thank you Chris and thank you for having
pointed out that I'm quite old I'm glad
to be here in Toronto today of course
glad to be here at the IPP symposium
it's an important day for us we're
launching an important exercise with
respect to the consent model so here it
is the suspense is over a widely cited
study dating back to 2008 suggests that
Internet users would need to spend 244
hours per year that's nearly 33 workdays
to read much less understand the privacy
policies of the websites that they
visited fast forward eight years add
mobile applications smart devices and
wearables to the mix it seems clear in
our current context that reading privacy
policies could be a full-time pursuit
with untold time hours of overtime this
situation serves to highlight one of the
many challenges that new technologies
have brought to bear on the current
consent model the fact is Peppa da
predates smartphones cloud computing and
business models predicated on thank you
on unlimited access to personal
information and automated processes that
use complex algorithms to extrapolate
new information from very large data
sets
gone are the days of routine predictable
and transparent one-on-one interactions
with companies it is no longer entirely
clear who's processing our data and for
what purposes while some would argue
that privacy policies have become more
about shielding organizations from legal
liability their intent is also to armed
individuals with the information they
need to decide whether to give or
withhold consent is it fair then to
saddle consumers with the responsibility
of having to make sense of these complex
data flows in order to make an informed
choice about whether or not to provide
consent suffice to say that technology
and business models have changed so
significantly since bifida was drafted
that many now describe the consent model
as not up to the task we heard this time
and time again last year during our
consultations on our strategic privacy
priorities when I spoke at this
conference a year ago I indicated that
the economics of personal information
would be a key focus for my office over
the next five years and that under this
priority we would examine the current
consent model with a view to improving
it so I am pleased today to announce the
launch of a discussion paper examining
potential changes to the consent model
we want to start a conversation across
the country and we will be consulting
widely with yourselves with others on
how to address this issue in my remarks
this morning I will touch on some of the
proposed solutions but more importantly
I would like to focus on the roles and
responsibilities of the various players
in this world in which privacy often
seems elusive it will be important I
think to clarify the expectations of
individuals organizations regulators and
legislators I will conclude with a few
thoughts on Privacy Act the public
public-sector legislation in terms of
pippa da it is unlikely that any one
solution could serve as the proverbial
silver bullet but we believe a
combination of solutions could help
individuals achieve greater privacy
protection which is our ultimate goal so
let's talk about the roles of various
players now when it comes to consent
individuals play an important role as
privacy is linked to individual autonomy
but is it fair to assume that average
Canadians will be able to demystify the
complex business relationships and
algorithms what's essentially under the
hood in terms of the processing of
personal information is the solution to
provide individuals with better
information on these complexities so
that they may make informed choices or
must must we find other ways to protect
their interests leaving them to decide
matters for which they can reasonably
and practically indicate their
preferences organizations on the other
hand have a legitimate interest in
processing information for business
purposes they must however be held
accountable in a very meaningful way
what incentives should exist for
organizations to implement greater
transparency and privacy preference
mechanisms to enhance individuals
ability to provide consent to what
extent can businesses be expected to
self-regulate in a matter that protects
individual privacy in the digital age
while organizations have a role in
ensuring the protection of their
customers they are not impartial and
will ultimately act in their own
interest consumer trust and effective
privacy protection demand the
intervention of independent and
impartial actors that are capable of
holding organizations to account and
protecting the interests of individuals
courts have a role to play here
but in most countries including Canada
the EPA's privacy commissioners have an
important role to play to this end what
are the necessary attributes and
authorities of an effective regulator
how best can data protection authorities
ensure that the interests of individuals
are protected and that organizations are
held accountable for their actions
currently my office plays a more
reactive role where generally we
generally investigate complaints after a
violation has occurred would it be
reasonable to give my office the
authority to oversee compliance with
privacy legislation more proactively
before problems arise and in most
countries as you know regulators have
the authority to issue binding orders
and to impose financial sanctions
against organizations why not Canada
while many proposed solutions may be
implemented within the current legal
framework others may require legislative
change is it time to call upon
Parliament to expand the powers of the
office of the Privacy Commissioner
should privacy by design become a
legislated requirement as it will soon
be in Europe should pipita be amended to
provide for no-go zones or conversely
for new legal grounds for processing
where consent may not be practicable
these are the sorts of questions we're
hoping to answer during our consultation
process let's move now to potential
solutions one school of thought suggests
the existing consent model may be
enhanced through mechanisms that improve
the ability of individuals to exercise
meaningful consent proposed solutions
involve providing consumers with better
information giving them the ability to
manage preferences across different
services and ensuring privacy is no
longer an afterthought but is rather
bait or design into products and
services
with respect to the Internet of Things
the US Federal Trade Commission has
proposed a number of promising solutions
to improve the effectiveness of privacy
messaging in the IOT environment these
include QR codes that lead consumers to
more in-depth information set up wizards
to help users select privacy settings
and privacy dashboards the ability to
manage privacy preferences across
different services means individuals
will no longer have to inform themselves
of an organization's privacy practices
and decide whether to provide consent
each time they use a new digital service
this could also help for consent when
new uses of previously collected data
are proposed another school of thought
contends that information flows have
become too complex for the average
person and have called for relaxing of
requirements for consent advocates up
for this approach focus on
accountability and ethical use of
personal information placing the
responsibility for oversight on
regulators alternatives to the consent
model raised questions about whether
certain types of data users may be
permissible without consent so long as
the right privacy framework is in place
such models however begged a question do
we have the right oversight structure to
provide public assurance that their
information is being used for
appropriate purposes and that it is
adequately protected
Europe has a law that allows that of
processing without consent so long as it
is done for legitimate business purposes
and does not intrude on the rights of
the individual to proceed organizations
must conduct a balancing test to waive
the interest of the organization against
those of the individual a solution for
Canada might be to broaden the
permissible grounds for processing under
pipita to include legitimate business
interests subject to a balancing test we
might also consider legislating no-go
zones which prohibit the collection use
or disclosure of personal information in
certain circumstances no-go zones could
be based on a variety of criteria such
as the sensitivity of the data the
nature of the proposed use or disclosure
or vulnerabilities associated with the
group whose data is being processed in
our policy position on online behavioral
advertising for instance we've
identified the funeral go zones
including the tracking of children and
the use of tracking methods users can't
control now what should be the role of
organizations under pipita organizations
are already accountable for meeting
their obligations to protect their
customers personal information but
certain governance solutions could
further strengthen accountability
mechanisms codes of practice and privacy
trust marks for example can provide an
added measure of predictability and
consistency for companies in
understanding their obligations around
meaningful consent and appropriate
limits on data processing they may also
offer greater clarity for individuals
that their information is being
processed in a transparent and fair
manner that is in line with their
expectations these codes of practice and
privacy trust marks may be voluntary
best practices promoted by industry
or they could be developed by regulators
to serve as an enforcement tool under
Cappetta my office has a mandate to
encourage organizations to adopt
instruments such as policies policies
and codes of practice that are in line
with legislative requirements up to now
however this is not a provision we have
fully explored some commentators suggest
that in the age of big data where future
uses of personal information are
difficult to predict at the time it is
collected organizations should be able
to determine for themselves based on the
advice of boards of ethics and
accountability principles how data may
be used without the consent of
individuals should the private sector be
allowed to self-regulate in that manner
should legislation be amended to
authorize any use found appropriate by
an Ethics Board or should limits be
outlined in law in cases where
organizations have the ability to decide
whether data users are fair and ethical
what role should regulators play
accountability based solutions rely on
organizations to develop and implement
measures that respect their privacy
obligations including their obligation
to maintain meaningful consent while
there are positive aspects to the
ethical framework proposals discussed
earlier the process is internal to the
organization which inevitably places its
interests ahead of others independent
oversight bodies are needed to ensure
balance between the privacy rights of
individuals and the legitimate need of
organisations to collect views and
disclose personal information where
consent is impracticable and
organizations have a greater role in
deciding appropriate uses for personal
information the need for regulatory
bodies becomes even more
compelling so what attributes and
authorities should a regulator have in
order to be truly effective in
protecting the privacy rights of
individuals order making powers and
fines are some examples of enforcement
measures that could influence
organizations practices and strengthen
privacy protections for individuals in a
world where the traditional consent
model is under significant stress the
ability to levy fines currently exists
in the data protection laws of some
European countries as well as in the
European Union's new general data
protection regulation while EU and US
regulators have order making powers my
office on the other hand can only make
non-binding recommendations and has no
power to order a company to comply or
levy fines it's also worth noting that
our current enforcement regime operates
on a complaint based model a privacy
incident occurs somebody complains to my
office and we determine whether the
there are grounds to investigate a
proactive enforcement model would
involve intervening at an earlier stage
to ensure an organization is complying
with measures such as no-go zones or
legitimate purposes legitimate business
interest provisions this could be done
for it for example through spot checks
or compliance reviews these potential
solutions raise an important question
for my office as the federal regulator
should we be given additional powers to
oversee compliance and enforce knee or
enhance consent rules certainly this
would bring us more in line with our
counterparts and provinces with private
sector privacy legislation that is
substantially similar to pipita as well
as regulators in the US and the EU which
have order making powers but of course
regulators are only part of the puzzle
as I've said before individuals
organizations and legislators
to have a role to play in any case these
are the questions I hope to answer
during this important consultation
process and we look forward to hearing
your views you've seen I think on the
screen the timetable that we have in
mind so today we're in mid-may making
public our consultation paper we would
hope to receive views from those who are
interested by mid-july and in the fall
we will proceed with meetings and other
ways to consult much along the way as we
used to define the private the strategic
priorities of the office last year a few
words sorry a few words now on Privacy
Act reform
as you may know I've recently testified
and submitted recommendations on private
Privacy Act reform to a parliamentary
committee I'm hopeful this issue will be
a priority for the government as the
basic protections and rights guaranteed
by the legislation had not been updated
since 1983 it goes without saying that
the law governing how federal
institutions collect use this close and
protect personal information is archaic
it's archaic on a technological from a
technological perspective from a
legislative perspective and from a
transparency perspective in terms of
expectations of citizens so the act is
in dire need of modernization to that
end I've made a number of
recommendations to Parliament 16
altogether I won't name them here but
for example it's important to reduce the
over collection of data by creating an
explicit requirement in law that
institutions only collect information
that is necessary for the operation of a
program or activity we also want
institutions to consult with my office
on draft legislation that may impact
privacy it's also critical given that
technology makes information collection
and sharing much easier that all
information sharing between departments
and agencies be governed by written
agreements that should be submitted to
my office we're also calling on
Parliament to finally enshrine in
statute a number of provisions that are
not currently afforded the weight of the
law for instance it should be a legal
requirement that institutions employ
appropriate safeguards to protect
personal information an obligation that
as you know was imposed on private
organizations through bill s form
government institutions ought to be
bound by law to notify my office of
serious privacy breaches another
obligation imposed on companies privacy
impact assessments for new or
substantially redesigned program
and services should be illegal
imperative we're further calling for an
explicit public education and research
mandate as I have in pipita the
flexibility to publicly report on
government privacy issues that are in
the public interest in a more timely
fashion not just through annual or
special reports to Parliament and we
also are calling for the extension of
the Act two ministers offices and the
Prime Minister's office without renewal
the protections of the Privacy Act are
proving to be increasingly out of touch
with Canadians in terms of how they
engage with the digital world in
conclusion the fast-paced evolution of
the digital economy due to constant
technological innovation has
fundamentally changed the privacy
landscape we are at a critical point in
which action is needed on a few fronts
Privacy Act reform as I've just said is
long overdue and the time has also come
to seriously seriously think about the
practicability of the current consent
model under pipita and how it might be
better supported or enhanced I would
encourage you then to read our
discussion paper and provide your
feedback as privacy professionals your
input will be extremely important beyond
that I would ask that you share this
discussion paper with your colleagues
and friends it's critical that we hear
not only from privacy experts but also
from advocacy groups academics educators
IT specialists and everyday Canadians
with that very important discussion
we're about to launch on the viability
and practicability of the consent model
that will be an important very important
initiative in my mandate and I hope that
through that process we find the right
balance between
relation and Privacy Protection with the
goal i have set out for myself when I
was appointed to improve the privacy
protection of Canadians thank
I think there's there's time for
questions so if people do want to ask
questions there are mics
if there are no questions I'll just
leave you with this thought so the you
will see in a discussion paper a fairly
complete not completely not completely
exhausted but a fairly long menu of
solutions and improvements possible to
the consent model obviously we need your
your comments on those that you find
most appropriate and effective but do
give some thought to the issue of what
is the appropriate role of individuals
it is their privacy that we are trying
to protect through rules and the
application of rules but the
consultation cell and you know as
experts that the consent model may have
limits in the in the current age so
absolutely I think we need to improve
the information that individuals have to
exercise meaningfully their their power
to consent or not to consent to the
usual information but we we also need to
think about the role of other players
particularly organizations and the role
of regulators which then suggests
perhaps certain roles for legislators
I'm I true I'm absolutely convinced that
many solutions can be found within the
current pavada for instance greater use
of cause of practice would not require
any letters of change but it may be that
certain solutions would require a list
of change and I will not be signed from
recommending changes if that is the case
so look at the solutions that we we
propose give you give us our comments on
that but also give serious thought to in
this day and age what can we ask and
what is realistic to ask of individuals
and if there are certain situations
where consent is impracticable what kind
of system do we need
so that innovation can occur so that
business interests can be fulfilled but
in a way that truly respects the privacy
of ions and individuals I'll leave you
with that thought thank you