Public Opinion Surveys

Revisiting the Privacy Landscape a Year Later

Submitted to:
The Office of the Privacy Commissioner of Canada
March 2006

EKOS Research Associates

---

Outline of Report

This report has five sections:

• Overview of Key Findings
• Broad Attitudes
• Privacy Laws
• Transfer of personal information
• Technology and Personal Information

Appendice:

• Research Methodology

Overview of Key Findings

Study Background

In 2005, EKOS was commissioned to undertake a survey on behalf of the Office of the Privacy Commissioner of Canada to get a snapshot of the Canadian public in relation to the privacy landscape. That study looked at emerging privacy issues with a particular focus on the cross-border transfer of Canadians' personal information. Because this field is so rapidly changing, in terms of technology, public policy and media coverage, EKOS undertook a follow-up survey a year later.

Broad Perceptions

• Canadians are increasingly concerned with the protection of personal information. This concern has displaced vaguer worries about physical privacy which once dominated the privacy landscape. Those traditional worries have long been ebbing, driving a fall in the overall salience of privacy as an issue during the 1990s. When privacy re-emerged strongly in the consciousness of Canadians in the early 2000s, it was driven by the new challenge of information privacy.
• This year's survey reveals that concern about the privacy of personal information remains very high. Canadians believe their personal information is less protected than it once was — a view held by more than seven in ten. Yet Canadians do not view all types of personal information as being the same. Health information is one type of information, for example, that is considered sacrosanct.
• Two-thirds of Canadians have concerns about the future, agreeing that the protection of personal information will be "one of the most important issues facing our country in the next ten years".
• It is important to recognize that Canadians can diverge widely on privacy-related issues. What is acceptable to one individual may be entirely unacceptable to another.

Faltering Faith in the Law, Business and Government

• Canadians believe firmly that laws need to be updated in response to the rapid evolution of information technology.
• It is disturbing, however, that most Canadians believe that neither governments nor business take the responsibility to protect personal information very seriously.
• This lack of confidence in institutions to take the protection of personal information seriously may result in part from Canadians' very low awareness of existing privacy laws and institutions. Only one in five Canadians reports a "clear" awareness of privacy laws; and the true number is undoubtedly lower. Even fewer are able to identify the federal institutions concerned with privacy issues.
• There are also widespread misperceptions of government information practices. For example, EKOS' research shows that nearly half of Canadians erroneously believe that the federal government has a central database on citizens that contains all of their personal information. (This is a slight improvement over last year).

Canadians Take It as a Given That the Privacy Act Must Change

• Canadians take it as a given that the rapid pace of technological innovation and adoption means that existing privacy legislation needs to be updated regularly.
• Two in three Canadians believe the extent to which the Privacy Act needs to be modernized is high. Virtually no one believes there is little need to modernize the Act.
• A plurality of Canadians continue to question whether governments are doing an adequate job of understanding the use of personal information by businesses (and by extension the potential threats).

Privacy is a Concern

• Though Canadians do not believe that privacy is on a par with "tier one" priorities such as healthcare and education, they do place updating privacy laws on a similar footing to issues as ethics and accountability, public security and taxation.*
• There is some reason for optimism. Although there is far to go, Canadians are becoming more informed of their privacy rights and more engaged in the protection of their personal information.
  • The proportion of Canadians reporting they have a good or very good understanding of their privacy rights has doubled since 2001; rising from 13 per cent to 26 per cent.
  • Sixty per cent of Canadians rate their attention to protecting the privacy of their own personal information as "good" to "very good".

* Based on comparison of data from this study and EKOS' own studies.

Cross Border Information Transfers are a Worry

• Belief in the pervasiveness of the transfer of personal information across borders, and related concern, are up slightly from the previous year, perhaps reflecting heightened media attention.
• Canadians attribute high importance to being notified of the transfer of personal information across borders and concerns are rising with regard to transfers relating to national security.
• Canadians want to have their consent obtained before personal information is transferred. Simply being notified isn't enough. In fact, more than four in five place "high importance" on the requirement that consent be obtained.

USA PATRIOT Act: an area of concern

• There is impressive awareness of the USA PATRIOT Act and the privacy issues it raises. More Canadians report a high level of recall of privacy-related concerns with the Patriot Act than with the Canadian privacy laws.
  • Awareness of the privacy-related concerns with the Patriot Act is higher in B.C., likely reflecting the highly publicized work of the Office of the Information and Privacy Commissioner for British Columbian on this front.
• A majority of those aware of the USA PATRIOT Act and the related privacy issues, report they are personally concerned about the Act.

Canadians Still Working Through the Issues

• Canadians are among the most technologically sophisticated populations in the world. They understand that the processing of the personal information of citizens and consumers is core to the modern economy.
• Though EKOS' own research indicates Canadians have become tech savvy and mature users of technology, the results of the current study indicates they feel no more equipped to understand the privacy implications of new technology than they were at the start of the decade.
  • Only half report they are confident they have enough information to know how new technologies might affect their personal privacy — virtually unchanged from fall 2000.
  • And some new issues are not well understood. Fewer than half of Canadians report some awareness of radio frequency identification (RFID tags) or automotive "black boxes" (Motor Vehicle Event Data Recorders).
• While Canadians are divided over whether the consequences of new technology on the protection of personal information are "overblown", they agree on the high importance of being informed on the privacy implications of the products and services they buy.

Canadians Want Control of their Personal Information

• But Canadians want more than just to be informed; they want to take ownership of their personal information. When technology is installed in a product that may allow others to keep track of how they use it, most Canadians want the option to turn the tracking technology off or disable it.
• Canadians are worried about losing control of their personal information. As a result, they are becoming more concerned about their privacy rights and are becoming more engaged in the protection of their own personal information. Canadians believe they should be notified of information collection, use and disclosure. But they do not believe that notification should be a substitute for consent.
• In the absence of sound information about privacy laws and rights, many Canadians are inclined to assume the worst. They question the efficacy of privacy laws and the commitment of business and government to protect their personal information. This represents a significant challenge to both the private and public sectors.

Broad Attitudes

I feel I have less protection of my personal information in my daily life than I did ten years ago.

Mar. 05

Mar. 06

Protecting the personal information of Canadians will be one of the most important issues facing our country in the next ten years.

Aug. 01

Mar. 05

Mar. 06

 DK/NR    Disagree (1-3)    Neither (4)    Agree (5-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Broad attitudes: health information

There are few types of personal information that are more important for privacy laws to protect than personal health information.

Aug. 01

Mar. 06

 DK/NR    Disagree (1-3)    Neither (4)    Agree (5-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Privacy Laws

Importance of privacy laws

How important is it to you personally to have strong laws to protect Canadians' personal information?

Mar. 05

Mar. 06

 Low importance (1-2)    Moderate importance (3-5)    High importance (6-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Responsibility to protect citizen/consumer information

In your opinion, how seriously does the federal government take its responsibility to protect citizen personal information?

Mar. 06

And on the same scale, how seriously do businesses take their responsibility to protect consumer personal information?

Mar. 06

 DK/NR    Not seriously (1-3)    Fairly seriously (4)    Very seriously (5-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Perceptions of privacy laws

Compared to ten years ago, it is more important that Canadian privacy laws are updated regularly to ensure they are keeping up with new technologies that may impact personal information.

Mar. 05

Mar. 06

When it comes to privacy laws, I think that governments have a good understanding of how companies use personal information on Canadians today.

Mar. 05

Mar. 06

 DK/NR    Disagree (1-3)    Neither (4)    Agree (5-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Awareness of privacy laws

Q: Are you aware of any laws that help Canadians deal with privacy and the protection of personal information?

Mar. 05    Mar. 06
	Yes, clearly	Yes, vaguely	No

(BASE: All Canadians; Mar. 06, n=1,020)

Laws Canadians are aware of

Q: Which laws are you aware of?

 Mar. 05    Mar. 06

The Privacy Act
PIPEDA
Freedom of Information Act
Personal Health information Protection Act
Charter of Rights
Other
Unable to name law/no response

(BASE: Those report "vague" to "clear" awareness of privacy laws; Mar. 06, n=445)

Awareness of federal privacy institutions

Q: And are you aware of any federal institutions that help Canadians deal with privacy and the protection of personal information from inappropriate collection, use and disclosure?

Mar. 05    Mar. 06
	Yes, clearly	Yes, vaguely	No

(BASE: All Canadians; Mar. 06, n=1,020)

Federal Institutions Canadians are aware of

Q: Which federal institutions are you aware of?

 Mar. 05    Mar. 06

Privacy Commissioner
Justice agencies
Law enforcement
Canada Revenue Agency
Consumer protection agencies
Human Rights Commissioner
Government Ombudsman
Other
DK/NR

(BASE: Those report "vague" to "clear" awareness of privacy laws; Mar. 06, n=220)

Perceived need to modernize Privacy Act

Q: The Privacy Act requires federal government departments and agencies to respect privacy rights by limiting the collection, use and disclosure of personal information. The Act also gives individuals the right to access and request correction of personal information about themselves held by these federal government organizations. The Act has not been substantially updated since coming into effect in 1983.

To what extent do you believe there is a need to modernize the Privacy Act to ensure the Act is keeping pace with new technology and is providing appropriate checks and balances to government use of personal information?

	Low extent (1-2)	Moderate extent (3-5)	High extent (6-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Level of priority attributed to modernizing the Privacy Act

Q: What priority should the federal government place on modernizing the Privacy Act?

	Low priority (1-2)	Moderate priority (3-5)	High priority (6-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Understanding of privacy rights

Q: How would you rate your knowledge of your privacy rights under the various laws protecting your personal information?

 Apr. 01    Mar. 05    Mar. 06

Very good
Good
Neither good nor bad
Poor
Very poor
DK/NR

(BASE: All Canadians; Mar. 06, n=1,020)

Protecting privacy rights

Q: In your day to day life, how good of a job would you say you are doing to protect the privacy of your own personal information?

Very good
Good
Neither good nor bad
Poor
Very poor

(BASE: All Canadians; Mar. 06, n=503)

Transfer of personal information

Extent of transfer of personal information

Q: To what extent do ...

Canadian companies transfer personal information on customers to companies in other countries?

Mar. 05

Mar. 06

 DK/NR    Low extent (1-2)    Moderate extent (3-5)    High extent (6-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Extent of transfer of personal information (b)

Q: To what extent do ...

Canadian government agencies transfer personal information on citizens by outsourcing work to companies in the United States who conduct business on the government's behalf?*

Mar. 05

Mar. 06

Canadian government agencies transfer citizen personal information to foreign governments in order to protect national security?*

Mar. 05

Mar. 06

 

 DK/NR    Low extent (1-2)    Moderate extent (3-5)    High extent (6-7)

(BASE: All Canadians; Mar. 06, n=1,020, *½ sample)

Concern regarding transfer of personal information

Q: How concerned would you be if...

Canadian companies transfer personal information on customers to companies in other countries?

Mar. 05

Mar. 06

 Low concern (1-2)    Moderate concern (3-5)    High concern (6-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Concern regarding transfer of personal information (b)

Q: How concerned would you be if...

Canadian government agencies transfer personal information on citizens by outsourcing work to companies in the United States who conduct business on the government's behalf?*

Mar. 05

Mar. 06

Canadian government agencies transfer citizen personal information to foreign governments in order to protect national security?*

Mar. 05

Mar. 06

 Low concern (1-2)    Moderate concern (3-5)    High concern (6-7)

(BASE: All Canadians; Mar. 06, n=1,020, *½ sample)

Importance of notification of transfer

Q: How important would it be to you personally to know ...

Canadian companies transfer personal information on customers to
companies in other countries?

Mar. 05

Mar. 06

 Low importance (1-2)    Moderate importance (3-5)    High importance (6-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Importance of notification of transfer (b)

Q: How important would it be to you personally to know ...

Canadian government agencies transfer personal information on citizens by outsourcing work to companies in the United States who conduct business on the government's behalf?*

Mar. 05

Mar. 06

Canadian government agencies transfer citizen personal information to foreign governments in order to protect national security?*

Mar. 05

Mar. 06

 Low importance (1-2)    Moderate importance (3-5)    High importance (6-7)

(BASE: All Canadians; Mar. 06, n=1,020, *½ sample)

Importance of consent before transfer

How important is it that an individual's consent be required before a company can transfer personal information on customers to a company in another country?

Mar. 05

Mar. 06

 Low importance (1-2)    Moderate importance (3-5)    High importance (6-7)

(BASE: All Canadians; Mar. 06, n=516)

Awareness of the USA PATRIOT Act and related privacy issues

Q: Some people have raised concerns that the US Patriot Act enables the American government to access the personal information of Canadians citizens, without their knowledge or consent, if this information is being held by a US company. Before this survey, have you ever read or heard anything about the concerns about the USA PATRIOT Act?

 Yes, definitely    Yes, maybe    No

(BASE: All Canadians; Mar. 06, n=1,020)

Level of personal concern about the USA PATRIOT Act

Q: How concerned are you about the USA PATRIOT Act?

	Low concern (1-2)	Moderate concern (3-5)	High concern (6-7)

(BASE: Those report "vague" to "clear" awareness of USA PATRIOT Act and related privacy issues; Mar. 06, n=390)

Technology and Personal Information

Know enough to protect information online

I feel confident that I have enough information to know how new technologies might affect my personal privacy.

Sep. / Oct. 00

Jun. 01

Oct. / Nov. 01

Apr. / May 03

Mar. 05

Mar. 06

 DK/NR    Disagree (1-3)    Neither (4)    Agree (5-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Awareness of RFID

Q: Radio frequency identification or RFID tags use wireless technology and are designed to allow things to be tracked and monitored. When installed in products, they allow companies to keep track of products in warehouses and retail stores. Before this survey, have you ever read or heard about radio frequency identification tags?

 Yes, definitely    Yes, maybe    No

(BASE: All Canadians; Mar. 06, n=500)

Awareness of automotive black boxes

Q: Some car makers now install automotive black boxes or Motor Vehicle Event Data Recorders that keep track of and store driving information, such as speed, braking and seat belt usage. Before this survey, have you ever read or heard about these type of black boxes that are being installed in some cars?

 Yes, definitely    Yes, maybe    No

(BASE: All Canadians; Mar. 06, n=521)

Consequences of technology and willingness to allow tracking

I think the claims about the negative consequences of technology on the protection of personal information are overblown.*

Mar. 05

Mar. 06

I would be willing to allow a company to track how I shop in order to receive a discount on products or services I buy.

Mar. 05

Mar. 06

 DK/NR    Disagree (1-3)    Neither (4)    Agree (5-7)

(BASE: All Canadians; Mar. 06, n=1,020, *½ sample )

Privacy implication of consumer products

I should be informed by companies about the potential privacy risks associated with the products or services I buy.

Mar. 05

Mar. 06

 Disagree (1-3)    Neither (4)    Agree (5-7)

(BASE: All Canadians; Mar. 06, n=1,020)

Privacy implication of consumer products (b)

I should be informed if a product, like a car I have bought or rented, has features installed that could allow others to keep track of when and how I use it.*

Mar. 06

If I buy a product, like a car or truck, I should have the option to turn off or disable features that could allow others to keep track of when and how I use it.*

Mar. 06

 Disagree (1-3)    Neither (4)    Agree (5-7)

(BASE: All Canadians; Mar. 06, n=1,020, *½ sample)

Appendice

Research Methodology

• The findings in this report are based on a 12 minute telephone survey with a national random sample of 1,020 Canadians, aged 16 and over:
  • The questionnaire was pre-tested on March 21st, 2006, leading to some small revisions in the questionnaire.
  • The survey was conducted between March 22nd and 29th, 2006.
  • Results of the survey are weighted by age, gender and region to ensure they are representative of the Canadian public.
  • The margin of error is +/- 3.1 % points, 19 times out of 20.