Privacy consultations helped prep office for upcoming battles, participants say

The Office of the Privacy Commissioner’s summer consultation on emerging technologies will help the office take pre-emptive measures to deal with technology firms, industry observers told The Wire Report. “I think saw many issues coming down the pipe consumer-facing technologies and cloud computing. I think she thought to get ahead of the curve a little bit,” David Fewer, director of the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC), said in an interview. “I was pretty impressed to see the commissioner taking so proactive a role in educating her office and educating Canadians generally on these technologies and privacy issues associated with them. It’s a good move.” In January 2010, the privacy commissioner announced a consultation on privacy issues relating to online tracking, profiling and targeting of consumers. The office held three expert panels: one in Toronto in April, one in Montreal in May, and another in Calgary in June. Karen Eltis, an associate professor at the University of Ottawa’s faculty of law, said via email the panels helped the privacy commissioner gather information on new technologies and their privacy implications. Eltis sat on one of the consultation’s panels on consumer information, data mining and analytics in Montreal. “The consultations were a very important, laudable, and a very productive initiative by the ,” she said. She added it was important to gather experts “from various sectors and inclusive of relevant stakeholders towards the development of pragmatic and effective policy privacy strategies.” Eltis said the consultations also helped inform the public in an “emerging area where fostering awareness is key.” Anne-Marie Hayden, director of communications at the Office of the Privacy Commissioner, told The Wire Report in an email the office will be posting a draft of the consultation report on its website this fall. The commissioner will issue a call for comments about the draft from the public and stakeholders and will release a final report by spring 2011. Hayden said the consultations will help inform the next Personal Information Protection and Electronic Documents Act (PIPEDA) review process, scheduled for 2012. “The work via the consultations will help us determine whether or not, in our view, PIPEDA would need to be amended in any way to address the issues highlighted in the consultations (e.g., online tracking and cloud computing). When the next round of PIPEDA review commences, we would likely be asked by Parliament for our thoughts on this,” Hayden wrote. Suzanne Morin, assistant general counsel and privacy ombudsman at Bell Canada, said in an interview the consultations showed PIPEDA is effective at dealing with privacy issues. Morin sat on the consultation’s Montreal panel with Eltis. “The outcome of the consultations proved that PIPEDA … continues to be able to meet these ever changing and evolving environments because it is a flexible piece of legislation,” she said. “Listening to the comments and the kinds of issues people raised, you could say, ‘Well, PIPEDA allows this, PIPEDA does that’ … I didn’t see anything saying that the sky was falling and we need a new law ... Canada is probably in the best position internationally with the law that we have.” Morin said she hopes the OPC will make the consultation an ongoing discussion, and will bring up further issues in new consultations. Hayden did not comment on what issues will be given importance in the commissioner’s report, but Fewer said the online targeting of consumers may become a problem as foreign companies develop tracking methods. “Given the fact that many business models are going to be originating within the United States and not out of Canada, I think we’re going to see a repeat of the Facebook issue, where the privacy framework embedded in these technologies is going to reflect the U.S. framework and not the Canadian framework. So you are going to have privacy issues,” he said. In January the privacy commissioner launched two probes into Facebook’s privacy policies. Fewer said the commissioner was forced to react to sudden changes to the social networking website’s privacy policy. “Facebook caught the office a little bit flatfooted. It didn’t have the capacity to understand the technology, and so they had to build that capacity,” he said. Following the Facebook probes, Fewer said the commissioner decided to take a more proactive approach to gather information and better cooperate with technology firms. “This is fairly innovative from a Canadian perspective. We don’t have a lot of Canadian regulators who on their own initiative do effectively what is a public information gathering initiative intended to benefit not only the regulator, but also the public generally and the regulated industry,” he said. Fewer said the way forward for the commissioner should be to encourage companies to design products in compliance with Canadian privacy law before they are introduced—rather than trying to “fix” them afterwards. Fewer said that, following the privacy commissioner’s recent interactions with Facebook and Google, Canadians can expect “very visible” public interventions. “I would like to see guidance. That’s something the commissioner can take out of this. If you are going to roll out a cloud service, here are some of the issues that you’ll need to address, and here is some guidance on how to address them. I’d love to see that,” he said. Eltis said she is advocating the commissioner undertake a clear, principle-based approach where privacy strategy does not rely on solving issues after complaints have been filed. In 2009-2010, the privacy commissioner funded nine research projects, including an analysis of the privacy implications of deep packet inspection (DPI), a networking technology used by Internet service providers (ISPs) to monitor and control data traffic. The project determined ISPs could potentially use DPI for behavioural marketing, data mining and copyright enforcement, but its report said none has done so. Fewer said that while no companies are using DPI to track online behaviour, the technology is a problem if companies use it in this way without public disclosure. “Many Canadian telecommunications companies … introduced deep-packet inspection technologies without doing any kind of public announcement of what they were doing. They weren’t collecting personal information, it turns out, but nonetheless they were violating Canadian privacy law with respect to inadequate disclosure. Transparency is one of the requirements of Canadian privacy law,” he said. kfournier@thewirereport.ca

Privacy consultations helped prep office for upcoming battles, participants say

Broadcast | September 21, 2010

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us