‘Rights, Responsibilities, Trust: Archives and Public Affairs’

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Association of Canadian Archivists Conference 2009

Elizabeth Denham
Assistant Privacy Commissioner of Canada

Calgary, AB
May 17, 2009

Introduction

Good morning, it is a pleasure to be a part of this panel today, and to contribute my perspectives alongside those of Jim and Amanda.

Of course, I’m always happy to accept a speaking engagement in my hometown, but I also have a deeply personal connection to your profession. I may be dating myself but I was one of the first graduates in the UBC Masters” of Archival Studies Program (class of 1984!)

The last time I addressed an ACA conference was, I believe, at the ACA/ICA conference in Montreal in the early 1990s. It is wonderful to see so many friends and colleagues in the room.

Before I get into my remarks, let me ask you this: Are any of you Twittering about this conference?

I ask because staff from our office recently attended a conference in Toronto where the very tech-savvy mayor, David Miller, was giving the keynote address. Since the conference was all about online networking, there was much Twittering, with people running in and out of sessions according to which were generating the most buzz at the time.

I mention this only in case you feel the urge to fire out some tweets that will attract more folks into this session!

Context

With Amanda describing for us the new social context created by the Web 2.0 world of Twitter and Flick’r, Facebook, YouTube and blogs, and Jim addressing some of the significant challenges for archivists in defining and preserving records in this new era, I intend to focus on:

  • The impact of new technologies on privacy
  • How our understanding and expectations of privacy is evolving in this digital era
  • And what we as individuals, businesses and regulators can and should be doing to strengthen privacy protections.

The challenges for privacy advocates and for archivists in the web-connected world are many - the scope and reach of digital media and a global audience - both communities need to figure out whether our tools and approaches will work in the 21st century. Do we risk becoming irrelevant to the public?

Privacy as an enduring value

In a widely quoted remark nine years ago, Scott McNealy, CEO of Sun Microsystems, announced that “Privacy is dead -- get over it.”

Which compels me to paraphrase Mark Twain in arguing that reports of privacy’s death are greatly exaggerated.

Without a doubt, privacy remains today a powerful value. In fact, an EKOS poll commissioned by our Office earlier this spring revealed that 62 percent of respondents agreed that “protecting the personal information of Canadians will be one of the most important issues facing our country in the next 10 years.”

What’s more, when asked how important they felt it was for Canada to have strong laws to protect personal information, 99 % of respondents said that these laws were important. So if it’s clear that people see privacy as a genuine value, why is protecting that privacy so difficult?

In part, it’s because technology keeps introducing new challenges. Just when we figure out the privacy implications of one innovation, up pops a different one. It is a bit like a game of wack the mole!

The other tricky part is that the definition of what constitutes privacy changes over time, and across demographic groups.

Context

Consider, for instance, that it wasn’t long ago that we all lived in villages - and before that, caves! - and simply expected everyone to know our business, as we knew theirs.

Concepts of privacy also have cultural dimensions.

In Japan, for instance, where personal space is at a premium, people have objected to the on-line mapping application, Google Street View, on the grounds that it is considered impolite and intrusive to look at into the front gardens of Japanese homes. Google has agreed to rephotograph cities in the country, raising the height of cameras to provide privacy.

And then there’s the generational aspect. Every generation, I’m sure, has thought the “young ’uns” were exhibitionists with no sense of decorum, daring to show off ankles in one generation, knees the next, and lots more body parts the one after.

According to Montreal humour columnist Josh Freed, it’s the yawning gap in outlooks between “Generation Parent” and “Generation Transparent.”

He quips that Generation Transparent have lived their whole lives on stage, ever since their first blurry images were captured by a “womb-cam” at eight weeks gestation. They’re apt to wonder whether life is really happening if no one is watching.

Generation Parent, by contrast, grew up in the shadow of McCarthyism, Nixon wire-tappers and espionage, leaving many afraid to bank online or buy a book on Amazon.com. They’d certainly never post their personal diaries or family snapshots online.

While demographics undoubtedly contribute to an evolution in our understanding of personal space, personal information, and privacy, the main influence, surely, is technological - simply because new information and communications applications have vastly accelerated and amplified all the other, more gradual, changes.

Moreover, technology is always yielding new applications that test the capacity of individuals to keep their personal information to themselves - or at least to a select group of friends.

But, even as these new technologies challenge our notions of privacy, the fact is that people love them. Researchers tell us that two-thirds of the world’s online population visits social networking and blogging sites. Here at home, nine of 10 young Canadians socialize regularly online. Indeed, the New York Times recently reported that Facebook, after just five years, had registered its 200 millionth user. Even I recently acquired a page - and immediately attempted to “friend” my 20-something children, a typical helicopter parent! My son was the first to write on my wall! Of course I applied the highest possible privacy settings - it is very hard to find me on Facebook.

Challenges

Clearly, this Web wired world is here to stay, and it’s up to us, as travelers in that world, to adapt, especially when it comes to safeguarding our own privacy.

But what happens if we don’t?

Our Office funded some fascinating research at Ryerson University’s Privacy and Cyber Crime Institute. It found that Canadians from their teens to their 30s are not especially concerned about their online privacy - except where it could be lead to credit card fraud and other hassles of that nature. And yet we’ve all heard many stories about people getting stung by taking their personal lives online without adequate safeguards. People have been fired, suspended from school and missed out on job interviews because of instant messages, wall posts and other communications that they thought were private chats with friends.

Recently, for instance, a political candidate in British Columbia was forced to step down over some racy photos on his Facebook page.

And several young employees at an Ottawa grocery store chain were fired after posting derogatory comments about the store and its customers.

Digital Divides

Indeed, the Ryerson researchers detected a big difference in perceptions between workers and their bosses, and determined that the explanation is likely generational. The employees, who tend to be younger, think their personal information is private as long as it’s restricted to their social network. Their supervisors see information posted online as public, and therefore not entitled to special treatment. Other researchers describe a different disconnect - between users of social networking sites and the site administrators and marketers who commercialize the social networking phenomenon.

Research commissioned by our Office compared the privacy practices of six popular social network sites in Canada, including Facebook, MySpace, LinkedIn, Live Journal, Skyrock and HI5 Study author Jennifer Barrigar found that users typically believe a personal network is private and secure. By contrast, site owners and markets perceive them as essentially public spaces that house a rich source of data.

Meanwhile, in studying teens, American social network researcher Danah Boyd [cct] found yet another digital divide - this one between their imaginary audience and their real one. While the potential audience for young people on social networks could be anybody in the world, teenagers tend to imagine they’re speaking only to a very local and familiar group of friends.

Those peers also have certain practices, or standards of behaviour, to assert their privacy. So these peer standards, combined with the user’s perception of a very limited audience, tends to create an illusion of privacy.

New way of thinking

To bridge these multiple gaps, some experts are calling for a new, more nuanced, definition of privacy in the online universe.

Boyd, for example, suggests that we think of social networking sites as a “mediated public” environment, “where people can gather publicly through mediating technology.”

A conversation in a mediated public space is quite different from a chat in a regular public space - two friends meeting on the street, for example, and catching up on the gossip.

For one thing - and certainly of significance to you as archivists - conversations in mediated public places leave a record, a potentially permanent trace.

That record, moreover, becomes searchable, which gives it greater value to third parties such as marketers, or parties in civil litigation.

But perhaps the most significant distinction is that there may be an audience to the conversation, and most of it may be invisible to the speakers.

It’s as though a boom mike leading to a live TV feed were hovering over the two friends chatting in the street, and they were oblivious to it.

Reconciling conflicting outlooks

In a mediated public arena that is neither purely public nor purely private, Barrigar urges everyone to try to better understand and accommodate the perceptions of others.

For example, social networking sites should make efforts to provide clear information about the site’s privacy practices.

Equipped with plain-language privacy policies, users are then better able to understand the context in which their information is being shared. They also need user-friendly tools that enable them to decide on and enforce appropriate levels of information sharing.

To be truly effective, those tools must be built right into the regular pathways that users take on these sites, right from the moment of registration.

Investigative findings

Our Office recently published findings in an investigation that showed that some users still don’t fully understand privacy controls.

The case involved a conman who used the name, personal information and photo of a senior federal civil servant to create a phony account on a social networking site.

Pretending to be the man, this individual duped the man’s daughters into becoming his “friends,” thus gaining access to their personal information. He then took to harassing the daughters with threatening and obscene postings and e-mails.

The victims eventually recognized they’d been tricked, and notified the site, which deleted the offending account.

The family complained to us that the site lacked adequate control mechanisms to prevent impersonation. But, at the time they set up their accounts, the daughters didn’t know that they could change their privacy settings to restrict access to their profiles. 

Our Office has also been investigating a comprehensive complaint against Facebook, including allegations that FB does not adequately notify users or get their informed consent for the extent of commercial use and disclosures of personal information, that it does not properly safeguard information, and that fails to properly provide for deletion of accounts.

Indeed, the deletion and deactivation of social networking accounts is a significant privacy issue.

Under privacy laws, organizations must not retain information if there is no longer a business purpose; individuals have the right to be forgotten.

But it is not always a simple task - often SNS retain information on “deactivated accounts”, in perpetuity. This is one of the most challenging complaints our offices has examined under the private-sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA.

Part of the challenge is that this law was drafted before the explosion of ICT and the web, and it was based on a traditional relationship between a company and a customer.

In a traditional transaction, a business directly collects the personal information it needs to provide a service. 

With a social networking site, by contrast, individuals proactively publish their personal information online for the purpose of sharing it with others.

The social network is a platform for self-publishing and self-promotion, with a massive commercial enterprise operating in the background. This is not the business model PIPEDA was necessarily designed for.

Our report in the Facebook investigation will offer insights into what our Office expects in the way of privacy protections on social network sites. And who, in a particular transaction, is the “data controller”.

Businesses and privacy

In addition to complaints investigations, our Office has developed guidelines to encourage organizations to come up with policies on the appropriate use of social networking sites at the workplace.

While employers are expected to ensure workplace security and efficiency, organizations should also view the tracking of employees on social networking sites as surveillance that may be subject to privacy legislation.

Street-level imaging services such as Google Street View and Canpages have also drawn the interest of our Office, the media and the public. These applications are extremely popular because they provide a 360-degree digital walking tour of major cities world-wide. 

You can check out your daughter’s route from her apartment to her university, and view the area you plan to stay in Paris on your next vacation.

These applications underscore the challenges of the “mediated public place,” where people go about their business in public, but retain some expectation of privacy.

They recognize, for instance, that other passersby can see them, but they don’t necessarily expect a record of their movements to be uploaded to the Internet, perhaps in perpetuity.

The residents of the small UK village of Broughton illustrated that view quite dramatically last month when they formed a human chain to block the Google Street View car’s access to their streets, and berated the driver until he turned around and fled.

We’ve tried to keep the conversation a little more civil, but in discussions with Google we wanted to know whether and how people are notified that their neighbourhoods and their images are about to be photographed for use online.

I understand that catching a glimpse of the Google SV car is a recent Calgary diversion as the company snaps high resolution images for its on-line mapping service. Calgarians are twittering to report local sightings of the SV cars.

Due to our office’s interventions with Google, the photographs of individuals will be blurred when they roll out the application in Canada. But we also want evidence that the blurring technology is effective. 

As you can see from this slide, for instance, [Paris couple kissing], there have been cases where individuals are still identifiable, even after the blurring process has been applied.

We also want assurance that the original “unblurred” images of people’s faces are destroyed as is required under privacy laws.

Some companies are devising other novel ways to advance privacy and keep track of people’s digital footprints”.

For example, Legacy Locker, KeepYouSafe and Deathswitch are three web-based services aimed at helping people safeguard the personal information they will leave behind when they die. - they offer a way to organize and preserve one’s “personal digital disorder” .

The idea is that subscribers to the service set up a secure online “locker” in which they can store an electronic copy of their will, along with other critical personal information such as user names and passwords for bank accounts and log-in information for their social networking sites.

They then nominate a “beneficiary” who will receive all this information after the subscriber’s death, and properly close all these no-longer-needed accounts.

Individuals and privacy

The EKOS survey I mentioned earlier also revealed that about six in 10 respondents feel they have less protection of their personal information in their daily lives today than they did a decade ago.

Our Office works to ensure that individuals are educated, aware and engaged in strengthening privacy protections.

Toward that end, we publish extensive amounts of fact sheets, booklets and other forms of information.

A lot of our efforts have also been directed at youth, with a special dedicated website, a blog, a YouTube video, posters, contests and so on, all aimed at getting them thinking about privacy in their online lives.

Conclusion

Over the centuries, books, films and other forms of media have too often been censored or otherwise regulated. The Internet, however, has been spectacularly immune to that sort of control.

 At the end of the day, privacy is naturally a social standard and each generation and social group can define its own standard.

Given this new generation and the tools at hand, will this mean a downward slide away from privacy? I don’t believe so, because our ability to selectively disclose information about ourselves to different groups is part of what makes us human, even in the global village.

But what is our strategy as privacy regulators? How do we ensure that we don’t become dinosaurs to the new generation?

In the democratic Internet world, we cannot tell people what they should or should not do on line.

However, we can, help people recognize where their privacy may be at risk; offer them some suggestions on how to address those risks; and, ultimately, let them make their own choices.

As for social network sites and other companies developing new interactive technologies, our Office is dedicated to providing practical and reasonable guidance to help implement - and communicate - the kind of privacy policies that people can understand and use. And to take enforcement action when companies contravene the law.

Our goal is not to stifle innovation or to interfere with people’s fun; it’s to do what we can to restrict the cost to their privacy, a value that we believe will endure.

Thank you.

Date modified: