The benefits of a broad interpretation of the definition of personal information

Remarks at the Canadian Bar Association's Access and Privacy Symposium Dinner

September 14, 2012
Ottawa, Ontario

Address by Jennifer Stoddart
Privacy Commissioner of Canada

(Check against delivery)


Introduction

Good evening everyone. All in all, today's digital economy, and our digital society for that matter, is marked by many players holding a growing wealth of personal information.

And in a world increasingly marked by businesses finding new ways of using personal information along with large scale data breaches, personal information is being put at greater and greater risk.

In this world, our Office stands as a privacy guardian. And in setting out to fulfill PIPEDA's stated purpose, I sometimes look to the words of Theodore Roosevelt for both inspiration and resolve. He famously once said,“speak softly and carry a big stick.” But, given the tools currently bequeathed unto me by law, I'm left to “speak softly and carry a big, banana cream pie.”

I mean, as it stands, we do hold some leverage to deter bad privacy practices such as when we make findings public, but this comes only after the fact.

All this to say, in the coming months and in the name of fortifying the legal protections for personal information, our Office will be looking at how we hope PIPEDA may evolve to encourage companies to be more proactive in their privacy obligations.

Tonight, however, I’m not going to be talking about how to fortify the walls. Instead, I’m going to discuss the entry criteria if you will, to be nestled within them. In other words, I want to talk about the definition of personal information, how it might - and should - be evolving, and what this could all mean for Canadians.

Definition and interpretation

First of all, as you know, in the Privacy Act, PIPEDA and substantially similar private sector provincial legislation, the definition of personal information is broad; and to some, it’s too broad. Myself, I’m a proponent of the belief that broader is better.

Until recently, a broader interpretation of this important definition stood tall and strong; but in the past year, Alberta’s Court of Appeal has expressed a more reductionist viewpoint.

As you know, this occurred in the decision involving Leon’s furniture chain, in which, the court determined that a licence plate is not personal information because it relates to an object rather than an individual.

I, along with several privacy advocates had hoped the Supreme Court would hear an appeal on this important issue, but it chose otherwise.

However, the definition of personal information may still receive an airing before the Supreme Court due to another Alberta Court of Appeal decision, the United Food and Commercial Workers case.

As many of you know, that case raises the issue of the appropriate balance between freedom of expression and the protection of personal information in a public space.

My Office supported the Alberta Information and Privacy Commissioner’s leave to appeal to the Supreme Court and a decision on the application is still outstanding.

While the Supreme Court chose not to hear an appeal of Leon’s and the matter of United Food is still in play; in discussing the definition of personal information, I would be remiss if I didn’t discuss the ramifications should a narrower interpretation become the norm in Canada.

Reasons broader is better  

1) Technological capacity and uses or purposes for information evolve

First of all, if one were to say we live in the Information Age; that would be old news.  A term that better illustrates our time would be the Information Innovation Age.

In other words, there are profits to be made by not just gathering, aggregating and processing information, but constantly finding new ways of collecting and using it.

Take for example the evolution of the cellphone from a brick with an antenna to a veritable homing device, or that of the Internet from a medium that users went to obtain information to today, where marketers have turned the tables and use it to collect data and track users. These are just two examples. 

For what others we might be talking about in 10, five or even two years, I can only guess.

2) As technology advances, today’s innocuous bit is tomorrow’s puzzle piece

One thing though is certain: there surely won’t be a shortage of information to work with; certainly not in this burgeoning age of Big Data.  Now, the amount of data is staggering, but it actually pales in comparison to the escalating technological capacity to sort through it, make connections and find patterns – and this is something that courts need to bear keenly in mind.

As Canada Research Chair in Information Law Theresa Scassa has noted in research conducted for our Office, as this capacity increases and the longer information is retained, the greater the likelihood of being matched and processed with other data.  As a result, “identification that is impossible today may indeed be easy tomorrow.”

Of course, this does not mean that every piece of seemingly innocuous data should be considered personal information. There has to be some middle ground. On this note, let’s consider work by the Council of Europe to modernize Convention 108. 

This proposes that an individual should not be considered identifiable if identification requires unreasonable time or effort. Certainly, in the context of looking at the future of privacy law, this seems to me like a reasonable middle of the road approach and one worth considering in Canada.

3) International implications

On another international note, Canadian courts and decision-makers also need to be aware of the global context to privacy legislation. The broad definition of personal information found in Canada’s privacy laws is one that is shared by many other countries.

And as I pointed out in my affidavit supporting the Alberta Office’s leave to appeal in the United Food case, unduly restricting the application of PIPEDA “could jeopardize Canada’s status as a country which provides adequate privacy protections for the purposes of European Union data protection laws, which in turn could impact international trade and commerce.” 

Conclusion

In closing now, as a final note, I want to thank the Canadian Bar Association for its support for privacy reform.

I hope I can persuade you in the coming months that even more reforms are due. Thank you.

Report a problem or mistake on this page
Please select all that apply (required): Error 1: This field is required.

Note

Date modified: