I want to now take the time to introduce
our first keynote speaker and we call it
the keynote speaker because every year
during his mandate he's always agreed
even in difficult times and when it
conflicts with his schedule he always
somehow manages to make it work and and
it's to hear from the Privacy
Commissioner of Canada
Daniel Terry and his annual address to
the profession Commissioner Terry a was
appointed in in June of 2014 after three
decades serving Canadians as a lawyer
with various federal departments and
human rights issues were we're we're
human rights issues were important he
said that the overarching goal of his
mandate is to increase the control of
Canadians have over their personal
information and I think his remarks this
morning will probably touch on this
overarching goal since his appointment
he is champion privacy rights in the
public debate over national security and
public safety
he's led research and investigations
into privacy issues that go to the heart
of consumer trust and confidence and and
I'm sure we will have a lot to learn
from his remarks this morning please
join me in welcoming Commissioner Daniel
Terry to the stage
[Applause]
good morning I'd like to be here in
Toronto to for this annual address like
to see all of you and we have a few
announcements to make today that may not
be as riveting as the gdpr
but we'll try our best at this midway
point of my mandate as Privacy
Commissioner it has become increasingly
clear to me that to have a more positive
impact on the privacy rights of a
greater number of Canadians we at the
OPC need to change our approach to
privacy protection a young complete de
la medida mama dada concern in bossam
Aveda capone new cottage in a deep
ravine area unknown world the Canada's a
new the home it's fee not approach and
here I am NOT referring to the need to
modernize our laws although that remain
that remains in ssed
even more so in my view after the
Facebook Cambridge analytic and
aggregate IQ event or crisis amending
legislation is of course not within the
OPC remit but we are not waiting for
government to act what we're trying to
do is to breathe new life into old laws
with a vision of a more proactive
approach to privacy protection you may
recall that this is something I
discussed at this conference last year
but since then we have fine-tuned this
new approach we've set some ambitious
goals for our work we've made some
important structural changes at the OPC
and we are putting our vision into
concrete action so these are the themes
that I want to focus on most in my
remarks today the context that all of
you are aware of is that the scale and
pace of technological advances and
use in business and government
organizations are significantly
straining the ability of individuals to
protect their privacy innovation in the
areas of data analytics artificial
intelligence genetic profiling and the
Internet of Things raises novel and
highly complex privacy risks now we
realize that these technologies are
necessary for economic growth and to
improve government services but they
must be used in a manner that respects
the privacy of Canadians people want
both we also believe that many
organizations want to do the right thing
and we want to help them with that and I
have a few announcements on that point
this morning as such and to address some
of the challenges we face we've made
significant changes to our
organizational structure that we believe
will help us achieve better results for
privacy
we have streamline our operations by
clarifying program functions and
reporting relationships and B and we've
become more forward-looking by shifting
the balance of our activities towards
greater proactive efforts our objective
as I descend is to have a broader and
more positive impact on the privacy
rights of a greater number of Canadians
which is not always possible when
focusing most of our attention on the
investigation of individual complaints
with that in mind our work will now fall
into one of two program areas promotion
or compliance activities aimed at
bringing departments and organizations
towards compliance with the law will
fall under the promotion program while
those related to addressing existing
compliance issues will fall under the
compliance program in the coming weeks I
will be announcing the two deputy
commissioners who will oversee these two
new sectors now we know that a
successful regulator is not one that
uses enforcement as a first or primary
strategy to seek compliance
thus our first strategy will be under
the promotion program to inform
Canadians of their rights and how to
exercise them and to guide and engage
with organizations on how to comply with
our privacy obligations guidance and
information will be issued on most key
privacy issues starting with how to
achieve meaningful consent in today's
complex digital environment which I will
discuss in greater detail in a moment so
I notice Chris that your recent book
speaks of law and policy maybe you'll
need to update your book given the
amount of guidance we intend to publish
we will also work with industry
proactively and collaboratively in an
advisory capacity
that's a bit newer to the extent our
limited resources allow we will seek to
better understand privacy impacts of new
technologies and provide practical
advice on how to use them in a Privacy
compliant way addressing privacy issues
upfront and resolving matters
cooperatively outside formal enforcement
is our preferred approach it avoids
time-consuming and costly investigations
helps mitigate against future privacy
risks offers organizations a measure of
consistency and predictability in their
dealings with our office and I'm open to
questions on that point after and allows
everyone to benefit from innovation it
is for these reasons that we will
primarily consider our promotion tools
before engaging our second strategy
proactive enforcement under the
compliance program our proactive
enforcement actions will target systemic
chronic or sector specific privacy
issues that are not being addressed
through our complaint system and that we
believe may inflict significant diamonds
to the damage to the privacy rights of
Canadians
so by delineating our activities more
clearly under two programs compliance
and promotion by being more proactive
and by ensuring that we are citizen
focused giving practical actionable
advice both to Canadians and to
organizations
I hope Canadians may begin to feel more
empowered and in control of their
personal information and generally safer
in a knowledge that their rights will be
respected now I'd like to elaborate on
some of the work we will be doing in the
coming year under this new approach and
this new structure through our
restructuring the new business advisory
Directorate formerly the Toronto office
that will continue to be in Toronto but
will have slightly amended mandate that
Directorate will aim to provide advice
to businesses subject to pivot on in
part we want to proactively engage with
organizations on a voluntary basis on
privacy risks at a high-impact nature
either upon request or based on our own
intelligence the aim of this to gain a
better understanding of innovative new
business models and practices and to
address and potentially resolve any
privacy concerns before they materialize
we also want to explore the possibility
through pilots because resources will be
an issue we have too few resources for
this of responding to advice requests
for smaller businesses who are not
necessarily at the cutting edge of
technology but who nevertheless have a
significant impact on the privacy of
Canadians given resource pressures as I
said we will need to be selective at
least for the moment in deciding which
projects we are going to take on by the
way the Toronto office will no longer
perform investigations this is because
we want to make a clear delineation
between compliance and promotion
functions the business advisory
Directorate is part of promotion it is
when you get a call from PIPA de
investigations and compliance that you
should start to worry
so this year on the engagement front I'm
pleased to announce the first advisory
project initiated by my office which is
now underway it relates to sidewalk
Toronto a smart city and ever between
Waterfront Toronto and sidewalk lands
owned by Google's parent company
alphabet the initiative which I expect
most of you are familiar with involves
building a technology driven
neighborhood on the city's eastern
waterfront that includes sensors aimed
at helping city planners find
efficiencies understandably this
initiative is raising many questions
about data collection privacy where the
information will be stored how it might
be used including whether it will be
sold or used for marketing purposes last
month
members of our business advisory
Directorate along with a colleague from
the Ontario IPC met with those behind
the project to learn more about it and
how they were addressing some of these
privacy concerns overall we were
encouraged by their efforts to
proactively address privacy and data
security and the design and
implementation of the initiative we
reminded officials of key privacy
principles including purpose
specification of course with some degree
of granularity ensuring individuals
could access their own personal
information and being accountable for
protecting that the data and being fear
about who owns it we also emphasized as
you might imagine the importance of high
standards and techniques when it comes
to di notification of data to mitigate
the risk of re-identification and that
any open that a component to the
initiative would be done in a privacy
protective manner given that the project
is still in its early stages we will
continue to monitor developments and
proactively engage with sidewalk auto
officials as it progresses the
government sign our government advisory
Directorate is also in the business of
giving advice to federal departments and
institutions
and we plan to do more of this going
forward again with the philosophy of
bringing departments towards compliance
with the law as they deliver services to
Canadians we were we recently concluded
a series of stakeholder engagement
sessions with federal departments to
help inform our efforts as we realign
our advisory services we are
consistently asked to provide more
guidance to individuals on how to
exercise their privacy rights and to
organizations on how to respect their
obligations resources permitting we have
committed to doing just that and have
identified 30 topics on which to get
started these are found in our annual
report the consent report of the fall of
2017 at the top of the list our consent
and no-go zones I'm pleased to announce
today that our final guidelines for
organizations on obtaining meaningful
consent and inappropriate data practices
are available it should be on our site
as we speak as I speak the consent
guidelines are in fact a joint effort
with our Alberta and British Columbia
counterparts because we share the no
signaling direct risk so that national
morality in accept I'm I'm at Celtic at
Maddy Denis
so on this podium I can't eat noodle
jure among other important advice in the
meaningful consent guidance we outline
four elements that must be emphasised in
privacy notices and explained in a
user-friendly way first what personal
information is being collected second
with which parties it's personal
information being shared third for what
purposes is being collected used or
disclosed and fourth what are the risks
of harm or other consequences that might
come from any collection use or
disclosure of the information some have
expressed concerns about our decision to
include risk of harm among the four
elements to be emphasized this decision
that were making as a
flows from the definition of valid
consent in the act in Pepita the Act
requires that an individual understand
the nature purposes and importantly the
consequences of the collection use or
disclosure to which they're consenting
among the consequences might be harmful
consequences but what we're talking
about is not any and all risks of any
and all harms what we're talking about
are those residual risks that might
remain despite an organization's best
efforts to apply mitigation measures
designed to minimize risk and impact of
potential harms in the end only
meaningful residual risks of significant
harm must be included in notifications
risks such as bodily harm
humiliation loss of employment and
identity theft
that fall below the balance of
probabilities but are more than a
minimal or mere possibility that's what
we mean by meaningful risk below the
balance of probabilities but more than a
minimal or mere possibility I know I
know that there may also have been some
concern about binding language in the
guidance while it is clear that we
cannot use guidance to establish new
legal standards we think are all as a
regulator includes giving guidance that
clarifies fit better requirements and
sets expectations as to how the law
should generally be interpreted and
applied given that PIPA is so broad in
nature individuals and organizations
need an adequate level of certainty
now let me give you a few some examples
of what we mean by guidance that
distinguishes between requirements and
best practices or recommendations the
four elements that I've just mentioned
that according to our guidance needs to
be highlighted or given emphasis in our
view are a requirement because it is not
possible in our view to have meaningful
consent a legal term without giving
emphasis to these four elements now
there's an issue about the level of
detail that each of these elements needs
to have in order to constitute proper
notice but there needs to be emphasis of
the four elements at some level of
specificity but the level of detail will
will depend for instance one of the four
elements is that individuals need to be
informed of the third party's with which
the organization collecting the
information will share the information
the requirement that we for which we see
a clear and direct connection in the act
itself is that these third parties need
to be described in sufficient detail for
the individual to understand what it is
that they're being asked to consent to
we also say in the guidelines as it was
in the draft that ideally all third
parties should be described that is a
recommendation that is not a legal
requirement so third parties need to be
informed need to be in the individuals
need to be informed of the third parties
with which information will be shared
these third parties need to be described
in sufficient detail for individuals
giving consent to understand what
they're giving consent to how many of
them are there how you do that the level
of specificity the advice that we give
in the guidelines is a recommendation
it's a best practice
similarly we speak about layering in the
guidelines and that clearly is a best
practice that's not a legal requirement
so in order to describe for consumers
the third parties with which you will
share information that needs to be done
in sufficient details ideally all of
them all of the third parties and
layering is a recommended best practice
to get to that point without burdening
the individual getting consent with too
much information a very important change
that was made very useful I think point
that the change that was made between
the guidelines that were issued in draft
form in September and what appears today
on our site is that we were we were
asked during the later set of
submissions and discussion with
stakeholders that we had to make the
distinction between what we feel is a
legal requirement and what we feel is a
recommendation or a best practice so
that should should be clear through the
words using a guidelines musts insured's
but also at the end there's a checklist
to serve as as a reminder of the
distinction where we see the the advice
that we give as flowing directly from
the act and therefore a requirement
versus best practices as I mentioned we
also launched new guidance on no-go
zones and I see that time will go by
pretty quickly so I will just say that
the guidelines are also up in final form
on 5:3 and in appropriate practices when
will these guidelines be applicable the
five three guidelines I do not think
there's any reason to delay the
application of them these are
appropriate practice isms so we propose
that they would become applicable very
shortly that is on July 1st however
because the consent guidelines may be
our organizations to implement changes
to their systems and practices their
application will begin on January 1st
2019 bar Bucknall our director of policy
will speak more fully to these
guidelines later at the conference I
spoken at length about promotion and
guidance we will continue to of course
undertake investigations and enforcement
in part responding to complaints as you
know we have an obligation to
investigate complaints that are
presented to us subject to very few
exceptions but we will also undertake
proactive investigations as I mentioned
particularly in areas that are more
opaque or less obvious for individual
consumers and on that front I'm
announcing today that we're proceeding
with our first proactive industry-wide
Commissioner initiated investigation
into the privacy management practices of
data and list brokers organizations that
deal in lists are responsible for how
the information is compiled which
includes obtaining consent from those on
the lists preliminary inquiries with
industry practices have raised a number
of concerns about how databases of
Canadians detail personal information
are being compiled and then subsequently
disclosed to marketers detailed profiles
about individuals may be inaccurate and
could be accessed and used for purposes
that individuals may know nothing about
as such our investigation will look at
accountability openness and transparency
in the management of personal
information collected used and disclosed
as well as the means of consent obtained
for the personal information collected
used or disclosed in total will we will
be investigating the practices of six
different data brokers this would
include a consideration of castle and
the address harvesting provisions and
force by my office we believe that this
industry can benefit from an
investigation of this nature
and that Canadian consumers will welcome
it
I understand Brent Holman will be
speaking more to our proactive
compliance efforts in another panel so
in closing I think you will agree that
we have set an ambitious agenda
not to mention homework for Chris by
enhancing our advisory role we can help
organizations achieve their objectives
in a Privacy compliant way and foster
greater confidence among Canadians that
they will that will only serve to
benefit the digital economy I'm
confident that changes to our approach
will be good for business businesses
that want to be responsible corporate
citizens it will be good for federal
institutions that wish to maintain the
trust of Canadians and of course it
should be good for Canadians who
ultimately want greater control of their
personal information and respect for
their rights thank you very much
[Applause]