AIQ investigation shows need for strong privacy laws, OPC says

At a Vancouver press conference Tuesday, the federal and British Columbia privacy commissioners presented the results of their investigation into AggregateIQ (AIQ) as an example of how investigations into companies can go — correctly — when commissioners have proper privacy laws that allow them to compel cooperation. Both federal commissioner Daniel Therrien and B.C. commissioner Michael McEvoy pointed to the fact that unlike the last joint-investigation their offices released into Facebook Inc. and Cambridge Analytica in May, the investigation into AIQ was assisted by the fact that as a Victoria, B.C.-based company, AIQ was compelled to give evidence under oath to the B.C. privacy commissioner. The investigation found that in its use of data scraped off social media for use in political campaigns, AIQ used the data for purposes not explicitly consented to, and in some cases “AIQ was unaware of how, or whether, individuals had consented to the use of their personal information,” according to the report. According to Therrien, the investigation into AIQ has brought a global privacy scandal traversing continents and involving millions of people right to the doorstep of Canada. “The Facebook-Cambridge Analytica scandal last year served to expose some of the troubling practices used in political campaigns,” Therrien said at Tuesday’s press conference. “With AIQ, we now have a Canadian player playing a key role in the troubling ecosystem of political campaigning in the digital era. This is too close for comfort.” According to McEvoy, the company has said it will abide by the report’s central recommendations, namely that AIQ must obtain data with consent and must delete all personal information in its custody after the data ceases to have a business or legal use. The report also recommends that the company undertake a number of steps to protect that media from being exposed online. In the report’s findings, the privacy commissioners write that the company “failed to take reasonable security measures to ensure that personal information under its control was secure from unauthorized access or disclosure,” contravening sections of both B.C. and federal privacy law. “This issue is, however, resolved as, in our view, the security arrangements implemented by AIQ since the breach” will bring the company into compliance, along with providing the two commissioner’s offices with an affidavit that they had deleted the relevant personal information. “Ultimately, we used legal powers to compel the two principles of AIQ to answer our questions to provide us with relevant documentation,” Therrien said. “Commissioner McEvoy could if necessary, impose an order. I could not, federally. So we made recommendations that they company agreed to follow and implement.” “Thats certainly a difference with Facebook that we welcome,” the federal commissioner said. When Therrien and McEvoy announced the release of their findings in Ottawa in April, Therrien portrayed the relationship with Facebook during the investigation as fraught, in which the company refused to implement any of the recommendations. Therrien also said in April that his office would be taking Facebook to federal court to seek an order forcing it to comply with his office’s recommendations to bring the social media giant in line with the federal Personal Information Protection and Electronic Documents Act (PIPEDA). That court application, Therrien said, is “imminent,” but did not say exactly when the office would file it. In May, Therrien said that his office would file before the federal election, which has come and gone. In a follow-up email, an Office of the Privacy Commissioner spokesperson said the delay had to do with the complicated nature of filing in what is known as a “de novo” proceeding. “We cannot simply file our report of findings with the court; rather, we must demonstrate to the court via evidence and arguments that Facebook did not comply with PIPEDA,” the spokesperson wrote. “Consequently, even though we have completed an investigation, bringing a court application is a significant undertaking.” AggregateIQ was involved in harvesting and processing data for “political microtargeting” in the 2016 election in the United States that saw the election of Donald Trump, and the earlier 2016 referendum in the United Kingdom on membership in the European Union, known as Brexit. The company provided “targeted advertising, website development, and database management services to various Brexit campaigns on the “leave” side,” according to the report, and in some cases violated Canadian privacy law while it did so. Therrien also reiterated his long-standing call for Canada’s political parties to be brought under the jurisdiction of Canadian privacy law, and cited a joint resolution announced earlier this month in which all of the provincial privacy commissioners endorsed his call. In May, executives from the Internet giant Facebook, Alphabet Inc.’s Google, and Twitter Inc. came before the Ottawa meeting of the International Grand Committee on disinformation and fake news, where legislators from across the world signed what they called the Ottawa Declaration, detailing a set of principles for accountability for the data giants. — With reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Anja Karadeglija

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

AIQ investigation shows need for strong privacy laws, OPC says

News | November 26, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC lacking in battle against cybercrime: Auditor General

Education key to combating foreign interference on social media, ETHI hears

Educating Canadians is key to address cybersecurity threats: CTS panel

Cybersecurity is national security, panelists tell IIC

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us