Privacy Commish wants power to triage complaints and requests

The Office of the Privacy Commissioner needs to be able to decide what to prioritize in the best interest of citizens as it deals with increased responsibilities under Bill-C-11, Privacy Commissioner Daniel Therrien told the House of Commons Ethics committee Monday. As it currently stands, under Bill C-11 -- the federal government’s planned privacy law update -- the office will be faced with several new responsibilities, such as reviewing codes of practice and certification programs and advising organizations on their privacy management programs when requested, Therrien said during his opening remarks. Due to the pandemic, Therrien said the OPC is struggling to meet the demand in guidance advisory work and to assist investigators in addressing complaints. He said his office got funding through the government’s fall economic update to support the implementation and enforcement of Bill C-11, but that more would be necessary. “The issue here is not primarily financial, although in our view additional resources will be required,” Therrien said of its responsibilities under C-11. “The OPC should have the legal discretion to manage its caseload, respond to the requests of organizations and complaints of consumers in the most effective and efficient way possible and reserve a portion of our time for activities we initiate based on our assessment of risks for Canadians.” Therrien said “such discretion is enjoyed broadly by domestic and international regulatory partners, both within and outside the privacy protection sphere." Therrien told the committee it used temporary funding this fall to reduce its investigation backlog of complaints older than a year by 91 per cent. It previously got a permanent increase of 15 per cent as part of the 2019 federal budget, which Therrien said was used to expand the OPC’s policy and guidance functions, enhance advisory services for organizations, and address pressures from new mandatory breach reporting requirements in the public sector. In order to decide what it deals with, the OPC would conduct a risk evaluation when a complaint is received to determine what it will prioritize, Therrien said. He said another way to balance the office’s activities could include requirements for the payment of cost-recovery fees to the OPC when it’s asked to take on code of practice approvals and certification programs proposed under C-11 “to ensure that we have the capacity for that task as well as for our other priorities.” The second half of Monday’s meeting focused on Therrien’s views of the use and impact of facial recognition technology on Canadians. A pair of investigations into facial recognition company Clearview AI and the RCMP’s use of its software are coming to completion with a report on the findings of the latter investigation to be completed in a week or so, Therrien said during his remarks. The OPC’s investigation into Clearview, which was used by dozens of police departments across Canada before it withdrew itself from the market last summer, found Clearview scraped some three billion images of faces and corresponding biometric identifiers off of publicly accessible information on the internet, such as social media. “Remarkably, and shockingly, the new administrative penalty regime created by Bill C-11 would not apply to these and other important violations of the legislation,” Therrien said Monday. “Such a penalty regime renders meaningless laws that are supposed to protect citizens. I therefore urge you to amend the bill to remedy this fundamental flaw,” he said, according to simultaneous translation. Clearview has so far refused to delete pictures it collected, according to the OPC. Last year, it finalized an investigation launched in 2018 into the use of facial recognition technology to analyze the age and gender of customers in Cadillac Fairview shopping malls, concluding that it violated Canadian privacy law. When asked by NDP MP Charlie Angus Monday whether or not his office is investigating claims that Pornhub, owned by Montreal-based company MindGeek, has breached the privacy rights of Canadian citizens as it has been accused of hosting illegal and non-consensual content, Therrien confirmed that it is but did not offer details. “I’ll be careful because we’re investigating. I’ll just note the general principle that consent is generally required to collect, use, and disclose personal information under Canadian private sector privacy laws,” Therrien said. “There’s a further rule which provides that even if consent is provided, a company cannot collect, use, and disclose information if a reasonable person would find that inappropriate.” Last month, RCMP commissioner Brenda Lucki was questioned by the committee on whether or not a criminal investigation is taking place. Lucki said the call for an investigation was under review and that if information was found that points to a need for one, it would absolutely take place. Therrien, who said Monday his office prepared a brief with several recommendations for C-11, also repeated his stance that the bill needs to stand on human rights, and told the committee there’s “no question” that C-11 is a "comprehensive and serious" attempt to address privacy issues, but that it needs significant changes in order to protect individuals. “For instance, there’s an exception to consent where it is, quote, ‘impracticable’ to obtain consent. Well, we think that such an extremely broad exception to consent makes the rule hollow,” Therrien said, adding that there appears to be less control for individuals and more flexibility for organizations. “We’re not against additional flexibility for organizations per se, particularly when organizations want to use personal information for the public good, or for a legitimate public interest, but we think that additional flexibility should come with additional accountability,” he said. - Reporting by Hannah Daley at hdaley@thewirereport.ca and editing by Jenna Cocullo at jcocullo@thewirereport.ca.

Privacy Commish wants power to triage complaints and requests

News | May 10, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Privacy Commish wants power to triage complaints and requests

News | May 10, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Watchdogs find deceptive privacy practices across majority of websites, apps studied

Privacy tribunal unlikely to get through INDU’s look at Bill C-27

Privacy tribunal needed in Digital Charter, ISED continues to tell MPs

Privacy commissioner flags excessive site blocking, privacy risks in age verification bill

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us