and, as in so many things, we must reject extremes in either direction.
The way to avoid this false dichotomy and achieve both privacy and the public interest is by considering privacy at the front end – not after-the-fact. Doing so will be more cost-efficient and effective, and the costs will become investments that are good for businesses and governments alike.
All of us, whatever our roles in the private and public sectors, or as citizens participating in our democracy, need to work together to ensure that the fundamental right to privacy is protected while we achieve other important public interest goals. Taking the crucial work that you all do as an example, the accessibility, transparency, accountability, and effectiveness of government are core principles of our Canadian democracy. These are incredibly important public interest goals that we must work to achieve while at the same time respecting fundamental privacy rights.
Finding this balance is not always easy, but it is absolutely possible and necessary.
It is also good business and good public policy.
Resources spent on protecting and promoting privacy – on creating a ‘culture of privacy’ – are smart investments in trust and the security of Canadians, in both the private and the public sectors.
It is not an either/or proposition.
Even in the context of privacy-intrusive tools such as facial recognition technology, federal, provincial and territorial privacy commissioners in Canada have not called for an outright ban but rather for a clear and strong legal framework to regulate its use.
This was the subject of a recent report by the Access to Information, Privacy and Ethics (ETHI) Committee of the House of Commons, which reiterated the need to ensure appropriate regulation of such privacy-impactful technologies. The report recommended a moratorium on the use of facial recognition technologies until they could be reviewed by courts or my Office, and confirmed the need for critical measures, such as mandatory privacy impact assessments and consultation with my Office prior to the adoption, creation and use of facial recognitions technology; improved transparency and enhanced oversight; and modernized public and private sector laws.
In November 2022, the ETHI Committee issued another report on the use of on-device investigative tools by the RCMP. I welcomed this report which calls for a legislative framework that recognizes privacy as a fundamental right and that requires government institutions to consider and address privacy impacts at the outset when developing and using new technologies.
My provincial and territorial colleagues and I have also issued a resolution on digital identification. In announcing the resolution, I stated that the development and implementation of a digital ID ecosystem is an opportunity to demonstrate how innovation and privacy protection can coexist.
We can all see the benefits of a system that will allow individuals, businesses and governments to confirm identities and carry out transactions online with a high degree of efficiency and confidence.
But we must also recognize that unless digital identity projects and the frameworks that support them meet high standards of privacy, security, transparency, and accountability, they will not be trusted enough to be widely adopted, and those benefits will not be realized.
Treating privacy as a fundamental right and finding ways to achieve the public interest and innovation at the same time is not only possible, it is a virtuous circle that will generate trust and further benefit these interests.
This brings me to my third pillar – privacy as an accelerator of trust in the digital economy.
Privacy as an accelerator of trust in the digital economy
When individuals trust that their rights will be protected, they feel confident about participating freely in the digital economy. This is good for Canadians, good for businesses, and good for innovation.
Yet, in our most recent survey of Canadians, more than half of respondents expressed concern over the respect of their privacy.
So how do we restore this trust? Let me highlight three ways.
First, we need a strong set of public and private sector privacy laws that fairly and effectively regulate the collection, use, retention, and disclosure of personal information. Our laws need to be rights-based and provide effective remedies in cases of violations so that Canadians know that they are not alone in protecting their fundamental right to privacy.
The government took an important step toward modernizing the private-sector law with the tabling of Bill C-27, the Digital Charter Implementation Act, in June of this year. The bill is a recognition by the government that Canadians need and expect modernized privacy laws. I look forward to providing my advice to Parliament on how the Bill should be further improved.
I was also encouraged by the remarks of the Minister of Justice and Attorney General of Canada, the Honourable David Lametti, who following the tabling of Bill C-27, said that public sector privacy reform is not far behind. It will be important to harmonize the legislation to ensure that both public and private sector privacy laws are grounded in the same privacy principles – especially given the increased prevalence of public-private partnerships.
A second way to restore trust, and this touches my Office directly, is to ensure that data protection authorities have the necessary authority and resources to not only deal with complaints, but to also play a strong advisory and promotion role giving independent and expert advice and input to organizations planning new initiatives that involve the collection or use of personal information.
My hope is that when organizations consult with my Office, we will either be satisfied with the measures taken to safeguard privacy or we will be able to provide advice resulting in course corrections at the outset. I know that Canadians are well-served from access to information and privacy perspectives when we consult one another regularly and keep open these lines of communication.
Over the past few years, federal institutions have been consulting my Office more and more about the impact of their initiatives on privacy. In the past year alone, our Government Advisory Directorate held 39 outreach sessions, with more than 700 federal employees from program development and policy areas as well as teams like yours dealing with access to information and privacy, providing valuable input on issues ranging from how to develop a PIA to how to comply with the Privacy Act when using biometrics.
I am confident that the very fact that these consultations take place with my Office reassures Canadians that their privacy is being properly considered and protected in the pursuit of important public interest goals.
Through engagements with my Office, the preparation of PIA’s, or in the day-to-day work that you do, you are uniquely placed to apply the elements of this vision for privacy in a way that recognizes its fundamental importance, accounts for contextual realities, and supports the public interest and innovation. Your leadership and commitment to these principles is so important because by treating privacy as a priority, you are generating necessary trust in our democratic institutions.
As a third measure to restore trust, we need to create a strong and lasting culture of privacy. We need to make sure that Canadians do not feel that they are being nudged or encouraged to provide more information than what is strictly necessary and proportional to achieve an organization’s purposes. We also need to make it easy for Canadians to choose the most privacy protective settings, and to make sure that they know and understand when, how and why their information is being collected, used, disclosed and retained.
Our findings in the Tim Hortons investigation, where the company’s app tracked users’ locations even when the app was not in use, and without the users’ knowledge or consent, demonstrate how trust can be undermined when privacy is not sufficiently considered and protected.
It serves as a reminder of the work that remains to be done to promote a culture where privacy protection is the default setting and where Canadians have the reflex to always ask why their personal information is being sought.
A culture of privacy, with privacy by design, and privacy by default.
Conclusion
In conclusion, there is no doubt that the modern economy and public policy context increasingly depends on the value of data extracted through digital technologies. We have seen that these technologies can bring important benefits. But we have also seen the risks and the harms of technologies without adequate privacy protections.
Canadians should not have to look over their shoulders when using technology.
The way forward is through reform of our privacy laws in a manner that recognizes and protects privacy as a fundamental right, while at the same time supporting the public interest and innovation.
I believe that this can and must be achieved, and as Privacy Commissioner, I commit to working with all of you to promote and protect this fundamental right to privacy that is so essential to individual autonomy, dignity and the full enjoyment of other rights and freedoms in Canada.
Thank you again for having me this morning, and for the critical contributions that you make every day as public servants and access to information and privacy champions.
I would be happy to take any questions now and look forward to our discussion.
- Date modified: