Privacy Protection in the Context of Evolving New Technologies: The Imperative of a Proper Legal Framework and Dynamic Oversight
Remarks at Les Journées Strasbourgeoises 2012
July 9, 2012
Address by Jennifer Stoddart
Privacy Commissioner of CanadaFootnote 1
(Check against delivery)
Good afternoon, ladies and gentlemen. I would first like to thank Mr. Justice Nicolas Kasirer and Ms. Chantal Chatelain for having invited me to speak at this important conference. I am very pleased to be here today to discuss the protection of privacy with such a distinguished group of jurists.
We are living in a global era of “big data.” We are witnessing the emergence of a capacity to store digital data in once-unimaginable quantities. According to one study, businesses and consumers collectively stored over 13 exabytes of new data in 2010—that is more than 52,000 times all the information stored in the United States Library of Congress. Put another way, that is twice the amount of space required to store all language ever spoken throughout the history of humanity.Footnote 2
Despite the purported benefits of new technology, ongoing technological change is increasingly blurring the lines between public life and private life. Furthermore, companies are compiling more and more information that traditionally belonged to the private sphere, such as our private correspondence, our buying habits and our online activities.
By contrast, our Office has observed the power of social networking sites to promote and generate social change. Using social networking sites, agents of change have coordinated historic demonstrations and revolutions that might not have been possible without online tools. Closer to home, information technology and social networking has played a role in the G–20 demonstrations, the Vancouver Stanley Cup riots, and, recently, in the student protest movement in Quebec.
But how do we reconcile the protection of privacy with the advent of new technologies? Is our current legal system robust enough to allow us to benefit from rapid technological change without requiring us to re-evaluate our fundamental values? While technology may significantly improve our living conditions, it is also disruptive. We must come to a better understanding of the implications of such an unprecedented capacity to share information and of the Internet reality of eternal data storage.
1. Current overview
In Canada, there are many fundamental laws designed to protect privacy. In particular, the Canadian Charter of Rights and Freedoms protects certain interests with respect to privacy, though it does not specifically recognize a right to privacy. Also, the protection of privacy is an integral part of Quebec civil law: guarantees are provided at article 35 of the Civil Code of Quebec and article 5 of the Quebec Charter of Human Rights and Freedoms.
There are, of course, other federal and provincial laws designed to protect the privacy of Canadians as well. These include provisions in the Criminal Code, data protection laws, and laws establishing causes of action for privacy breaches; all of these laws are part of the panoply of legal instruments designed to protect privacy in Canada. Furthermore, the Civil Code of Quebec and legislation in British Columbia,Footnote 3 Manitoba,Footnote 4 SaskatchewanFootnote 5 and Newfoundland and LabradorFootnote 6 provide for tort/extra-contractual liability with respect to privacy. Indeed, even the common law is in the process of recognizing tort liability for "intrusion on seclusion," as the Ontario Court of Appeal recently did in Jones v. Tsige.Footnote 7
Does this legal backdrop provide enough privacy protection, given the modern-day challenges arising from new technology? For the purposes of discussion, let's look at two recent decisions of the Saskatchewan Court of Appeal,Footnote 8 where the Court reached two different conclusions. Both cases addressed the issue of whether the disclosure of personal information about an Internet subscriber, without a search warrant, constituted a "search" under section 8 of the Canadian Charter of Rights and Freedoms. As in these two Saskatchewan cases, police are sometimes able to determine the IP address of a particular Internet user who is looking at illicit online content (e.g. child pornography). But law enforcement must then approach an Internet service provider like Videotron or Rogers to determine the identity of the individual behind the IP address.
In the Spencer case, the Saskatchewan Court of Appeal determined that the disclosure of information without a warrant was not a "search" and consequently did not infringe the rights of the accused under section 8. However, in the Trapp decision – which was released concurrently by a different panel of the Saskatchewan Court of Appeal – the opposite conclusion was reached. An application for leave to appeal to the Supreme Court of Canada was filed in Spencer in June 2012.
2. Issues that test the legal framework
With the legal context in mind, I will now turn to the challenges ahead. First among them: the rapid pace of technological change.
In large part, consumers are driving this rapid technological development with their insatiable appetite for new technological tools. The danger lies in a lack of awareness with respect to the privacy implications of some of these new gadgets. And while this knowledge deficit is improving, one does not have to look far to discover the traps that lie in wait for the uneducated Internet user.
Given the profitability of companies that trade in personal information—especially in the case of publicly traded companies—the commercialization of personal information and the increased profitability of trading in such information leads to increased incentives and a higher risk of profiling, data security breaches and online identity theft.
Social networks also present serious challenges in the more private spheres of our lives. Whereas adolescents two decades ago could learn by making mistakes, today an inappropriate photo or intimate detail broadcast on the Internet can have serious and damaging implications for years to come. Photos and intimate information can be re-transmitted, re-tweeted and “cached” such that they will always remain accessible on the Internet. And whereas a central issue in Europe is whether the European Union should develop regulations formally recognizing the "right to be forgotten," discussion in Canada on this issue is much more tempered, if not non-existent.
The case of A.B. v. Bragg,Footnote 9 which is currently pending before the Supreme Court of Canada, provides a good example of the legal challenges associated with social networking. A young teenager who was subjected to online sexual bullying on Facebook sought legal redress but did not want to be exposed to further humiliation by using her real name in court process; she hoped to keep the details of the bullying out of the media and from thereby becoming a permanent fixture on the web. Our Office, which intervened in this case, argued that while the principle of open courts is the cornerstone of our democratic society, the public interest in privacy must be considered throughout the legal analysis. Legal submissions to courts must be contextualized in the Internet age, where new technologies facilitate virtually unrestricted access to personal information for a vast public whose interests are unknown.
Accordingly, while we must embrace the potential that technology has to improve our standard of living and to expose us to new forms of knowledge and new relationships, we must be cautious regarding technology’s potential adverse effects which, in turn, can influence our understanding of traditional legal concepts in unintended ways.
3. Migration of intellectual and social discourse to cyberspace – a venue for law enforcement
Finally, I would like to address one further implication of the new online age. My Office has observed a slow but steady migration of vast amounts of social and intellectual discourse to social networks and the blogosphere. Once again, new technologies and social networks present an incredible opportunity to foster the development of social and intellectual discourse: new ideas are published, new connections are made and new relationships flourish on a global scale. My position with regard to the use of new online technologies by law enforcement agencies without judicial oversight is already known.
Throughout Canada and in other democratic countries, government bodies increasingly require the private sector to play a significant role in law enforcement. Social networks and Internet service providers are often asked to disclose personal information to law enforcement agencies without judicial oversight or appropriate control mechanisms. After lengthy discussions with telecommunications companies, Internet service providers, civil society and government actors, I can tell you that the deputization of industry for law enforcement purposes is already occurring on a surprisingly large scale. The number of disclosures made annually by telecommunications companies to law enforcement agencies is significant: in 2010, the RCMP obtained the information it requested in 93.6 percent of cases through voluntary cooperation by the telecommunications companies.Footnote 10 In most cases, the figures are not made public, and the individuals whose personal information is disclosed to law enforcement agencies are not informed of the disclosure.
Law enforcement agencies should, of course, have the tools needed to carry out their mandate, but accountability and transparency must remain priorities.
As many of you know, the Supreme Court of Canada recently rendered a decision in R. v. Tse.Footnote 11 The case addressed the constitutionality of a provision in the Criminal Code that permits the warrantless interception of private communications via wiretap where an emergency situation arises.Footnote 12 The Court agreed that such a power may be required in certain limited circumstances; however, the Court struck down the provision because there was no accountability mechanism built into the legislation. If a warrantless wiretap never resulted in criminal charges, the subject of the wiretap would never know of the existence of the wiretap nor would she be able to challenge the wiretap in court.
Analogous concerns exist in situations where private companies are asked or required to provide subscriber information to law enforcement agencies without appropriate judicial oversight. As I have already mentioned on several occasions, I am concerned that legislation like the Protecting Children from Internet Predators Act, Bill C–30, will shield law enforcement authorities from the proper authorization, accountability and transparency mechanisms that are so essential in our democratic system. While the law enforcement and intelligence communities must be given the appropriate tools to do their jobs, the proper balance must be struck to ensure that the privacy rights of individuals are respected.
In closing, the rapid growth and evolution of Internet and mobile technology has the potential to radically improve our society if we harness the potential appropriately. Unfortunately, technology is a double-edged sword: if left unchecked, the commercialization of online personal information could erode our conception of privacy by blurring the lines between information that should remain private and information that is accessible to everyone. Increasing public awareness of these risks is essential. Legal interpretation also has a crucial role to play in the area of privacy law and the protection of personal information.
In an age of rapid technological change, lawyers and judges must, in my opinion, be aware of the ways in which technology is profoundly altering our existence. A legal interpretation based on decidedly pre-Internet concepts will often be inadequate for resolving problems arising in our modern technological environment. New and creative ways will therefore have to be found to preserve the fundamental rights and freedoms that are the cornerstone of a democratic society.
- Date modified: