Ontario privacy watchdog says province should update privacy law, even without feds

The Office of the Information and Privacy Commissioner of Ontario (IPC) says the province should move ahead with its own private sector privacy law, despite federal reforms coming to a halt, arguing it would expand privacy protection for millions employed by provincially-regulated companies including unions, charitable organizations, and professional associations whose non-commercial activities are unregu currently unregulated. Tuesday the privacy commissioner of Ontario Patricia Kosseim released a response to an Ontario government white paper titled Modernizing Privacy in Ontario, which sought to consult stakeholders on how to increase transparency for individuals about how their data is being used, enhance consent provisions and introduce a right to erasure and data portability. The province’s white paper was largely based on the the federal government Bill C-11 a move which the IPC called a “wise approach given the importance of achieving ‘substantially similar’ status, which would exempt Ontario’s organizations conducting commercial activity within the province from the federal regime, streamlining regulatory oversight and ensuring practical compatibility with other private sector privacy schemes in Canada and around the world.” Bill C-11 died on order paper when the fall election was called, however, the IPC urged the provincial government to move forward with updating its privacy legislation despite uncertainty at the federal level. “Many experts have raised concerns about the increasing level of employee surveillance during the pandemic, which shows no signs of abating in a post-COVID recovery world… These include technologies that monitor: websites visited; time spent on websites or in documents; location information through GPS; employees’ computer screens; incoming and outgoing email; keystrokes; social media activity and more,” the IPC wrote in its response. The IPC argued that “significant volumes of data” from the not-for-profit sector is vulnerable to cyber threats and security risks, yet the government proposal was “silent” on the issue. In one instance, the commissioner pointed out, with fewer resources to resolve security issues, a small charity took five months to notify an individual of a break, which the organization did voluntarily. “Currently, no privacy law applies generally to Ontario non-profit organizations and no regulator has been given responsibility for this sector,” the IPC wrote. Kosseim also noted that an Ontario private sector privacy law includes political parties, as is the case in British Columbia and which is proposed in Quebec’s Bill 64, arguing that the misuse of citizens' information would undermine trust in democracy. “One need only turn to recent news items highlighting the alleged use of facial recognition technology by political parties to verify identities, or the Cambridge Analytica scandal, to appreciate the need for political parties to be subject to privacy obligations.” Protection for the youth was also a concern for Kosseim who said that Personal Information Protection and Electronic Documents Act (PIPEDA) and Bill C-11 are largely silent on this subject. That despite 21 per cent of polled Ontario students, pre-pandemic, reported spending five or more hours on social media per day and that emerging smart toys are incorporating artificial intelligence (AI) to collect data for children, which can put kids at risk of creating gaming dependency, addiction or “otherwise negatively influence their behaviour”. In addition to making the case for the urgency of implementing new privacy legislation in Ontario, the IPC also highlighted several areas of concern in White Paper proposal, including what is considered fair and appropriate use and collection of personal data. “When considering the volume, nature and sensitivity of the personal information, we would recommend including consideration of the context… the sensitivity of the information may drastically change from one context to another.” Kosseim said that that effectiveness should be taken into account when assessing whether the collection and disclosure of personal information is necessary to achieve the legitimate needs of an organization and whether less information will suffice. “We recommend that this proposed factor make explicit reference to both necessity and effectiveness as accompanying conditions to consider when determining what is fair and appropriate. When assessing whether the benefit is proportionate to the individual’s loss of privacy, it would be important to specify for whose benefit. We would recommend that benefits be considered beyond the organization’s pure commercial profit to include benefits to the individual, to other individuals and to society more broadly.” The IPC also questioned how to define whether or not information is “about”, with the ability of emerging technologies to infer or predict information becased on online behaviour. “Whether or not such information is accurate should not matter from a privacy perspective. To the extent it is associated with an individual or attributed to them by a human or algorithm, it should still be considered about them,” Kosseim wrote. — Reporting by Jenna Cocullo at jcocullo@thewirereport.ca and editing by Michael Lee-Murphy at mleemurphy@thewirereport.ca

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Ontario privacy watchdog says province should update privacy law, even without feds

News | September 7, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Watchdogs find deceptive privacy practices across majority of websites, apps studied

Privacy tribunal unlikely to get through INDU’s look at Bill C-27

Privacy tribunal needed in Digital Charter, ISED continues to tell MPs

Privacy commissioner flags excessive site blocking, privacy risks in age verification bill

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us