Creating a culture of privacy
Remarks at the Public Interest Advocacy Centre annual dinner
November 25, 2022
Ottawa, Ontario
Address by Philippe Dufresne
Privacy Commissioner of Canada
(Check against delivery)
Introduction
Thank you for that kind introduction. I am honoured to be here with all of you and in this beautiful venue this evening.
As one of Canada’s leading think tanks, the Public Interest Advocacy Centre has made significant contributions on a wide range of issues, including: consumer rights, diversity and equal opportunity, privacy, transportation, finance and telecommunications. Your research and advocacy in these areas have helped inform debate and ultimately shaped Canada’s policies and public services. I thank you for these important contributions to the public interest and I am thrilled to be speaking with you tonight for my first in-person keynote address as Privacy Commissioner of Canada.
As I have stated in my annual report this year, it is a pivotal time for privacy, and for my Office, with challenges and opportunities in our legal, technological and societal landscapes.
In this context, my appointment as Privacy Commissioner of Canada in June of this year was, for me, a logical progression in my career as a lawyer and senior executive committed to promoting and protecting the fundamental rights of Canadians, while at the same time ensuring that pragmatic and important objectives are also achieved.
This approach also applies to the world of privacy and will be particularly relevant when dealing with matters related to the increasingly central role that technology plays in our world, our lives, and our economy.
Technology offers tremendous potential for public- and private-sector innovation, and for improving the lives of Canadians. Ensuring that we can use these innovations while protecting privacy will be critical to our success as a free and democratic society, and a key challenge for Canada’s institutions in the coming years.
In order to do so, Canada’s federal public and private sector privacy laws need to be modernized to respond and adapt to these societal and technological changes, and to keep pace with legislative developments in other jurisdictions both domestically and internationally.
The insights and advice provided by stakeholders such as the Public Interest Advocacy Centre are also essential to meeting this challenge. An example of this is the recent opinion piece by PIAC lawyer, Yuka Sai, on the proposed update to PIPEDA and what the bill needs to accomplish.
This is why I have made it one of my early priorities to reach out to many organizations in industry, government, academia and civil society because it is important that we understand your realities so that this understanding can inform and be reflected in our work.
I will continue to consult stakeholders as we seek to advance law reform and implement world class privacy protection and promotion regimes for the benefit of Canada and all Canadians. As many important stakeholders have told me, protecting privacy is one of the key challenges of our time.
I fully intend to meet this challenge and in doing so, I will apply the three elements of my vision for privacy that I presented during my confirmation hearings before the House of Commons and the Senate earlier this year. They are:
1) Privacy as a fundamental right;
2) Privacy in support of the public interest and Canada’s innovation and competitiveness; and
3) Privacy as an accelerator of Canadians’ trust in their institutions and in their participation as digital citizens.
These three pillars reflect the reality that Canadians want to be active and informed digital citizens, able to fully participate in society and the economy without having to choose between this participation and their fundamental privacy rights.
In short, privacy is fundamental. It supports important public and private interests, and it builds necessary trust.
This evening, I would like to talk to you about what these three pillars mean to me as Privacy Commissioner, and what they mean for Canadians, starting with the first pillar – privacy as a fundamental right.
Privacy as a fundamental right
In 2019, my Office and our international colleagues in the Global Privacy Assembly declared in a resolution that “privacy is a precondition for citizens’ other freedoms as well as a keystone right for democracy…”.
This description of privacy as a necessary condition for the existence of other fundamental rights is consistent with the Supreme Court of Canada’s long-standing interpretation of privacy law as having quasi-constitutional status and with international legal instruments such as the 1948 Universal Declaration of Human Rights that have recognized the right to Privacy.
Treating privacy as a fundamental and quasi-constitutional right means treating it as we do other human rights. As a priority.
It means that privacy must be legally protected, with a strong, fair and enforceable legal and rights-based regime. A regime that offers meaningful remedies to prevent and address violations and that acts as an incentive for institutions to create a culture of privacy.
Let me repeat that. A culture of privacy. Privacy by design, where it is considered, valued, and prioritized. Privacy that is embedded at the outset of innovation, not as an afterthought or a regulatory irritant.
It means limiting the collection, use, retention and disclosure of personal information to what is demonstrably necessary and proportional to achieve an organization’s purposes. It also means adequately training those dealing with that information on the importance of protecting privacy, and having monitoring mechanisms in place to ensure that policies are being followed on an ongoing basis.
While consent is an important element of privacy law, consumers cannot be solely responsible for the protection of their privacy and those who trade in and benefit from the knowledge economy must also be accountable for the ways that they use information.
Indeed, as a litigator, I was often involved in matters where courts had to determine which side had the responsibility to do something or present evidence. One of the ways that courts made this determination was by assessing which party was best equipped to fulfill the task or to provide the necessary information, and which party was the most vulnerable or in need of protection.
This is certainly true in the case of children, who need even greater privacy safeguards. Those of us who are parents will have seen firsthand our children’s increased use of technology and social media in recent years.
This is an issue of increasing global importance. Earlier this month, Facebook whistleblower Frances Haugen appeared on the Radio-Canada TV show Décrypteurs. She said that when she interviews children, they “consistently use an addict’s narrative to describe their usage of social media” – that they cannot stop using it even though it makes them unhappy. She said that Facebook does not give children the “tools to help themselves escape the algorithm or moderate their own usage,” because those tools would undermine the company’s business model. This highlights why it is so important that our privacy laws do more to protect children.
Next week, I will be in Singapore to attend the 58th Asian Pacific Privacy Authorities Forum to underline the region’s importance from a data privacy standpoint. One of the events that I will be participating in is a round table on the protection of children on the internet, and I look forward to discussing the important role that my Office is playing in protecting and promoting the fundamental privacy rights of all Canadians, including consumers.
Personal privacy is not a right we should have to surrender – at any age – in the name of innovation or profit.
Treating privacy as a fundamental right also means giving privacy an interpretation consistent with the purpose and objectives of the legislation, which can, in the case of private sector privacy law, be the promotion of trade and commerce as a matter of federal jurisdiction.
In cases of conflict – and these will be rare – between privacy rights and private or public interests, privacy will prevail. I say that these cases will be rare because by creating a culture of privacy and protecting personal information at the front end, we will be able to avoid most conflicts and achieve both privacy and the desired public or private interests.
Privacy in support of the public interest and Canada’s innovation and competitiveness
This brings me to the second element of my vision – privacy in support of the public interest and Canada’s innovation and competitiveness, which recognizes the positive impact of privacy protection and rejects the false choice between privacy and innovation. I believe that Canada can be an innovation hub and a model of good government while at the same time protecting the personal information of Canadians.
We can and we must have privacy while fostering the public interest. It is not a zero-sum game and, as in so many things, we must reject extremes in either direction.
The way to avoid this false dichotomy and achieve both privacy and the public interest is by considering privacy at the front end – not after-the-fact. Doing so will be more cost-efficient and effective, and the costs will become investments that are good for businesses and governments alike.
All of us, whatever our roles in the private and public sectors, or as citizens participating in our democracy, need to work together to ensure that the fundamental right to privacy is protected while we achieve other important public interest goals. I am not saying that this will be easy, but I am saying that it is necessary.
It is also good business and good government.
Money and resources spent on protecting and promoting privacy – on creating a ‘culture of privacy’ – are smart investments in trust and the security of Canadians, in both the private and the public sectors.
It is not an either/or proposition.
Even in the context of privacy-intrusive tools such as facial recognition technology, federal, provincial and territorial privacy commissioners in Canada have not called for an outright ban but rather for a clear and strong legal framework to regulate its use.
This was the subject of a recent report by the Access to Information, Privacy and Ethics (ETHI) Committee of the House of Commons, which reiterated the need to ensure appropriate regulation of such privacy-impactful technologies. The report recommended a moratorium on the use of facial recognition technologies until they could be reviewed by courts or my Office, and confirmed the need for critical measures, such as mandatory privacy impact assessments and consultation with my Office prior to the adoption, creation and use of facial recognitions technology; improved transparency and enhanced oversight; and modernized public and private sector laws.
This week, the ETHI Committee issued another report, this time on the use of on-device investigative tools by the RCMP. In a statement issued today, I welcomed this report which calls for a legislative framework that recognizes privacy as a fundamental right and that requires government institutions to consider and address privacy impacts at the outset when developing and using new technologies.
Just last month, my provincial and territorial colleagues and I issued a resolution on digital identification. In announcing the resolution, I stated that the development and implementation of a digital ID ecosystem is an opportunity to demonstrate how innovation and privacy protection can coexist.
We can all see the benefits of a system that will allow individuals, businesses and governments to confirm identities and carry out transactions online with a high degree of efficiency and confidence.
But we must also recognize that unless digital identity projects and the frameworks that support them meet high standards of privacy, security, transparency, and accountability, they will not be trusted enough to be widely adopted, and those benefits will not be realized.
This idea that privacy and trade can and must co-exist has also been a theme of my discussions over the past few months with international groups such as the Global Privacy Assembly and the G7 Data Protection Authorities, and also with the Agile Nations, a group of seven countries, including Canada, that was formed in 2020 to work together to create a global regulatory environment that promotes innovation.
Earlier this month, as part of the Agile Nations Working Group, Canada, Singapore and the UK signed a joint statement of intent to promote and support cyber security measures surrounding the Internet of Things. We say in the statement that we see “tremendous economic and social benefits” in connected products, but that “appropriate cyber security requirements must be built into these products from the design stage, rather than placing this burden on consumers.”
Treating privacy as a fundamental right and finding ways to achieve the public interest and innovation at the same time is not only possible, it is a virtuous circle that will generate trust and further benefit these interests.
This brings me to my third pillar – privacy as an accelerator of trust in the digital economy.
Privacy as an accelerator of trust in the digital economy
When individuals trust that their rights will be protected, they feel confident about participating freely in the digital economy. This is good for Canadians, good for businesses, and good for innovation.
Yet, in our most recent survey of Canadians, more than half of respondents felt businesses do not respect their privacy.
So how do we restore this trust? Let me highlight three ways.
First, we need a strong set of public and private sector privacy laws that fairly and effectively regulate the collection, use, retention and disclosure of personal information. Our laws need to be rights-based and provide effective remedies in cases of violations so that Canadians know that they are not alone in protecting their fundamental right to privacy.
The government took an important step toward modernizing the private-sector law with the tabling of Bill C-27, the Digital Charter Implementation Act, in June of this year. The bill is a recognition by the government that Canadians need and expect modernized privacy laws. I look forward to providing my advice to Parliament on how the Bill should be further improved.
I was also encouraged by the remarks of the Minister of Justice and Attorney General of Canada, the Honourable David Lametti, who following the tabling of Bill C-27, said that public sector privacy reform is not far behind. It will be important to harmonize the legislation to ensure that both public and private sector privacy laws are grounded in the same privacy principles – especially given the increased prevalence of public-private partnerships.
A second way to restore trust, and this touches my Office directly, is to ensure that data protection authorities have the necessary authority and resources to not only deal with complaints, but to also play a strong advisory and promotion role giving independent and expert advice and input to organizations planning new initiatives that involve the collection or use of personal information.
My hope is that when organizations consult with my Office, we will either be satisfied with the measures taken to safeguard privacy or we will be able to provide advice resulting in course corrections at the outset. Ultimately, I am confident that the very fact that these consultations take place with my Office would reassure Canadians that their privacy is properly considered and protected.
As a third measure to restore trust, we need to create a strong and lasting culture of privacy. We need to make sure that Canadians do not feel that they are being nudged or encouraged to provide more information than what is strictly necessary and proportional to achieve an organization’s purposes. We also need to make it easy for Canadians to choose the most privacy protective settings, and to make sure that they know and understand when, how and why their information is being collected, used, disclosed and retained.
Our findings in the Tim Hortons investigation, where the company’s app tracked users’ locations even when the app was not in use, and without the users’ knowledge or consent, demonstrate how trust can be undermined when privacy is not sufficiently considered and protected.
It serves as a reminder of the work that remains to be done to promote a culture where privacy protection is the default setting and where Canadians have the reflex to always ask why their personal information is being sought.
A culture of privacy, with privacy by design, and privacy by default.
Conclusion
In conclusion, there is no doubt that the modern economy increasingly depends on the value of data extracted through digital technologies. We have seen that these technologies can bring important benefits. But we have also seen the risks and the harms of technologies without adequate privacy protections.
Canadians should not have to look over their shoulders when using technology.
The way forward is through reform of our privacy laws in a manner that recognizes and protects privacy as a fundamental right, while at the same time supporting the public interest and innovation.
I believe that this can and must be achieved, and as Privacy Commissioner, I commit to working with all of you to promote and protect this fundamental right to privacy that is so essential to individual autonomy, dignity and the full enjoyment of other rights and freedoms in Canada.
Thank you again for the invitation and I wish you all a good evening.
- Date modified: