Rights and Justice in Online Social Networking Canadian Perspectives

Remarks at the consultation meeting to draft recommendations on protecting data and privacy, in particular for children and teens in social networks on the Internet

July 27, 2009
Montevideo, Uruguay

Address by Chantal Bernier
Assistant Privacy Commissioner of Canada

(Check against delivery)

Versión en español

---

The subject of this meeting, particularly the issue of young people’s privacy in online social networking, is both pertinent and urgent.

We are talking about protecting the most vulnerable individuals in our society from risks that we adults are just discovering.

Today, I want to speak about Canadian perspectives, especially those of the federal privacy protection authority, on protecting privacy in a social phenomenon that is now clearly inescapable.

I will deal with it in three parts:

• First, I want to describe our outlook on the general issue of online social networking.
• Second, I want to focus specifically on young people.
• Finally, I want to present some strategies to protect their privacy on the Internet.

So here is the general problem.

Based on Canadian experience, we have three main concerns, in general:

1. Gaps in knowledge of users, both adults and young people, of what confidentiality means and thus gaps in consent on this issue.
2. Storing too much personal information, as we saw in our investigation of Facebook, which I shall discuss in more detail shortly.
3. Inadequate protection from third parties accessing personal data; this is also one of the conclusions of our Facebook investigation.

These concerns are even greater when it comes to young people.

First, here is a demographic profile of Internet users in Canada.

Of the total Canadian population of 33 million, almost 12 million have a Facebook account.

Of these 12 million:

• 56 per cent are women (or girls),
• 1.9 million are between 13 and 18 years old,
• 3.3 million are between 18 and 24 years old.

In this demographic profile, we need to consider the geographic spread particular to Canada. It is so large that the Internet not only provides a social connection but also contributes to national cohesion.

Having seen the demographic profile, let us look at the legal picture.

Canada is a federation with shared jurisdiction between the federal government, for everything that is common or interprovincial, and the provinces and territories for more local matters.

The Canadian legal system for privacy protection includes:

1. Constitutional protection of the right to privacy,
2. A federal privacy protection law for the federal public sector,
3. A federal privacy protection law for the private sector that applies throughout Canada except where provinces have their own legislation in this field,
4. Provincial laws that apply to the provincial public sector and some that apply to the private sector,
5. Provisions of the Criminal Code.

In general, this is the legal framework of privacy protection in Canada and therefore the legal tool to protect young people’s privacy.

On this basis, our office investigates and conducts surveys on the protection of young people’s online privacy.

As part of this investigation, last winter we held focus groups or discussion groups with about 150 young people in various parts of Canada to discover trends and attitudes. Here is what we found:

1. Young people have an unfounded expectation of online privacy.
2. Young people place full responsibility for their privacy on the social networking companies.
3. Young people release their information very widely; for example, they may have up to 800 “friends” on Facebook.
4. Finally, young people are more or less aware of access to and use of their personal data by third parties, such as for marketing or employment purposes.

As part of our investigations, the Facebook investigation identified other concerns, relevant to young people’s privacy, since they represent a huge component of Facebook users.

In summary, here are some of our conclusions about Facebook:

• Some Facebook practices need to be better explained and justified, such as collecting birth dates, default settings, advertising and monitoring irregular behavior
• Finally, some practices must change:
  • Facebook must better protect users’ personal data from third-party access.
  • The distinction between deactivating and deleting accounts must be clearer.
  • Facebook must end its policy of keeping personal data from deactivated accounts.
  • Facebook’s policy of keeping personal data of deceased individuals for commemorative purposes must be explained better and subject to consent.
  • Finally, Facebook must assume more responsibility for protecting the personal data of non-users from collection and disclosure, for example, in user communications or through its “invitations” policy.

Our office continues to work on prevention and implementation of privacy laws.

Our prevention work includes:

• Public education to involve young people, their parents and the education system in privacy issues,
• Research to analyze social and technological trends relevant to privacy protection,
• Guidelines that may be found on our Web site.

Our work in implementing privacy laws includes:

• Investigations such as Facebook,
• Audits,
• Legislative proposals.

Specifically, we are studying legislative changes to protect young people’s online privacy.

We also believe in international cooperation to deal with a phenomenon that transcends borders. Our participating in this seminar illustrates our openness in this regard.

Thank you very much.