Should we Adopt a Digital Bill of Rights?

Remarks at the Canadian Bar Association Legal Conference

St. John’s, Newfoundland
August 15, 2014

Address by Patricia Kosseim
Senior General Counsel and Director General, Legal Services, Policy, Research and Technology Analysis Branch

View the video

(Check against delivery)


Twenty-five years after inventing the world-wide web, Sir Tim Berners-Lee called for an Online Magna Carta as part of "the web we want" initiative. Rather than carving our digital space into separate and potentially conflicting national rules, his vision is for a global bill of rights that cuts across regional issues, cultural sensitivities, and reflects a common statement of shared principles and international values.

Should we have a Digital Bill of Rights? Certainly, there'd be benefits.

What universal principles should feature in a Digital Bill of Rights? From a privacy perspective, I'd like to table a few for consideration:

1. Forgive & forget

Leading author, Viktor Mayer-Schonberger, got us thinking about "the right to be forgotten" in 2009 when he described the profound human and societal implications of shifting from a traditional default of forgetting, to a default of remembering.

Taken in or out of context, our digital footprints can come back to haunt us years afterwards - people have lost their jobs, their relationships, even their lives over it.

The human need to learn from mistakes, put our past behind us and move on with our lives is at play here. Our human capacity of resilience and reinvention is being threatened by a future shackled by our past.

Merely knowing we now have perfect and permanent external memory that can be accessed by anyone, anywhere, anytime, can actually alter our decisions and choices. Just like the prisoners in Jeremy Bentham's panopticon, our behavior is inevitably influenced by the constant potential of being watched. Our very freedom to be and become who we want is at stake.

The European Court of Justice attempted to curb this tide by formally entrenching the "Right to be Forgotten". In a seminal decision against Google, it required the search engine to honor an individual's request to remove links to past newspaper articles about old debts he had long since repaid.

The practical and technological implications of this decision are still being worked out.  Imagine the person at Google who now has to respond to all such requests and decide when personal information is inaccurate or has become inadequate, irrelevant or excessive.  But more importantly, how does one balance other societal values – like access to information and freedom of expression? And in a world where – for good or ill – Google has become our global library, how do we preserve the integrity of historical records? 

2. Ethical Use

In the age of Big Data, massive volumes of data are being aggregated,  combined with powerful analytical tools and algorithms, to reveal past patterns in attempt to predict future behaviour – be it consumers’ purchases, disease outbreaks, criminal plots, or socio-demographic trends.  Given billions of data points involved, it’s increasingly challenging to implement -- let alone speak about -- the traditional consent model that assumes opportunity to explain, and obtain  individual consent for, each piece of data collected for a specific and limited purpose

This new reality has led some to question whether consent is still a workable principle at all or whether we should be moving towards a different paradigm of ethical use.  Recognizing that massive aggregation of online data is inevitable, should we be focusing our efforts on ensuring that what is done is done both legally and ethically? If individual consent is truly impossible – or even imperfect – should we be requiring independent third party approval of the purported use? 

Has the time come for the creation of consumer ethics boards to oversee the propriety of controversial experiments and social manipulations like the one Facebook recently undertook? 

3. Hands Off

While many internet users may assume their online activities are free from state surveillance, we now know that is not a safe assumption.  When you are online / offline; what you searched for; what links you clicked on; for how long; how often; who you emailed; who emailed you back; where are you located physically; etc. are all valuable data not only for commercial companies seeking to tailor their ads to sell more products and services, but also for governments seeking to collect such data directly or through third parties for law enforcement or other purposes.

Traditionally considered banal and inconsequential, these forms of "meta data" are turning out to be potentially far more revealing than originally thought.

In a unanimous ruling in R v. Spencer, the Supreme Court of Canada planted the seed for a "hands-off" principle when it held that, absent exigent circumstances or a reasonable law authorizing it, government institutions cannot access such information from private sector organizations without a warrant. A reasonable expectation of privacy exists not only in specific data elements in issue, but also in the potential of that information to reveal intimate details about lifestyles and personal choices.

4. Be Nice

Twenty years ago, kids graffiti’d mean things on the bathroom stall visible to a few others, at least until the janitor would clean it up.  Now it’s posted on the internet for everyone in the world to see, forever:  non-consensual images of ex’s on revenge porn sites, impostered Facebook accounts, or hateful messages about the “new kid in town”. 

Reputational onslaught can be particularly grueling in a virtual world, where "cyberbullies" typically coward behind the veil of secrecy.

Under California's new "Minors in a Digital World" law, kids will soon be able to have removed any personal information they posted about themselves online.

Here in Canada, Facebook agreed with our Office's recommendation to facilitate its take-down procedure for individuals seeking removal of imposter accounts about them.

However, under Canadian data protection law, there is no administrative regime for an individual to complain against another individual.

This leaves potential legal action in tort of privacy or defamation. But, as we know, litigation is expensive. And victims could face a lifetime of pain and humiliation if the offensive materials are digitally immortalized in an exhibit or court judgment posted online forever.

In a unanimous ruling, AB v. Bragg, the Supreme Court allowed a partial confidentiality order, recognizing that -- at least when it comes to young victims of sexual cyberbullying -- the right to privacy could justify limiting the open courts principle.

The criminal provisions proposed in Bill C-13 might open up yet other avenues to pursue - and seek justice against - cyberbullies here in Canada.

But more fundamentally, how can we teach youth to be digitally literate and responsible? How to think before they click? How not to do unto others, what they would not want done to themselves or their loved ones?  How to grow up being trusting, creative and curious about the world, while respecting the universal principle of just Being Nice?

Date modified: