Transparency and privacy in the digital age: Toward a new balance
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Remarks at the 5th International Seminar on Transparency and Privacy in Law Enforcement and Administration of Justice
October 21, 2011
Mexico City, Mexico
Address by Chantal Bernier
Assistant Privacy Commissioner of Canada
(Check against delivery)
Overview
The central issue before us today is how to strike the right balance between two very important values: open court and individual privacy rights. I very much appreciate the chance to exchange ideas with this audience about reconciling these values.
It has long been a central tenet of any democratic legal system that justice be administered in an open manner—not only to be fair, but to be seen to be fair. Until recently, that openness was limited by what has been called the “practical obscurity” of paper and the physical confines of a courtroom.
We have now moved from the constrained access of courthouses and paper to the digital posting of proceedings on the Internet. In this area as in so many others, the Internet—which rests on digitization and networkization of data—is the great game changer. The consequences for privacy have been significant—and often not very positive.
The argument I would like to put to you today is that the Internet has not merely changed the level of transparency of justice, but its nature. To such an extent, in fact, that we must rethink the modalities of judicial transparency to address the differential impact of the Internet as it topples the established balance between judicial transparency and privacy.
The Office of the Privacy Commissioner of Canada (or OPC) has issued guidelines to reconcile transparency and privacy in federal administrative tribunals. I hope they can serve as an example on how to tackle the very new challenge of balancing judicial transparency and privacy in the digital age.
I will begin my presentation by describing the premise that underpins my reflection: the differential impact of the Internet on the principle of judicial transparency forces us to re-evaluate its application.
I will then give you an overview of the Office of the Privacy Commissioner of Canada and its authority over federal administrative tribunals, after which I will discuss the main point of my remarks today, which is the re-evaluation of judicial transparency in the digital age.
In closing, I will describe the guidelines we have issued on this matter.
The differential effect of the Internet
In order to get to the heart of the matter, I would like to share with you an e-mail I received:
“I just received notice that my grievance will be referred to adjudication at the Public Service Labour Relations Board. I am concerned because the grievance involves matters of discrimination and medical information. I am considering abandoning my grievance because I don’t want my personal information posted on the internet. I am really torn because finally resolving this matter at adjudication is very important to me, however, I don’t want my job prospects to be threatened because of the Internet publication of my name.”
Obviously, I could not be of any help. I answered that, indeed, the danger was real, and that the decision to continue with the proceedings or not was a personal one. It seems to me that this exchange clearly highlights the differential—and in fact deleterious—impact of the indiscriminate publication of decisions on the Internet. We have created an obstacle to justice.
Loss of privacy or loss of access to justice
The OPC has long shared the concerns of individuals who fear that participating in a tribunal proceeding could violate their privacy when the decision is ultimately posted online.
The lack of concern by tribunals and other bodies for privacy may well limit access to justice. The risk of having personal details made public may make people reticent to assert their rights in administrative and quasi-judicial proceedings.
Given the many areas of our lives touched by such bodies, this effective lack of access to justice could be profoundly disabling for those who need disputes with governments, employers or service providers resolved. And why should a law-abiding citizen fighting for a government benefit be forced to expose the intimate details of her personal life to public scrutiny?
The issue
In trying to address this issue, I will begin by giving you an overview of the legislation in place to protect privacy in Canada, and of the role of the OPC in this context.
There are two federal acts overseeing personal information in Canada: one aimed at the private sector and the other, at the public sector—as is the case in Mexico.
The mandate of the OPC is to oversee compliance with federal privacy law. We exercise our mandate through six well-defined functions:
- We respond to information requests—over 11,000 a year;
- We receive and investigate complaints—over 200 a year against the private sector and over 600 against the public sector;
- We review privacy impact assessments (or PIAs) submitted to us by federal organizations about their programs or activities which may entail the collection of personal information;
- We audit the personal information management practices of organizations subject to either act;
- We perform and support research and public education activities; and
- We support Parliament by commenting on bills and amendments that touch on privacy issues.
I would like to emphasize at the outset that Canadian courts are not covered by the federal Privacy Act in Canada. The OPC’s jurisdiction extends exclusively to the executive branch of government, more than 30 federal administrative and quasi-judicial tribunals. They consider issues such as the denial of pension and employment insurance benefits, compliance with employment and other professional standards, allegations of regulatory violations, and challenges to the federal public service hiring processes.
There are crucial distinctions between judicial courts and administrative tribunals in Canada that are relevant to the issue of privacy and transparency:
- Administrative tribunals are subject to access to information and privacy laws; superior courts are excluded.
- Administrative tribunals remain accountable to the legislatures that create them.
- Members of administrative tribunals are usually selected and appointed by the executive. They are independent, through built-in arms-length relationships, but they are part of the executive.
- The citizens appearing before administrative tribunals often do so without legal representation, and those who compose the tribunal are often citizens untrained in the law. All involved are therefore likely to have little experience in identifying privacy issues and little familiarity with exceptions to the open court principle.
The level of independence of administrative tribunals may vary according to their enabling legislation, but they are subject to the same constitutional rules of natural justice, impartiality and fairness as the courts. Hence, the underlying principles of transparency and privacy apply to administrative tribunals as they do to the courts, and the law that covers privacy in government also covers transparency and privacy in administrative tribunals.
Through the Privacy Act, Parliament made a conscious decision to impose specific rules on these bodies about their handling of personal information. These bodies commonly publish their decisions on the Internet, even though the decisions often contain personal details that not many people would be comfortable sharing widely—salaries, physical and mental health problems, detailed descriptions of disputes with employers, and alleged wrongdoing in the workplace. Other information of questionable relevance is also sometimes included in the published decisions, such as the names of children, home addresses, places and dates of birth, and descriptions of criminal convictions for which a pardon has been granted.
The essence of the open court principle
The essence of the open court principle is twofold:
- The open court principle places secrecy and transparency in opposition; not privacy and transparency.
- The object of the open court principle is the tribunal, not the parties.
It exists to ensure the effectiveness of the evidentiary process, to encourage fair and transparent decision-making.
Openness remains a key functional principle of justice, but the Internet represents a crucial change in the equation between privacy and openness.
The Internet distorts the application of the open court principle
The Internet distorts the application of the open court principle through three broad impacts:
- It removes the limits to the loss of privacy that were physically inherent to the traditional court process;
- It removes the protection of privacy from the control of the tribunal;
- And, in its most perverse impact, it turns the focus away from the tribunal and toward the parties.
As a result, to preserve the principle of judicial transparency, we must adapt the modalities for its application.
The purpose of the open court principle is to oppose transparency and secrecy; it should not oppose transparency and privacy.
Indeed, privacy can and ought to be preserved, even in the pursuit of other important outcomes of transparency—notably the legitimacy of the adjudicative process, the accountability of the court or tribunal, and the assurance of public confidence in the justice system.
In Canada, tribunals widely utilize the Internet as an efficient, inexpensive and effective tool to communicate their decisions to the public. The benefits are many. By electronically disseminating their decisions, tribunals can better educate the public about their mandates, make precedent-setting decisions readily accessible, promote transparency and demonstrate accountability.
However, tribunal decisions may contain significant amounts of personal information. Some of this may be sensitive information, such as information about medical conditions, financial circumstances or mental health issues.
Often, the format of tribunal decisions published on the Internet and the personal information they contain has not changed to reflect the reality that the Internet provides unlimited access to tribunals’ decisions to unlimited persons for unlimited uses.
The impact of the Internet on privacy in justice matters can be seen in a newspaper story that came out a few years ago in Canada. The story was about the province of British Columbia’s new online court records system.
The online system permits searches for information about civil and criminal proceedings involving anyone—even those facing nothing more than a parking ticket.
In its early days, the system became so popular that it became difficult to get access to it because of the enormous volume of online traffic. There was a digital line-up for access.
One privacy advocate wryly noted that she’d never heard of people lining up around the block at the court registry to get access to that same information. Indeed, the limitations imposed by paper-based records had simply made it too much trouble to sort through such records before.
I don’t think anyone is claiming that this greatly increased thirst for personal information about others represents a pent-up demand purely for a valid societal purpose. Instead, it probably reflects other, often much less noble, ends—the unbounded and sometimes prurient curiosity of some members of the public, and the interest of others in exploring the potential of this online source for commercial exploitation or, in some cases, criminal gain through identity theft.
The easy online availability of this information might also facilitate discrimination, harassment and stalking.
The approach taken by the OPC
The OPC is not convinced that the broad public needs to know the names of individuals involved or requires access to intimate personal details through decisions posted widely on the Internet.
The OPC has concluded that blanket electronic disclosure of personal information contained in tribunal reasons for decision is not the purpose for which the information was obtained. Rather, tribunals collect personal information in order to make a decision based on the specific facts of a case.
The OPC has taken the position that the public interest in accessing information about tribunals’ proceedings does not obviously or necessarily extend to obtaining access to identifying information about individual participants.
Simple suppression of direct and obvious identifiers such as names is likely to represent the most efficient and effective means of ensuring individuals’ privacy is properly protected. This method of protecting privacy poses no significant threat to tribunals’ independence and ensures that the facts and issues in individual cases may be fully and transparently debated.
Where there is a genuine and compelling public interest in disclosure of identifying information that clearly outweighs the resulting invasion of privacy, institutions have the discretion under the Canadian Privacy Act to disclose such information.
Similarly, if a law or regulation authorizes the disclosure of personal information, the Privacy Act does not prohibit that disclosure. In this way, the Act recognizes the right of Parliament to create disclosure regimes that reflect the mandate of a particular tribunal and the demands of the open court principle.
I do not profess to say that the balance between openness and privacy will always be easy to attain. However, it is not a zero-sum game. The open court principle does not equate open season on the personal information that is placed before tribunals and other quasi-judicial bodies.
Concrete examples
Over the years, as administrative tribunals subject to the Privacy Act began to publish their decisions online, people complained that their personal information contained in decisions had been posted on the Internet without their knowledge or consent.
Most of those people had entered their name into a search engine and found decisions that were 5, 10 or even 15 years old.
Many of these complainants told us they were distressed to discover—often with no prior notice—that personal information about them was available on the Internet for neighbours, colleagues and prospective employees to see.
A long-ago transgression or temporary lapse in judgment could continue to haunt an individual for many years. Even if no past transgression was involved, the nature of the personal information that was being disclosed could be deeply embarrassing.
Let me give you some concrete examples from among the cases submitted to us.
We have received numerous complaints about the Canadian Umpire, who hears appeals regarding employment insurance benefits. In 1996-1997, the Umpire started posting decisions that had not been de-identified online, beginning with 60 years’ worth of archives. Many people were very surprised to find decisions several years old come up at the top of the list, when they did an Internet search using their name.
A woman was surprised to find her name come up in a 12-year-old decision, in which she was identified as co-owner of a business that had made false statements to the federal government, when in fact she had only done office work on contract for the business. She complained to us that her name was being associated with a business in which she had no stake and her reputation was being tarnished.
A radio host who was looking for a new job found out that a potential employer had done an Internet search on her name and came up with a decision on an appeal regarding an employment insurance claim she had filed 14 years earlier. The potential employer apparently told the woman that if he hired her, he would be leaving himself open to the gibes and criticisms of his competitors, who were always looking for opportunities to discredit the hosts of competing stations.
One man complained that when he did an Internet search on his name, he came up with an employment insurance decision, the first paragraph of which mentioned a criminal record for which he had obtained a pardon several years earlier.
One woman who was appealing an issue related to her disability pension found her name, address and the specifics of her disability posted online as part of a tribunal decision. Such information is highly personal for anyone, but the complainant was doubly distraught because she felt the disclosure rendered her vulnerable in her somewhat downscale neighbourhood.
The last case I will mention to illustrate the impact on privacy that the publication on the Internet of decisions of administrative tribunals can have has do to with a complaint filed against the Pension Appeals Board. The woman begged the Board not to post on the Internet a decision containing information about her parents, her relationship with her previous husband and psychological problems she had had. In this case, the tribunal in question finally granted the complainant’s request—but unfortunately, that does not always happen.
In cases where the complaint was well-founded, we made the following recommendations:
- That administrative tribunals de-identify as appropriate subsequent decisions using random initials, or that they post summaries of decisions with no identifiable personal information.
- That administrative tribunals follow the OPC’s guidelines on the use of their discretionary powers in all cases where posting a decision on the Internet amounts to disclosing personal information.
- That decisions about which a complaint has been filed with the OPC be removed from the Internet until they can be de-identified.
- That the indexing of names from previous cases be restricted through the use of exclusion protocols, or that such cases be removed or de-identified as appropriate as soon as possible.
While some administrative tribunals have improved their privacy protections, I am disappointed to report that, despite the clear intention of Parliament in extending the federal Privacy Act to cover personal information handled by administrative tribunals and despite the compelling case for preventing the release of identifying information in many cases, the problem of excessive disclosure persists.
Even after being advised of privacy concerns with their policies and practices, most government institutions have been reluctant to change them. In fact, some government institutions told the OPC that they plan to continue posting sensitive personal information as they always have.
Others took important but incomplete steps toward improved compliance with the Privacy Act. As a result of our investigations, some institutions have implemented technical measures to prevent the names of individuals who participate in their decision-making processes from creating “search hits” when typed into major search engines. Others have agreed to use initials in place of individuals’ names.
The varying responses to the recommendations of the OPC mean that, even among those institutions that we have investigated, there remains inconsistent privacy protection for Canadians.
We are not empowered under the Privacy Act to bring this matter before the courts for further guidance. However, the OPC is committed to continuing to work with the government institutions which have been reluctant to implement all our recommendations to protect personal information. We hope that by maintaining a constructive dialogue, we will be able to persuade these organizations to take the steps necessary to protect Canadians’ privacy.
Integrating transparency and privacy
In order to formalize the positions we have adopted in our investigative findings, the OPC issued in early 2010 a set of guidelines on what administrative tribunals ought to consider when contemplating the online publication of their decisions. The guidelines, which we made public earlier this year, were developed in consultation with our provincial and territorial colleagues.
Recognizing that tribunals are diverse in terms of their enabling legislation and mandates, the guidelines call for a general approach, rather than a “one-size-fits-all” prescription.
Guidelines
As a first step, we encourage tribunals to be transparent, in order to lessen the risk of privacy-related conflicts, and to help manage the parties’ expectations and enable them to make informed choices.
For example, we suggest that tribunals inform the parties about the specific policies, statutes and regulations that govern their information-handling rules.
Tribunals should also publish a detailed written notice that describes how personal information is handled when reasons for decisions are to be published online.
Where there is discretion as to disclosure of personal information in decisions posted on the Internet, tribunals ought to develop a policy to guide each decision.
As a best practice, the guidelines encourage tribunals to consider whether de-identified or anonymized versions of the decision could be viable alternatives to full disclosure.
If personal identifiers have to be included in a tribunal’s reasons, we suggest that tribunals edit from the public posting all data elements that are not relevant to the decision itself. I am referring here to addresses, dates of birth, the names of family members, identification document numbers, and workplace names and locations.
Where names do have to appear online, the guidelines recommend that tribunals use web robot exclusion protocols, so that a routine Google search by name won’t bring up the decision.
They should, moreover, advise parties of steps they can take to identify and protect personal information in advance of a public hearing. For example, there’s usually no practical reason for people to include extraneous personal identifiers, such as state-issued identification numbers, in their submissions.
In the age of the Internet
In summary, I think we can agree that there are ways to respect the open court principle while avoiding or minimizing unwarranted harm to individuals.
Unwarranted, in the sense that they are merely witnesses, or family members, or people who have turned to one of our quasi-judicial bodies in the hopes of straightening out an employment situation, or obtaining a benefit, or finding a home in Canada.
The paramount principle of openness in adjudicative processes is not imperilled simply because we ask that institutions weigh the competing interests.
We ask only that a disclosure of personal information be in the public interest, and that the public interest actually outweigh the interests of the people most directly, and potentially gravely, affected.
We believe this is a nuanced, sensible and balanced approach that is fair to all.
- Date modified: