The New Era of Privacy Protection
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Treasury Management Association of Canada
19th Annual Finance and Treasury Management Conference
October 1, 2001
Privacy Commissioner of Canada
(Check Against Delivery)
As treasury professionals, you are key decision-makers in business. You have a keen interest in the issues that touch our society. And you are among the opinion leaders in your various communities.
It is in that context that I'm especially pleased to talk with you today, at a particularly important moment for our Canadian society.
I guess I had a certain prescience when I told your organization, quite some time ago, that I wanted my topic to be "The New Era of Privacy Protection." But I must admit that it was quite accidental.
At the time, I wanted to talk about the momentous step forward-for individuals and for businesses-that Canada has taken with the implementation of our new private sector privacy legislation, the Personal Information Protection and Electronic Documents Act. I will still touch on that, at least briefly.
But now, since the tragic events of September 11, we're in a new era of privacy protection for very different-but even more crucial-reasons. The challenge now for me as Privacy Commissioner, and indeed for all Canadians, is to ensure that the fundamental human right, and fundamental Canadian value, of privacy does not fall victim to a climate of fear and uncertainty that may well intensify as events unfold in the weeks and months ahead.
I'm confident that this ultimately won't happen, because I believe that an informed Canadian public will not want it or allow it. But to ensure that it doesn't happen we must all be very clearly aware of what is at stake and what the real considerations are.
Privacy, as I have said, is a fundamental human right, recognized as such by the United Nations. But it is not only an individual right-it's also a shared value, a social, public good. In the words of Justice Laforest of the Supreme Court of Canada, privacy is "at the heart of liberty in a modern state."
That's because there can be no real freedom without privacy. If at any given moment someone-and particularly agents of the state-may be metaphorically or quite literally looking over our shoulder, we are not truly free.
If we have to weigh every action, every statement, every human contact, wondering who might find out about it, make a record of it, judge it, misconstrue or somehow use it to our detriment, we are not truly free.
Many have suggested, in fact, that privacy is the right from which all others flow-freedom of speech, freedom of association, freedom of choice, any freedom you can name.
That's why lack of real privacy is a distinguishing characteristic of so many totalitarian societies. And it's why our society as a whole has a stake in the preservation of privacy. We cannot continue to have a free, open and democratic society unless the right to privacy is respected-it's as simple as that.
In recognition of this, our Parliament two decades ago created the position of Privacy Commissioner of Canada-an independent officer of Parliament whose responsibility is not only to oversee Canadian privacy law, but also to serve as the champion of the privacy rights of all Canadians.
For the first year of my term, this has been a very gratifying job. At a time when the importance of privacy in our lives was increasingly being recognized-in fact, I believe that privacy will be the defining issue of this new decade-I have been telling people how legal protections for privacy rights are being enhanced. And I've been emphasizing to business audiences like this one why good privacy is good business.
So it's been a good news message, telling people what they are generally glad to hear. That message still holds true. But in the atmosphere that has been developing since September 11, the vital importance of privacy may perhaps be a little less self-evident. That may make hearing about it a little less welcome-but it makes it infinitely more important.
Let me be very clear, right from the outset.
I am not here to argue that privacy is an absolute right-or even that there may not be a need for some new privacy-invasive measures to meet the kinds of security threats that we're now facing.
As Privacy Commissioner and an Officer of Parliament, I have absolutely no intention of being an obstacle to protecting the public. But equally, I have absolutely no intention of being a rubber stamp or a gateway for privacy-invasive measures that would not be demonstrably necessary.
Here's the challenge: When people are frightened for their safety, when we've seen the horrors of which these terrorists are capable-and there may be more-it's easy to fall into the trap of thinking that privacy is a luxury.
It's easy to start saying that security is all that matters right now, that privacy and other freedoms are frills that we just can't afford. Of course it's easy, it's human nature-the primal instinct for self-preservation that kicks in when we're afraid. But the instinctive, unreasoned response isn't always the right one.
Privacy and the other cherished freedoms and values that define Canadian society are not frills or luxuries in this situation. They are what this situation is all about.
Terrorism is not an action; it is an effect. The essence of terrorism is the impact it is intended to have on those who witness it-the capacity to frighten, to demoralize, to sap the will of a society to resist whatever it is that the terrorists want.
Usually, that's something fairly specific-independence for a particular area, or installation of a particular government. But by all accounts, the goals of the terrorist campaign now underway are much broader and more diffuse-it is the whole nature of American society, and by extension of all our Western societies, that they seek to attack and undermine. Our freedoms and values, very much including privacy, is precisely the target.
Far from making us safer, every ill-considered reduction of those freedoms-every needless encroachment on privacy-would be a victory for terrorism, a proof of effectiveness in disrupting our society that could only encourage further outrages.
The attacks of September 11 broke great taboos. They assaulted the very concept of civilization, of civilized behavior, as our societies know it. There's no question that they tore a hole in the fabric of all our Western societies.
Our challenge is to urgently mend that hole and reinforce the fabric, by reaffirming with all the more vigor and clarity the rights, freedoms and values that are the very definition of Canada.
The good news is that I believe our government understands this. I am very encouraged by the Prime Minister's statements that he will not allow Canadian values to be sacrificed.
The bad news is that the climate could very easily change, if we're not careful.
Hardly a day goes by, for instance, that I don't get a call from the news media, asking me to comment on the growing demand for new privacy-invasive measures to protect the public.
But when I ask who exactly in Canada is demanding this, it usually turns out to be the media themselves. It's not difficult for reporters to phone around and find someone-an unnamed police source here, an academic there or, not surprisingly, a manufacturer of privacy-invasive technologies-who will say that, yes indeed, we're going to need all kinds of new privacy-invasive measures.
The danger, of course, is that this kind of thing can become a self-fulfilling prophecy. The best defence against it is an aware public that can look at these suggestions from an informed perspective and make reasoned judgments.
I can tell you that so far, no one in authority-whether in government or in law enforcement-has contacted me and indicated that there is a perceived need for any major new privacy-invasive initiatives. And I certainly expect that they would contact me if any such initiatives were contemplated.
That's why my position exists: one of its key functions is to advise government on any courses of action that might have privacy implications. And the best way to ensure that privacy rights are appropriately respected in any initiative-whether governmental or private sector-is always to build privacy considerations right into the planning stage.
Perhaps it will be necessary to accept some new intrusive measures to enhance security. But these choices must be made calmly, carefully and case by case.
Each such measure should be accepted only if it is demonstrably and clearly necessary to address a specific problem, and only if it is clear that no less privacy-invasive measure could satisfactorily achieve the same result.
Even then, we must be careful to differentiate what might be appropriate as a short-term emergency measure, from what is justifiable as a lasting change. If something is demonstrably necessary and appropriate but only as an emergency measure, it should come with sunset provisions.
In applying these tests to any proposed measures that affect privacy, we need to distinguish, first of all, between what would make people appreciably safer, and what would only make them feel safer.
We all want to feel less vulnerable. But I don't think the objective of making people feel safe is a good basis for public policy, particularly where fundamental human rights are involved. The first test of any proposed measure has to be demonstrable need and effectiveness.
And even then, it's not enough just to say that some measure would increase security. We have to very carefully look at proportionality.
We'd no doubt be somewhat safer from terrorist attack if we permanently evacuated all our highrises, closed down the subways, ended all large public gatherings including sports and entertainment events. But no one would seriously suggest that, because it's far too big a price to pay. We'd be safer-though not entirely safe-but at the price of throwing away our way of life as we know it. It's an unthinkable response to a finite band of criminals.
The same kind of thinking needs to apply to any proposed new restriction of a fundamental human right such as privacy. Maybe we'd be safer-and that's a big "maybe"-but at what price? History-including our own country's internment of Japanese Canadians in World War Two-should teach us what can happen when people let fear make them lose sight of proportionality.
We also need to distinguish between different kinds of infringement on privacy, and their relative severity.
For instance, very carefully searching our luggage and scanning for weapons doesn't strike me as being more than minimally privacy invasive. If there's even a marginal improvement in our safety as a result, go for it.
When someone searches your luggage, or even your person, and finds nothing, you go about your business. You might have been delayed and inconvenienced, but that's the end of it.
There's no record. You go back to being your own person, not a suspect.
That's very different from having your identity and activities routinely recorded, sorted and stored in a database-where the information may be stored forever, where you have no control over what's done with it or who has access to it. Then you've entered the realm that used to be reserved for people who had earned the attention of the authorities-and that's maximally privacy invasive.
Necessity, effectiveness, proportionality, severity-these are the sort of tests I believe that we, as a society, should apply to any proposed new measure that would limit the privacy rights of Canadians.
And the burden of proof-the responsibility for making a reasoned, persuasive case-should rest on those who put forward the proposal.
I must say that the kinds of suggestions I've been seeing so far in the media don't seem very impressive to me, until and unless someone makes the case for them.
Some people are saying, for instance, that we should all have to carry national ID cards. But how, exactly, would that help against terrorism?
Any terrorists who have established themselves here over time would probably be able to get such an ID card and show it on demand, though it wouldn't identify their occupation as "terrorist." Landed immigrants are already getting cards to replace the paper documents they have to carry now. And tourists and other visitors, of course, wouldn't have such a card.
So how would it make us any safer? It seems more likely to me that we would have lost the very important privacy right of anonymity, of not having to produce identification on demand as we go about our daily lives, without any appreciable gain in security.
Other people talk about putting video surveillance cameras all over our streets. That's often put forward as a measure against regular crime-and I'll be addressing that shortly in another setting-but how would it help against terrorism?
Even if there had been so many street surveillance cameras in New York City that the whole city was quite literally a TV studio, it would have done nothing to stop the terrorists from crashing airplanes into the World Trade Center.
And if we had a camera on every busy street corner in Canada, who would be monitoring all those screens? I doubt it would be highly-trained anti-terrorism experts. And what exactly would they be looking for? We already have security cameras at many government and other installations that are at particular risk, and perhaps we need more.
But anyone who wants to spread anti-terrorist cameras beyond specific locations that are demonstrably in need of special security, would have to make the case why it wouldn't gravely violate privacy without making us proportionately safer.
In general, I think we have to be careful not to convince ourselves that we'd be safer if there was a lot more wholesale, indiscriminate gathering of information about everyone. In fact, I think we'd probably be a lot less safe.
Who would sift through all that additional information? Imagine the resources it would take.
The most likely result of a personal information glut would be to shift resources and attention away from the more targeted activities that are the only effective approach to terrorism. We'd only be creating a thicker forest of information in which the terrorists could hide.
I believe we've got to distinguish between information and intelligence. More information isn't likely to accomplish anything except violating people's privacy. Intelligence-directed, suspicion-based contacts, inquiries and searches-is a very different matter.
What we need, to be safer from terrorism, is more and better intelligence, in both senses of the word. We need better enforcement of our existing laws.
We should have professionally qualified people doing security checks in airports, for example. We should ensure that our existing customs and immigration laws are fully and effectively enforced, at our borders and within the country.
We should make sure that anti-terrorist intelligence is quickly and efficiently shared among the appropriate authorities, and acted on. We should identify areas of particular vulnerability to terrorist attack, and take sensible precautions.
All of this, I want to emphasize, can be done within our existing Canadian privacy laws, which are flexible enough to permit all legitimate law enforcement activity while still safeguarding privacy.
We are in a very difficult time. And it is difficult times that test our commitment to the rights we hold dear, to the cherished values that define our Canadian nation.
Today, a part of this test is that we are called upon to recognize that the fundamental right to privacy is not a weakness, but a great and crucial strength, of our society.
We must not fail to meet that test, and I know that we will meet it.
Having said all this, I know that you were expecting to hear today about the new federal private sector privacy law, and how it will affect your various businesses.
I hope you agree with me that, in the exceptional circumstances we face, it was important to take this speaking opportunity-the first I've had since September 11-to talk about the broader situation instead.
But the speech you were expecting to hear, I've given many times since the start of the year. They're all up on our web site, at www.priv.gc.ca. I've also had occasion to meet with quite a number of industry associations to answer their questions, and some of you may have been present.
My Office has also published a business guide and a consumer guide to the new law. They're up on our web site as well, or you can contact my office and we'll send you as many copies as you need.
Thank you very much for your attention, and for this opportunity to meet with you.
- Date modified: