and welcome welcome everybody to the IEP
p privacy symposium game show and in
honor of this year's playoffs it we're
modeling our game show after TSN's the
quiz and so please put your hands
together and welcome your host James
Duthie
James where are you James Oh celebrities
they never show up but you want them to
looks like I'm gonna have to do this
again myself that was discouraging I'm
sorry you don't get James Duthie welcome
everybody to the IEP p Canada privacy
symposium and in honor of the playoffs
we have a distinguished set of panelists
ready to explore and break down the game
for you this afternoon and without any
further ado I'd like to introduce your
panelists first we have the captain and
statesman the Daniel Alfredsson of the
privacy world Jennifer Stoddart
welcome Jennifer next I just want you to
make sure that you know which senator I
am NOT one who's revising his or her
expense account but thee the Daniel
Alfredsson next our panelist the
distinguished the effect of the enforcer
dr. Ann Cavoukian
welcome Commissioner kibou Guillen I and
next we have the hot new young rookie
the nail Yakupov of the privacy world
Commissioner Jill Platon it's a lot of
space in this jersey nice dress it's
signed and lastly but not least we have
the ultimate defender of the privacy
world the ever so stylish Commissioner
Liz denim
well welcome everybody and thank you
very much for participating we're here
to have a little bit of fun but also
sort talk some privacy so put on your
privacy analyst hats and let's get this
game show going so quiz question number
one recently there was news about an
international privacy sweep and
Commissioner Stoddard this refers to hmm
a gigantic broom used to push underwear
under the bed when guests arrive
unexpectedly and i'm not talking about
my superman underwear hmm the Publishers
Clearing House lottery and a big big win
every time in euros or is it various
countries working together to examine
data handling practices well you know I
want to give an answer that gives true
way to the importance of you know these
various possibilities in my life so i'd
have to say number a is really hbu
figuring largely in my personal life as
some of you know who've ever come to my
condo one of its salient features are
piles of dust bunnies in the corner and
so the privacy sweep is really the best
thing that I have found after the
invention of the vacuum cleaner in my in
my life when I battle through the dust
bunnies get out the door get to the
office then I have to deal with the
other privacy suite which is actually a
lot cooler it was headed up it was the
idea of brant oh man where are you brand
homing branches over there okay big
round of applause for Brant home
injuries
major player on the sens team in Ottawa
Brent brought this wonderful idea from
the Competition Bureau he encouraged and
119 jurisdictions including our own bc
to join an examination of online privacy
policies during the same week and we did
it all together we're discussing the
results when you hear more about it this
summer so that's that's the second less
important privacy sweet very good Liz
did you want to add anything our office
looked at I think 250 websites in bc our
sweep included not-for-profit
organizations and political parties that
are uniquely subject to the vc law and
we found that only forty-nine percent of
these bc businesses had privacy policies
so we're frowning down on that and we
the results will come out with the
commissioners with the federal
commissioners and the other participants
only in forty-nine percent forty-nine
percent and we've had the laws enforced
for how many years now okay quiz
question number two drones are Phil
Kessel Dion Phaneuf and any other member
of the Maple Leafs
this brave hey Granada was an Ottawa fan
to come into Toronto ins yeah a topic
that the awesome privacy scan just wrote
about that's a shelf that shameless
self-promotion sorry but that don't know
how I threw that in a technology that
poses some serious privacy questions and
issues dr. Kevorkian do you want to
tackle that question you need the mic
I'm gonna say none of the above although
i would probably lean towards see drones
are an amazing new technology that for
proper purposes will have amazing
results for search and rescue missions
and there's so many uses they've been
used in ontario by the OPP and Halton
Region Police for completely unrelated
to surveillance activities such as
search and rescue and going into remote
areas but the the threat of course
arises when they are used in a covert
manner to engage in public surveillance
domestic surveillance completely
unacceptable and the good news is in the
states 32 states have already either
introduced her in the process of
introducing bills to prohibit the use of
drones for purposes of domestic
surveillance without a warrant that this
is awesome it's already happening very
proactively for once which is
outstanding and in Canada we see I seem
to have less concerned certainly in
Ontario the police forces we spoken to
are not even contemplating the use of
drones for purposes of surveillance so
we have to remain ever vigilant because
this is one technology that if you take
your eye off the ball it will just leap
ahead and we won't be able to pull it
back it's an ideal application of
privacy by design and we're working on
this actively now we've got a paper
coming out actually next week the week
after next June the fourth called
surveillance then and now and it's an
examination of surveillance starting
with the olden days
cameras which used to be a thing of the
past and going through GPS automatic
license of lrp recognition and ending
with drones so we're taking a sweeping
look at surveillance potential and the
only thing I want to leave with you is
we have to find ways to come in front of
technologies that will engage in
surveillance especially in a covert
manner where you're given no notice and
the example that comes to mind which
you're going to think is not
surveillance related and it's not
technically is google glass when you
think of google glass it's someone
wearing glasses that has the capacity to
take your picture perhaps videotape
without your knowledge or consent to
that I say what I want to see and I want
any techies out there to give me this I
want a technology that would enable me
to put on the equivalent of privacy
glasses that would in effect block the
transmission or the interception by
Google glass or any other wearable
device of my facial image and think of
Star Trek think of force fields that's
what I want to develop so that people
have a response to this and be able to
say no because they're not going to know
who's doing it where so we need to
respond to technology with technology we
need to get smart about this excellent
yes Misha shudders yeah can I just point
out that i think the real answer is not
among those three the drones are is a
term used when somebody goes on for too
long
wait the gloves are off road collecting
and using big I'm moving right along
here um good collecting and using big
data is like a Big Mac hard to digest uh
it's an American sitcom um no sorry is
that the big bang theory or an
invaluable or for research but a
potential threat to privacy if not
handled properly Commissioner Clayton it
could be any of those like a Big Mac
hard to digest that's kind of the same
as C invaluable for research but a
potential threat I actually I think that
tongue well big data is a very very hot
topic at this privacy conference there's
been a lot of sessions where you know
some some real experts in the field some
people are spending a lot of time
looking at Big Data have been here to
talk to you and ran raise some of those
issues i'm not going to go into all of
the issues but i will point out a couple
that that that you know there are the
flags there are the things that not to
overuse the phrase i've already used it
a couple times today but the things that
keep us up at night the potential for
big data is obviously vast enormous and
you know i'm certainly one of those
people who believes in the value of
information just ask anybody that I work
for I'm looking for stats all the time
I'm trying to get some information so
that i can make decisions so I I get how
important that is but but it has to be
done properly and we've heard a lot at
this conference also about the
accountability framework you know if
you're moving in that direction that
drones Big Data social media cloud
computing all of these things it's not
it's not the technology that we should
necessarily be afraid of it's making
sure that it's done properly with due
regard to to privacy and the
accountability framework is one way of
doing that I less concern
about some of these these new
technologies if the proper foundation is
in place if we know that organizations
have you know the policies and the
procedures but not just those things
that they're checking and rechecking and
evergreening their their programs if
that foundation if the framework is in
place and I think there's room to go in
some of these directions so collecting
using big data I'm going to go with C so
yes invaluable for research but a
potential threat if not handled properly
you have to set it up right to begin
with excellent thank you any other
comments on that no I was going to say
that I think the challenges of big data
are absolutely hear what I hear about in
the health care sector is that
especially with the Canadian publicly
paid system we're all sitting on this
incredible treasure trove of data and if
we don't mind it and use it properly
then babies will die so we get into this
this really challenging dialogue with
with researchers with academics that
want to actually use this incredibly
important information pharmaceutical
data to come up with new solutions that
will allow us to live longer the
challenge is how do we actually how do
we do that well still allow the
principles of privacy to be applied and
I'm out there saying all the time that
research and privacy are friends not
foes but where I really see it in
British Columbia where I see this
dialogue about big data is in health
care mm-hmm yes go ahead in and if I
could just agree completely with what
Liz and Jill said and just add one thing
the key to big data is d identify if you
lead with D identifying especially
health related data you can maximize the
benefits of the data for full health
research purposes and protect privacy
completely securely strongly there are
excellent d identification tools out
there everyone knows of khalid el mmm
and his outstanding d identification
tools and I applaud Alberta
that have used his tools on their entire
health database and are getting the
multiple benefits excellent excellent um
having a speaking about health data all
right having true control over your
personal health information is a myth
true or false true the health care
sector simply cannot be trusted or false
our laws provide adequate protections
and they strike the right balance or you
can go off the map here and say none of
the above who wants to tackle that
question well I'll follow sure um I
actually I actually I'm gonna dodge that
entirely okay do that right I'm lon
Quist I'm the star goalie I actually
think that we've got a lot more
challenges than whether or not we
absolutely have control over our health
data I think that the current paradigm
of personal information protection and
standalone health information is broken
just going to put that out there I think
that we're really going to have to
examine our Health Information
legislation to deal with IT challenges
of EHRs to deal with tissue banks and
genomics to be able to deal with the
fact that individuals are more more
often than not now custodians of their
own health information so I think all of
these issues will shift and I don't
think that even the newest standalone
Health Information legislation is
adapting or can actually deal with this
new environment bigger challenges to
come so you want to see more legislation
no I want to see more flexibility in the
legislation and I really don't think
that the challenge is right in front of
us are dealt with adequately in our
legislative framework that we have now
dr. Couvillion yet and and I think this
is one area where in addition to
legislation and new frameworks processes
and
to protect the data we're going to look
for new ways to protect data how can we
get smart about the use of data and
would it be possible to enable the data
to protect themselves could we add some
artificial agents to the data that
render the data in effect
self-protective and I know it's a
far-out context we're doing this at U of
T I chair something called the identity
privacy and security Institute and we're
introducing something called Smart Data
smart data if you look at our website
you can learn more about it it's all
about arming the data in a way that
enables greater control by the data
subject and proper contextual use which
would only come from the dot data
subject it's looking to the future
because in the future we're going to
have to have greater intelligence not
only in terms of our processes and
legislative frameworks but arming the
data itself to protect itself in finding
waste in so great er control on the part
of patients and data subjects go ahead i
can I speak out of turn I just wanted to
follow up on on this question it's it's
of interest to me and I'm I agree with
what you said I do think that um that
the legislative framework is not ideal
but i do want to speak up for our
standalone health law in alberta because
i think there are some some some
interesting things in that legislation
that that actually frankly might work in
the private sector or the public sector
i mean there's there's nothing nothing
is ever perfect but you know this this
idea of having true controlling laws
providing adequate protections in
alberta basically information is shared
among healthcare providers so that if i
live in edmonton now city of champions
by the way city of really it's
really bad that team it was right to me
I don't know Vancouver isn't in the
playoffs this year hasn't been a riot
and no my absence
and an the Toronto Maple Leafs oh my
goodness oh my goodness well what are
you doing here I think somebody goes to
the penalty just because I was getting
too serious by two minutes I am not
calling any hotties no no penalties no
penalties you have a whistle I you need
a whistle I do need a whistle yeah um
yes I was things I was talking about the
health law now in Alberta because you
were talking about what the health law
in Alberta that's right helpful in
Alberta so there's this idea that if I'm
if I'm living in Edmonton city of
Champions and I'm injured in lethbridge
for example that my health care provider
the health care provider who is treating
me will have access to my information
this is this is a very good thing and
information in that circle is shared for
the most part without consent but it's
balanced by all sorts of controls
including controls that patients are
able to exercise we spent a lot of time
last year and we're still promoting this
working on a document that we published
which is a patient rights document
because we've had the health legislation
for over 10 years now and you know there
are some the ability for patients to you
know the healthcare treatment provider
is required by law to consider a
patient's express wishes if they don't
want their information to go to a
particular healthcare provider the
legislation includes a legal requirement
to to record disclosures of information
so it might be being shared without
consent but you have to keep a record of
that it's explicit in the legislation
that a patient can go and get a copy of
the audit log and patients don't know
these things that they have those
controls that it set out explicitly in
legislation so I'm not saying that it's
a perfect piece of legislation but but
there are some of those those rights and
controls individual controls that can be
exercised we've been doing our bit to to
to make that information available to
individuals because there hasn't that's
never really happened in Alberta and I
think it's resulting in some extra work
for some of the you know the health
region and the ministry but I think it's
really important you can build those
controls into legislation to make it
stronger even if you have laws that are
allowing for some of this information
sharing but I think with new technology
and with data analyst Ella analytics
applied to healthcare then those what
used to be discreet uses whether it's
patient care quality assurance system
management and research are becoming
increasingly blurred so I do think that
that our approach is really needs a new
and more flexible framework a new look
at it how we're going to deal with
genomics I don't know with this kind of
framework so I think you know maybe
there needs to be more flexibility
around around policy in this area well
and I think one of the other issues is
around transparency I won't go on about
this but Tom speaking about big data and
the information that's Indian Singh an
electronic health record one of the
things about the electronic health
records nobody has any idea what the
heck is going on in that what
information is in there how it's being
used what those secondary uses are so in
some ways I think you know the focus
needs to be on transparency for some of
these initiatives and making it clear to
individuals so they can exercise their
rights and they can take control my
office would kill me if I didn't mention
p HIPAA so I must tell you about
Ontario's personal health information
protection act which I would suggest is
the world's best health information
privacy law but don't take my word for
it the Institute of Medicine two years
ago in the US studied health information
privacy laws all around the world
because they wanted to use one as a
framework to base their revisions on the
US HIPAA the only existing statute they
pointed to for that would serve as a
model for such revisions was Ontario's p
HIPAA and it is very similar in terms of
the concept of the circle of care which
assumes the the patient's implied
consent for use within their healthcare
providers so it's right
if my GP refers me to a specialist who
sends me to the lab for testing they can
assume my implied consent for all those
purposes which are for the purpose of my
health care but an individual can say no
if they don't want their information
shared it is a wonderful model it
enables access to information when it's
needed and then if you're contemplating
sending the information out to a
third-party outside of the circle care
the walls go up positive consent is
required on the part of the patient the
data subject before that happens it's
been working fabulously here in Ontario
since 2004 we oversee compliance with
the legislation which applies to both
public and private sector agencies and
it is an outstanding statute we have a
lot of information a lot of guidance
documents on our website if you want to
take a look commissioners daughter did
yeah baby well being a European I
thought you'd like to know what's what's
happening in Europe and I was lucky to
be invited to an international genomic
research conference in Europe a couple
of weeks ago and doing the background
reading for that and preparing my
remarks with some of my staff I came to
the position you can I think this is
supposed to our website by now that in
the area of medical research given the
particular context giving the strong
ethical framework given the
professionalization of the people
involved given the public cost this is
not exactly what I said there but given
the importance of the public interest
involved that consent may not be the
centerpiece of how we deal with people's
information I think that we should as we
go forward say this is an area where
it's not practicable if you're doing
genetic research genomic research and
you're mixing things up and you have to
get samples apparently according to
these are internationally known genetic
research experts from thousands and ten
thousands of people in cohorts in order
to validate for example rare disease
and so on so i came to the opinion that
in that context i thought we could
dispense with consent of course things
are d anonymized and so on remains the
ethical issue of course if you discover
some medical situation over which a
person would have control if they were
informed than my opinion would be you
should go back try and identify them and
try and warn them because they can do
something so that's that was kind of for
me a glimpse into the future yeah but
increasingly we our community has to be
involved in these policy discussions
deeply involved and I think Canadians
expect their information to be used for
Public Interest medical research so we
better not have these conversations that
are going like that we have to be at the
table yeah excellent but so but on that
and there was a very interesting
workshop here on the European regulation
this group of researchers are very
concerned because the latest comment
says the Albrect report on the European
regulation does not allow scientific
research to be one of the exceptions to
the consent model so of course the
medical community is in overdrive and I
must say I sympathize with me but we
know the European regulation is far from
being adopted at the present time but
that is a concern in my opinion because
I agree with the player at the end of
the line yes that it is a public
interest issue we all have an interest
in finding the best way to deal with our
health issues okay thanks Lane so for a
true-and-false question that generated a
lot of discussion I thought they were
just gonna flip a coin um next question
a comprehensive privacy program is a
really really really really big one it's
a rarity sort of like winning all four
Series in the playoffs or it's an
essential way for an artist organization
to try to comply with the law
commissioners daughter
hmm well I don't know some people would
say it's a really really big one and its
really expensive and that's why they
don't invest in them that's what I was
talking about yesterday and so it is
kind of a rarity too but if you look at
it more positively it could be see and
in fact myself and Liz's office and
Jill's office have all produced a
document about how to set up a
comprehensive privacy program and so I
hope people are you know reading this
and taking it to heart and again you
know I think this is so important that
we have to have some way to check up on
it and so I come back to how do you
demonstrate accountability you
demonstrate it because you've got a
comprehensive privacy program but I
didn't work on this nearly as much as
Liz denim did so she's probably got more
thoughts on I think my staff are getting
tired of me talking about the
accountability paper so just to really
really bug them I decided that we had to
write another paper another paper about
accountability in the public sector
which our offices is going to be
releasing in the in the coming weeks but
in all seriousness I do think that the
establishment of comprehensive full some
privacy management programs our way
through of the mire that we see right
now so I don't see how any organization
unless you're the corner dry cleaner can
do 21st century information processing
using personal information so we're
talking about global data flows we're
talking about big data which is just
data analytics on steroids we're talking
about the application of new technology
you can't do that work
without having the management processes
in place across your organization and
increasingly you'll see that the
commissioners will be using this privacy
management framework in our enforcement
work and the work that you do with your
programs will have evidentiary value in
investigations and audits boy that was a
really serious answer that was very
shoes it's okay next question privacy by
design guess who's this this one is
directed to privacy by design is a great
concept but putting it into practice is
well it's it is just like that new
awesome sends Jersey it hides figures
yes putting it into practice is
virtually impossible unless of course
you have Commissioner kabuki as your
spokesperson or it's not as difficult as
you might think and totally worth it
this one's easy of course we've been
pushing this for many years now but the
beautiful vision that I have that I had
is is coming into fruition so privacy by
design has now been translated into 31
languages all around the world think of
a major language it appears in that
language and we didn't we didn't pay for
any of that we just reached out I would
reach out to my colleagues in different
jurisdictions and they at their own
behest are translating this and adopting
it I can give you examples from all
around the world we get contacted all
the time Japan has an active movement
Singapore just contacted us there's
there's so much all around of course the
EU it's in their regulation in the FTC
privacy by design is the first of three
recommended best practices for privacy
so what's the big deal why is it taking
off why was it made the international
framework for protecting privacy in 20
ten that was unanimously passed by
privacy commissioners and data
protection authorities the reason is we
as commissioners do a very strong job I
think we do a very good job we really
take our work seriously but increasingly
the majority of privacy and fractions
don't even come to the surface if you
think of the tip of the iceberg if we
get the tip of the iceberg we're lucky
because with the growth of ubiquitous
computing Wi-Fi positioning systems
online social connectivity data
everywhere it is simply impossible to
address all the infractions that are
arising and so the privacy by design
model is proactive instead of offering
reactive regulatory compliance after the
fact to offer systems of redress we're
trying to also prevent the harms from
arising you think of a preventive
medical model much better to detect the
cancer and prevent it rather than allow
it to arise and offer chemo afterwards
so we're trying to prevent it and it's
not a concept anymore I can point to you
too we have a paper we did in December
called operationalizing privacy by
design in it we reference nine different
areas in which it's on the ground
working ranging from all the things you
might think of CCTV cameras biometrics
sensores you name it this can be
embedded in technology biometrics in a
way that on a go-forward basis you can
prevent the harm from arising and I
called last year the year the engineer I
went around the world trying to talk to
engineers to get their input how doable
is this every single person I spoke to
said of course we can do it if we get
those instructions at the time we're
designing the technology where the
business practice or informational
process if you address it at the outset
you can embed it into the data
architecture into the processes you can
make it a reality and minimize not only
your the privacy items but the cost your
organization by avoiding the data
breaches avoiding the harm to your brand
into your reputation you can do all of
this at a fraction of the cost by
embedding it at the outset into the
process and so it I'm glad to say it is
in fact a reality its operating all
around the world and if you go to our
privacy by design dot CA website you'll
find countless of examples of how it's
working on the ground right now and
and just just to build because we've
been talking a lot this these past
couple days about reform to our laws
particularly our reform in Canada and
the need for it and we are starting to
see privacy by design being incorporated
into legal requirements in other
jurisdictions I think I know the answer
but would you like to see pbd
incorporated into our laws like made as
a specific requirement in our privacy
laws I would love that and we wrote a
paper two years ago privacy by design in
the law and we had a forward from the
Honorable Pamela who was here Jones
harbour I don't know where she is but
she wrote a wonderful forward in how
they were contemplating doing this at
the FTC in the United States of Federal
Trade Commission we have in Ontario a
privacy by design center of excellence
that the Ontario public sector has just
put up now so it is inching its way into
government organizations if we could
find a way to introduce it in
legislation and the way you would do
that is you're not going to tell people
what to do you're just going to plant
the notion of proactively embedding some
privacy protective features at the
outset of programs and initiatives and
technologies and if you could plant that
seed then maybe it would grow and would
I was going to say minimize our work
it's not going to minimize our work
because there's that work is growing
even the tip of the iceberg but it would
be amazing because it would minimize the
harms I've seen that again and again so
hopefully take a look at the oh p.s a
center of excellence for privacy by
design it was just initiated about six
months ago and it's really growing Thank
You Liz no I think the point is if
you're going to adopt shiny new toys and
you know new ways of crunching data then
you have to have privacy by design and
privacy by design is part of a
comprehensive accountable organization
I'll keep saying those words over and
over so do you think it's already exists
it does I mean there are Pathfinder
companies
there are Pathfinder organizations I
think particular and financial services
certainly in some of the telkom's
obviously the health sector you can see
some real leaders in this work but we
need to go further and you know what
I've been talking about now is the
public sector because arguably they
should be held to a higher standard than
the private sector because the state can
compel our information and let's face it
facebook doesn't knock on our door at
three o'clock in the morning so I think
the public sector needs to step up and
do a much better job of privacy by
design of accountable full some privacy
management program so that's where I'm
going next any bc public bodies here
she's on the warpath next question a
pre-employment criminal background
checks are there no longer necessary
because we have facebook they're a handy
tool for next year's hockey draft picks
are there an invasive screening
technique that should only be used in
limited circumstances Commissioner
Clayton you wanna had tackled i won hmm
I think the answer is C but I think
there are an awful lot of organizations
that think the answer is a unfortunately
Alberta actually doesn't have a great
rep for criminal background checks I
think there was a report was it last
year the Canadian civil liberties did a
study of criminal that was pretty
release information checks yeah and
Alberta did not come out very well in
that
in that study and I think that part of
the problem is that there's no there's
there are no standards in Alberta at the
moment for criminal background checks
and and what an organization's an
employer might be asking for on the one
hand and what they actually need are
also two very very different things so
you know I do know that there's a
there's a group that's gotten together
in Alberta that's actually taking a look
at at criminal background checks and
what information is collected and what
information is being shared and I know
that you know Liz will have something to
say about this because she's done a an
interesting report on the topic I think
all I'm going to say is that we haven't
looked at it very deeply in Alberta we
get occasional complaints and we've been
very we've been reactive to that but we
are involved with this group right now
that's trying to proactively figure out
how to solve some of the problems when
too much information is being shared and
organizations are collecting this
information with again without first
turning their mind to do I actually need
this information and of course once you
get this information that brings on a
whole other set of responsibilities what
are you going to do with it and how are
you going to limit access to it and how
long are you going to keep it because
it's a snapshot in time and what if you
ask for this information you find out
something that raises flags for you is a
DUI a problem is a break and enter with
like you know it raises all sorts of
issues it's a far more complicated thing
than just we're going to as a blanket
program do criminal background checks on
everybody yeah so it's tricky and I know
will you'll have some calm
on this well we are office did an audit
of the bc provincial governments
criminal records check policy and we
found that there there has to be a nexus
between the requirements of the job and
what kind of background check you're
doing so whether it's a criminal
background check or other types of
checks so I mean that's the principle
the bc government was not only doing a
criminal records check on everybody but
also doing a recheck every five years
and every time somebody changed jobs so
our report came out and we had eight
recommendations the provincial
government backed off on their recheck
policy they backed off and defined more
clearly the types and classifications of
jobs for which there should be a
criminal records check that was one
thing might I have what is keeping me up
at night our police information checks
so criminal records checks are a check
for outstanding charges and convictions
police information checks is a broader
review of all kinds of information
that's in a police database collected
for law enforcement and again revealing
all kinds of negative police contact
complaints about the neighbor
investigations that have not resulted in
a charge and I think that information
may be valid for law enforcement it's
not valid in the context of employment
and last time I checked in Canada there
was a presumption of innocence and so
I'm much more concerned about the
practice of police information checks
Michael McAvoy and I have been having
long discussions with both the police
services and employer groups in NBC
we're not moving very quickly on this so
my next step is an enforcement action
mr. Stoddard yeah Liz's touched
something that's really really
concerning to us in the federal
jurisdiction that is the broadening of
the information that some would like to
be available not only to
employers for background checks but also
to law enforcement and it goes far
beyond and and the the infrastructure is
being set up now far beyond do you have
a conviction but were you merely under
investigation what everything what did
you do in today's privacy news we see
that some would like to take DNA samples
from people who are mere suspects and so
this constant constant broadening of the
circle of information of anybody who
could be rightly or wrongly nearly or or
more distantly connected with a possible
criminal is certainly of great concern
it's just concerning absolutely okay
public opinion surveys about privacy
reveal wallhack whatever you want them
to say privacy is dead or that everybody
has a crush on Sidney Crosby even me
although not not right now I'm suspend
I'm suspending my crush on Sidney Crosby
that individual still care deeply about
their privacy commissioner's daughter
well I certainly don't have a crush on
Sidney Crosby because I'm gonna be him
tonight yes and as for privacy being
dead the only people ever said that had
a vested monetary interest in killing it
so that leaves us with see let's see
what some of our polling can say about
that in fact it tends to contradict that
statement quite radically I mean when we
pull Canadians and I want to give this
to you accurately so I'm going to read
from a press release many Canadians
reported being very concerned about
posting information about their location
and their contact information the
majority of
said that they decided not to install or
to have uninstalled a nap because of the
amount of personal information they
would have to provide and over
two-thirds of Canadians say they have
chosen not to use a site or a service
because they were uncomfortable with the
terms of the privacy policy and as I
explained to those of you who were in
the audience yesterday that's probably
an underestimation so privacy is far
from dead for Canadians it's a real
concern folks who use mobile apps or a
little more savvy I would say that's
about what they do to protect themselves
that's all good but some other
statistics that should give us all pause
to reflect the importance of this value
71 percent that's almost three Canadians
out of four think protecting the
personal information of Canadians will
be one of the most important issues
facing our country in the next 10 years
only one in five think the federal
government takes its responsibility to
protect personal information seriously
and only thirteen percent feel that
businesses are serious about their
privacy responsibility and I don't know
how many of you have heard about
notification fatigue this is often
brought up Oh even if we had data breach
protection people don't want to be
notified in notification fatigue they
just throw all these things in the
garbage and so on well we've never
really had it except in Alberta so we
don't know that much about it but 97%
ninety-seven percent that's almost all
of the Canadians fold want to be
notified by an organization if their
personal information was compromised so
you know I think privacy is certainly
alive and well and this is I'd say a
growing concern among canadians
excellent excellent thank you very much
speaking about mandatory breach
notification it is a total pain and you
know what only followed by those
who are worried about media attention or
critical as a means of demonstrating
accountability in openness and as the
Commissioner with the jurisdiction in in
Alberta you have mandatory breach
notification so maybe you can tackle
this question Jill well we have we have
mandatory breach reporting to my office
and then I have the ability to require
organizations to notify individuals who
have been who are at risk of significant
harm as a result of that reach I do just
want to follow up something that
Commissioner started sooner about
notification fatigue because I remember
before Albert is law came in and you
hear that all the time you know this is
the problem with mandatory but I have
never ever ever had anybody come up to
me and say you know I got so many
notifications of privacy breaches I'm
really tired of getting these things has
anybody ever said anything like that I
don't think that's a real issue so
mandatory breach notification is a total
pain in the you-know-what sometimes yeah
we we get a lot of these things and I
know it's a lot of it's a lot of work
for staff when a whole bunch of these
things come in at the at at any given
time all at once I'm saying in the
session earlier today that we get about
10 of them a month on average but it
doesn't actually work out to 10 a month
they don't come based like you're giving
us some stats because the oilers haven't
generated very much over tell Michael to
stop emailing you put your blackberry
away don't think I don't know what's
going on here and I like stats everybody
knows I likes tennis I know you do so it
can be a total pain in the you-know-what
but um ultimately and to some extent it
is a mandatory breach notification is
about those who are worried about media
attention but you know we used to get
self-reported breaches voluntarily all
the time before there was a mandatory
requirement in the legislation to report
these things to us and that's because
organizations want us to know ahead of
time because somebody's going to find
out the media is going to be all on it
and they'll come to us and they'll say
what do you know about this
thing and so organizations have always
reported well not all breaches but they
have reported to us because they want us
to know and they want to get some advice
and guidance on dealing with the issue
and they want to be able to respond to
the media for sure and I'm okay with
that but I do think that that breach
reporting to us and certainly notifying
individuals when individuals are at risk
of harm from a bridge is absolutely
critical and part of demonstrating
accountability and openness and frankly
just respect for your customers and your
clients mean the point of notification
is that individuals will be able to take
steps to protect themselves and this
part of control we've already spoken
about control it's about openness it's
about a transparency that's all of those
things it's just the right thing to do
in many cases so I think our experience
with breach notification has been really
positive i was saying again today that
you know we're still learning where
we've just passed the three-year mark
having mandatory reporting to my office
what i think is really encouraging is
that you know these reports do come to
the office and in an extremely high
percentage of cases it's something like
eighty percent of the time the
notifications already happened so you
only have to report to us if it's a real
risk of significant harm if you've
decided there's a real risk of
significant harm and you need to report
to me then chances are you've already
talked to the individuals people are
sending out notifications and i think
one of the the good things in the
legislation also is that it's fairly
prescriptive in terms of what needs to
be in a report to me but it's also
prescriptive in terms of what needs to
go in the notification statement at a
bare minimum you have to tell people
certain things give them information
about the incident what you're doing to
to fix it so there's room for
improvement I mean who knows what the
next round will look like we'll probably
have some suggestions it's still early
days as we work through it but I think
it's generally been a very positive
thing we're getting a lot more where we
have information we have knowledge and
and data and trends and real-life cases
we can go back to that we can turn into
outreach efforts and guidance documents
to help organizations to deal with these
things and respond when and hopefully
avoid some of these breaches Chris we
also have mandatory breach notification
and Ontario under P HIPAA we had it
since 2004's are approaching 10 years
very very successful but what's
interesting especially when you're
dealing with patients we've worked we
always work with the healthcare
custodians to develop something that is
not a one-size-fits-all when you're
talking about patients and they just get
a cold call letter in the mail notifying
them of a breach relating their personal
health information it's very very
stressful last thing you want to do is
add to the stress of patients going
through a health care crisis so we often
work with physicians for example if
they're going to have some of those
patients involved or repeat patients
that they see on a weekly basis for
example then we draft a script with them
that they can give verbally to the
patient when they come in at their next
visit and that is much less stressful
for example then cold call letter you
get in the mail and you don't know what
to make of it in terms of thing how
harmful is this so many ways to do it
it's an invaluable tool and it can be
done very creatively at times
the question we've all been waiting for
which team will win the Stanley Cup
toronto blue jays who cares we all have
privacy issues or go sans go we can
believe in the miracle seriously again
we come to the end of our game show and
and i'm just personally again taken
aback at your willingness to participate
and your willingness to have fun with us
every year at the symposium and it goes
a long way and i know that we all really
appreciate the fact that you guys take
your time out of your busy schedules to
do this with us and i just wanted to say
I'm really appreciate it thank you
I know everybody we paused for lunch you
actually do have dessert coming up and I
understand it's a yummy one so you might
want to stick around for that and
there's still a few sessions left
there's some sessions that start at two
o'clock so if you want to if you want to
join those sessions you're more than
welcome to for everybody who's going to
be taking an exam later on today good
luck last-minute cramming is always good
but make sure you have it after dessert
and just really quickly I I do want to
say a personal thanks from from me but
also I think we're all thankful for the
IEP piece staff who put on an absolutely
wonderful conference for us these past
few days all the people over at the
registration desk and the women wearing
the the beautiful scarves I'm very
appreciative of all their hard work and
I'm sure you guys are too so thank you
very much