The Unique Challenges to Privacy Rights Posed by the Internet and Other Emerging Technologies

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Remarks at the Internet Law Conference
The Second Wave: New Developments, Challenges and Strategies

Toronto, Ontario
March 27-28, 2008

Address by Lisa Madelon Campbell and Daniel Caron
Legal Services, Policy and Parliamentary Affairs Branch

(CHECK AGAINST DELIVERY)


Introduction

In a short articled entitled “Privacy Law, the Web” written in September 2006, Ben Spaulding stated that privacy on the web seemed analogous to ice cubes in hot chocolate – the one simply dissolves the other.

Do privacy and the Internet exist in a zero sum relationship?  Do advances in Internet technology necessarily equate to the eventual loss of privacy on the Internet?  The analogy of privacy to an ice cube in hot chocolate is interesting in that it shows just how the Internet has created a number of interesting challenges in the context of protecting privacy rights in Canada and elsewhere. 

For Canadians, privacy and the protection of personal information is an important value that entails more than what Justice Louis D. Brandeis termed “the right to be let alone” – it includes the notion that individuals should control how their personal information is used, collected and disclosed.  The right to go about our daily lives anonymously is also a fundamental aspect of privacy rights in Canada.  In fact, privacy rights in Canada enjoy elevated status; Canadian courts have had no hesitation in classifying the Personal Information Protection and Electronic Documents Act (“PIPEDA”) as a fundamental law of Canada, just as the Supreme Court of Canada ruled that the Privacy Act enjoyed quasi-constitutional status.  Whenever we identify ourselves to other individuals, organizations, businesses or government institutions, we unfortunately run the risk that our personal information may be misused in a way that has profound implications for not only ourselves or our careers, but our families, friends or respective work organizations.

The personal information of individuals has, in part due to the advent of the Internet, become an increasingly valuable asset.  Some sources have even been able to determine the value of personal information stolen from individuals.  A Security Threat Report from Symantec published in March 2007 attempting to monitor the clandestine online trade in stolen confidential and personal information found that the price for stolen U.S.-based credit card data (with verification number) ranged from $1 to $6 each, while the information needed to take over a complete identify (social security number, U.S. bank account, credit card, date of birth, government ID number, etc.) was for sale at prices ranging from $14 to $18.

An entire industry of data brokering has been created online that specialize in the compiling, analysis, and selling of personal information to individuals and organizations.  According to the Canadian Marketing Association, Canada’s marketing community supports over 480,000 jobs and generates more than $51 billion in overall annual sales through various marketing channels. Much of this economic activity involves the analysis, use and sharing of consumer information.  Other businesses collect personal information to personalize services, trace customer behavior and identify potential marketing opportunities.  Government institutions seek to contain personal information from individuals for a variety of purposes, including law enforcement and security.

It is clear that the Internet has posed some interesting challenges to privacy rights in Canada and abroad.  One particular challenge is with respect to Internet jurisdiction.  In the context of the protection of privacy, different jurisdictions hold philosophies to privacy and have put into place different approaches; which approach and philosophy will prevail in an online world that effectively knows no bounds?  The Internet is also forcing us to think differently, as things we might not have even dreamed possible 15 years ago have become an entrenched part of our reality.  Events that take place in new virtual worlds in which individuals can create “avatars” and purchase virtual goods with “Linden Dollars” can sometimes have real world consequences.  Can and should these virtual acts be regulated?  As well, the explosion of the social networking phenomena has created particularly interesting challenges for individuals who want to do the “in thing” and be technologically up to date, yet, do not want that one questionable picture of that one questionable act posted by friends on a website to catch up with them someday…

Other advances in technology are forever changing our traditional conception of privacy, and are distorting the distinction between what we consider to be private and public spaces.  Such advancements include the collection and use of biometric information, the deployment of geo-immersive technologies and developments in nanotechnology.

Theses challenges and developments are discussed below.

1. Jurisdictional Challenges

The Internet evolved as a medium for conducting businesses in the late 1990s.  During this period, businesses began realizing the potential importance, if not necessity, of operating online.  However, they also realized that there were certain inherent and unique legal risks in selling products online or even in maintaining an information-oriented website.   Such legal risks are unique in that the Internet is ubiquitous and knows no boundaries; if you are connected to the Internet, you can effectively access websites posted from all over the world. 

While the Internet has been remarkably effective in bringing different countries, markets and cultures together, it has also created a number of legal jurisdictional uncertainties: (i) which country can have jurisdiction over a certain legal dispute that may arise out of the Internet; (ii) which set of substantive legal rules will be applied to a dispute arising from the Internet; and (iii) whether one country’s legal ruling regarding a dispute on the Internet will be applied in another.

Notwithstanding the evolution of jurisprudence regarding Internet jurisdiction, determining jurisdiction for disputes or issues arising out of the use of the Internet is far from settled.  In fact, domestic legal rules are being applied to determine jurisdiction.  Accordingly, the same problems that arise out of applying private international law tests outside the Internet context persist.

In a paper on Internet jurisdiction, Professor Michael Geist of the University of Ottawa noted that there are several consequences that flow from such jurisdictional uncertainties.  First, they pose financial, and intangible, risks to businesses who aim to limit their legal liabilities.  Second, they can limit or undermine the effectiveness of local laws aimed at protecting consumers where a consumer does not have recourse to their local courts or if they need to initiate a further proceeding in order to enforce a foreign judgment. 

From a privacy standpoint, there is also the potential application of different privacy laws to privacy intrusive conduct online.   As a result, individuals may have, in one case, a right to privacy defined one way by one country’s court, and another, perhaps more limited manner, by another country’s court.  How can Canadians, who have a more liberal conception of privacy, have their right to privacy respected as they understand it by an organization in a country with a different conception of privacy?  Another practical consequence that flows from this piecemeal is that it leads organizations to “forum hop” in determining where to launch potentially privacy-invasive technology.  In such cases, organizations launch privacy-invasive technology in jurisdictions with a more relaxed approach to privacy, wait for their product to take a stronghold, and then slowly introduce it in jurisdictions with greater privacy protections.

Organizations can also use the ubiquitous nature of the Internet to collect, use or disclose the personal information of citizens of different countries.  In 2005, an individual complained to our Office that an online data broker situated in the United States had collected and used personal information of Canadians without their consent.  Although we initially declined jurisdiction to investigate the complaint under PIPEDA, the Federal Court of Canada ruled that our Office did in fact have jurisdiction to investigate a foreign based data broker where that data broker had a real and substantial connection to Canada.  While this case certainly highlights the ability of foreign organizations to collect and sell personal information of individuals of other countries for commercial gain through the Internet, it is also a prime example of the jurisdictional certainties that surround the protection of privacy rights.

2. Real World Consequences of Virtual Worlds

At 5 a.m. on April 18, 2005, the Chief Executive Officer of the Ubiqua Seraph Corporation was ambushed and murdered by a double agent who was a member of an underground organization.  This underground group had been secretly planning the CEO’s murder, as well as a heist of the corporation’s assets, for well over a year.  Members of this underground operative had slowly infiltrated the higher echelons of the corporation over a span of twelve months, gained the trust of the corporate directors, and then, with careful and meticulous calculation, eliminated the CEO while she was on a flight and orchestrated the take-over of close to 30 billion dollars in assets.

Sound a bit too farfetched to be real?  Well, that’s because it isn’t “real”.  Ubiqua Seraph was a Corporation created by players on the MMORPG called Eve Online, the CEO was a virtual character created by one of the players, the flight the CEO was on was a Battleship-class Navy Apocalypse Battleship, and the 30 billion stolen were actually 30 Billion ISK, Eve Online’s currency, including assets such as Imperial ships and the contents of other vessels.  The contract killing and heist all took place in the context of a virtual world, a video game governed by virtual rules and ultimately governed by game administrators, so where’s the harm, right?

Well, what is especially interesting about this Eve Online episode are the real world consequences that flowed from it.  A significant number of players from the game spoke out against the virtual heist; some noted that the players who had built up the Corporation had worked very hard over long months, investing time and money to save up to buy the eventually apprehended corporate assets.  In fact it is estimated that the real world value of the goods stolen on the video game approached $170,000USD, making it quite possibly one of the biggest MMORPG scams in history.

Apart from being an almost Hollywood-like story of betrayal, the Eve Online episode highlights the real consequences of acts committed on virtual worlds, to the tune of $170,000.  The real issue is that the actions posed online had an impact in real world terms and all the real world money invested by those players who owned the Corporation in Eve Online was ultimately lost.  There are also a number of other examples were thieves have, through a variety of means, gained unauthorized access to virtual worlds and committed fraud for gain in the real world.

Games like Eve Online or online communities like Second Life differ from traditional videogames in that players aren’t interested in gaining points or Super Mario Coins; players spend real time and real money to complete tasks and undertake quests in order to gain virtual money, valuables and experience, which can be spent on other in-game valuables, which can then be traded for real money.  However, thieves can use a variety of means to gain access to such worlds in order steal virtual goods, and even launder real money.

While such virtual worlds can lead to a number of interesting philosophical debates as to the status of individuals in such worlds, there are also interesting challenges from a privacy standpoint.  First, a variety of means can be used to hack into a virtual realm and commit fraudulent activity.  Malicious users can use a variety of techniques, such as social engineering, exploiting game server vulnerabilities and using malware, in order to steal the personal information of individual players and gain access to games as that person’s character.  Once a thief enters the virtual world, he or she can then steal virtual goods and sell them on a real world auctions site, or even use the virtual world as a way to launder real world money: Real world money is used to purchase goods, and then such goods are subsequently sold for money that originates form a new source.

Second, to what extent do real world norms inform a world like Eve Online or Second Life?  Does the Criminal Code, or the Canadian Charter of Rights and Freedoms apply?  Considering that individuals can effectively run businesses for profit on Second Life, and therefore, engage in commercial activities, does a law like PIPEDA govern privacy within those worlds?  If I sell a virtual T-shirt in Second Life, do I need to have a virtual privacy officer, a virtual privacy policy?

These questions raise issues that we will have to actively turn our minds to and eventually answer, especially in light of the growing trend of individuals accessing such worlds, where there is a lack of any real consequence from real world laws.

3. Controlling our Reputations on the Internet

“Never before in the history of the planet have so many people - on their own - had the ability to find so much information about so many things and about so many other people”

— Thomas L. Friedman

Our reputations are important to us.  As individuals, whether we like it or not, what other people think about us affects us and can inform how others act towards us.  For corporations, a business’ reputation is essential, as a poor reputation can actually have financial consequences.  The speed with which information travels over the Internet, and the ease with which information can be posted with anonymity, can lead to potentially devastating consequences for our reputations online.  In fact, a whole industry has burgeoned that specializes in managing and repairing online reputations for individuals and businesses who have been victim of an online reputation attack.  Unintentional online profiles, the source of which is effectively impossible to trace, can contain a startling host of personal information that can be accessed by essentially anyone with an Internet connection.  Such information can then be accessed by data brokers, marketers, identity thieves or even government institutions, in order to piece together various parts of an individual’s profile.

As well, individuals can intentionally create virtual profiles and post their own information online.  Such intentional profiles can be posted on social networking sites such as Facebook and MySpace, with the idea that the individual posting his or her profile has control over the information posted, and presumably, control over the information posted.

What is particularly interesting about the sharing of personal information online is the paradoxical nature of how people perceive privacy online.  A study conducted by members of the Institute of Information Systems at Berlin’s Humboldt University in 2005 demonstrated that, although individuals state that they are privacy conscious and that they have certain privacy preferences for when they visit websites, their actual online behaviour is not always in line with such stated preferences.  In fact, given the right circumstances, individuals easily forget about their privacy concerns and communicate the most personal of details, particularly where the online exchange is entertaining or where appropriate benefits are offered in return for the sharing of personal information. 

Conversely, people who post personal information on websites where such information is intentionally shared with others are nonetheless prepared to stand up for what they feel to be a violation of their privacy.  Let’s take the example of the reaction that followed that followed the introduction of the News Feed feature on Facebook in 2006 as an example.  As previously mentioned, Facebook users create personal profiles online that can be shared with friends (and unintentionally with other people).  Such online profiles may include what they are doing at that precise moment in time, where they were last night, or even new friends added.  In 2006, Facebook introduced a feature whereby users were instantly alerted whenever their friends added information or photos on their profile, including information about new friends added, or friends deleted.

In his book entitled “The Future of Reputation”, George Washington University law professor Daniel Solove recounted the outcry that resulted from the introduction of News Feed.  Within days of the feature being introduced, the number of protesters numbered close to 700,000.  What Solove finds interesting about the News Feed episode, however, is that it did not involve the exposure of any new information; users were in uproar over the sharing of information that they had themselves put on their profiles.  As such, all News Feed did was to make already existing information more easily assessable.  So why the seemingly paradoxical reaction?

Solove argues that it shows that Facebook users are not altogether aloof of the privacy dangers of the Internet and that such users see privacy as involving degrees.  The News Feed shows that, users who are willing to post personal information on a social networking website that raises certain privacy concerns are nonetheless aware of their privacy rights on the Internet.  It also shows that such users apply their own norms with respect to how their personal information can be made available to others.

Although the way in which Internet users view their online privacy, and how they act in consequence, may not always coincide, it is clear that the Internet will continue to pose unique challenges to online reputation. 

4. The collection and use of biometric information

Governments and private industry worldwide increasingly collect and use of biometric measurements to identify individuals and trace their whereabouts and movements.  

Biometrics is the identification of living human beings through behavioral or physiological properties.  As such, biometrics is effectively the oldest form of identification.  As Bruce Schneier has noted:

“Dogs have distinctive barks. Cats spray. Humans recognize faces. On the telephone, your voice identifies you. Your signature identifies you as the person who signed a contract”.

Biometrics involves taking or recording some of an individual’s most inalienable biological or physical attributes and using these to identify him or her.  If we conceptualize the notion of privacy on a continuum with the inviolability of the physical space in which we live and travel at one end, then at the other end would fall the inviolability of the self. 

Despite the fact that the use of biometrics to identity individuals is more ancient than we might think, new advances in technology have allowed for a number of sophisticated uses of biometrics in order to identity and verify individuals. Examples of such advances include photographs, facial recognition technology, iris scans, and of course, the ultimate biometric, DNA.  As well, the ways organizations are using biometrics has evolved, from regulating access to buildings and information to placing biometric identifiers in passports, driver's licenses, and other identification cards.

As mentioned above, the worldwide market in personal information is growing exponentially, and it is becoming increasingly important to accurately identify individuals for a variety of reasons.  As biometrics continues to play an ever-increasing role in identifying individuals, it evidently raises a number issues from a privacy perspective.  The use of biometric technologies has incited fears of constant supervision, the loss of individuality, privacy and freedom and uneasiness in having one’s bodily data digitally stored in large databases along with sensitive personal information.  How can we control the collection, uses and disclosure of biometric information, as well as access to the databases storing such information?

5. The deployment of geo-immersive technologies

Vast amounts of satellite and aerial imagery of major centers have been available on the internet for some time.  Imagery is available from government agencies including the Weather Office of Environment Canada and the US National Oceanic and Atmospheric Administration, as well as from commercial enterprises such as TerraServer, located in the US, and the Spot Image Group, which is headquartered in France.  These organizations specialize in the acquisition, processing and distribution (either free or as a paid service) of satellite imagery.

Other organizations have also been making use of satellite imagery, usually by combining maps with public information available online.  Notable examples include Google Earth and MSN Virtual Earth.  For the most part, the imagery contained in these applications consists of overhead imagery taken directly above the site being imaged and is of moderate resolution.  The highest resolution currently available commercially is on the order of 60 cm, that is to say, objects as small as 60 cm - or just shy of 2 feet in diameter - can be discerned.  Although these satellite images clearly show the presence of people, it is nearly impossible to identify any of these individuals.  

However, recent developments in 3D mapping technology have changed the dynamic.  A number of potential uses have been put forward for 3D mapping technology, including urban and land-use planning, environmental research and resource management, situational awareness for crisis management and response planning, location scouting and site visits, real estate development, and travel and tourism.  Some of the images contained in 3D mapping technology, however, appear to have been captured largely without the consent and knowledge of individuals who appear in the images, or whose property appears in the images.  Many of the images available on Google’s Street View application, which is yet to be launched in Canada, are of sufficient resolution and close enough to allow individuals to be identified, to discern what activities they are engaged in and to situate their geographic whereabouts.

As well, the use of geospatial information has allowed for even broader applications for mapping technology.  Geospatial information provides characteristics (e.g. buildings, roads, demographics, water, soil, weather, topography, wildlife habitat, etc.) regarding a geographic location.  This information varies in scale from street, local or regional to provincial, national or even global.  Examples of technologies which harness geospatial information are Global Positioning Systems (GPS), Geographic Information Systems (GIS) and remote sensing (satellite and aerial imagery).  Geospatial information is the core component of the field of geomatics, which is the collecting, managing, analyzing and integrating of geospatial data.  While geospatial information may begin as discrete images or street maps, geomatics helps combine this information with a variety of aggregate data such as census data, crime statistics, traffic data and consumer spending information in order to produce an end result which includes the sophisticated layering of varied sets of data, all within a geographic context.

Much geospatial information may appear, on its face, to be completely innocuous from a privacy perspective.  Individual pieces of geospatial information may not allow for the identification of individuals.  However, when that same geospatial data is combined with other information, it may become possible to identify individuals.  This raises a number of complex questions regarding the point at which geospatial information becomes personal information for the purpose of privacy legislation. 

6. Developments in nanotechnology    

“The principles of physics, as far as I can see, do not speak against the possibility of maneuvering things atom by atom. It is not an attempt to violate any laws [of physics]; it is something, in principle, that can be done; but in practice, it has not been done because we are too big.”

— Richard Feynman, Nobel Prize winner in physics

Nanotechnology exists at the atomic scale, and it’s been described as the ability to observe and engineer matter within the general size range of 1 to 100 nanometers.  To give you a sense of the size we’re dealing with, a nanometer is one billionth of a meter, roughly the width of three or four atoms - the average human hair is about 25,000 nanometers wide.  Nanomaterials are built on the scale of molecules or even atoms, and on a scale that is a fraction of living cells. 

Nanotechnology is creating a set of materials that have properties that differ in fundamental ways from those larger forms of the materials, and that make them useful for a variety of applications.  Over the past 25 years, we’ve seen two waves of technology infrastructure development. The first wave began in the 1980s, when computing power was decentralized from mainframes to PCs. In the 1990s, we added widespread access to the Internet, as well as communications capabilities, including e-mail, instant messaging, various online communication and collaboration tools, and high-speed connectivity.  In the spirit of Moore’s Law, while computing has evolved tremendously in the past twenty-five years, we’re reaching the physical limits of the traditional semi-conductor chip.  Molecular electronics, or computing on a cellular scale, will be the next paradigm.

Nanotechnology applications will increase the performance of electronic memory and embedded intelligence systems at greatly reduced costs. To put this in perspective, in 2003 scientists in Israel created a molecular computing machine that could be programmed that was 100,000 times faster than current PCs.

Tiny smart sensors will increasingly be embedded in everyday objects and places, forming the basis for a sensory infrastructure. As computing and processing move off the desktop into everyday thing, and as sensor networks become widespread, every object, every movement and every interaction online become pieces of data to be endlessly communicated, stored, mined and analyzed on countless levels.  Lest this sounds fantastical, the worldwide annual industrial production in the nanotechnology sectors is estimated to exceed $1 trillion in 10 to 15 years from now, which would require about 2 million nanotechnology workers.

Researchers at the University of Alberta are working to replace today’s “bulky” micron-sized transistor chips with nano-sized components—chips too small to see—that could turn cell phones, computers, or medical equipment into the smallest, most advanced, multitasking technology imaginable.  With more research on the horizon, nanotechnology is revealing its almost-infinite possibilities.

This reduced size and computing capacity also has implications for the ways in which computers are used.  The devices that are used to access the worldwide web are becoming increasingly smaller and differentiated, such that they will soon be able to be incorporated, in a subtle and unobtrusive way, into the environment in which we live.  As such, developments in nanotechnology may both facilitate surveillance and increase the power to process information obtained through surveillance.  The evolution of pervasive computing, with various information networks connected to many – and possibly invisible – sensors, suggests that traditional notions of privacy and private and public spaces may need to be re-defined.

Conclusion

“The times, they are a-changin'…

— Bob Dylan

Jurisdictional issues, virtual worlds, online reputation, biometric technologies, geo-immersive technologies, nanotechnology; these are but some of the new challenges and developments to protecting privacy rights in fast changing times.  Thanks to advances in technology, the type of information being collected about us is increasingly personal in nature and can be stored in ever-increasing databases.  Such information is often biological in nature, and is an inalienable part of us.  Such information, mashed or combined with other information available on the Internet, tells the world a great deal about us.

While legislative tools such as PIPEDA impose obligations on organizations (at least in Canada) to take appropriate measures in protecting personal information, such legal instruments are not all-encompassing. While PIPEDA and other privacy legislation certainly provide incentive for organizations to protect personal information, they may also be invaluable in helping to shape how people view privacy in Canada.   In short, legal rules can eventually have profound effects on behavioural norms.

Behavioural norms are an important part of protecting privacy rights in Canada.  In “The Future of Reputation”, Daniel Solove notes that:

“…the law’s function…is to ensure that people know that they must respect confidentiality or the privacy even of people in the public.  In the foreground, however, norms wil

Report a problem or mistake on this page
Please select all that apply (required): Error 1: This field is required.

Note

Date modified: