I am Estella Cohen senior privacy
consultant at trust Ark and serve as a
member of the ia PP Canadian Advisory
Board I have the pleasure of introducing
our next keynote speaker dr. Michael
Geist he is a law professor at the
University of Ottawa where he holds the
Canada Research Chair in internet and
e-commerce law he has written numerous
academic articles and government reports
on the internet and law and was a member
of Canada's National Task Force on spam
he is the editor of in the public
interest the future of Canadian
copyright law which was published in
2005 by erwin law he is also the editor
of several monthly technology and law
obligations and the author of a popular
blog on the internet and intellectual
property law issues please join me in
welcoming to the stage one of Canada's
best-known voices on privacy issues
Michael Geist
great well thank you very much for the
introduction and thanks so much for the
invitation this is a room as I was even
walking around in the back earlier on
this is a room filled with people who I
have worked with who I long admired
followed not in the creepy sense but
followed - and and in terms of the
leadership that we've seen from so many
people and so it's it's a real honor and
a pleasure to have the chance - to come
and speak so I've titled this talk
tippet at 20 it's the time for Pipit at
2.0 as many of you will know we're
perhaps not thought a lot about this
year marks the 20th anniversary of the
introduction of Pippin I was in the fall
of 1998 as part of the OECD ministerial
on electronic commerce when the federal
government at the time was looking to
make a splash from a policy perspective
it introduced a number of different
things and one of them would become the
legislation that was PIPA and from my
perspective there that that arc and that
timeline resonates quite a lot today
because at the time much of the emphasis
was I guess partially on that oacd
ministerial but even more it was on what
was taking place in Europe and the
directive and the pressure that Canada
like many other countries was facing
with respect to our own set of privacy
rules and up until I suppose about 15
minutes ago when suddenly now everyone
is just thinking about their next eight
months and consent related rules up
until that moment I think that the focus
for many in the room indeed the focus
for many on the cot in this conference
is the GDP our this was from this
morning it's now about 10 hours away I
think and so there's been an enormous
amount of attention not on our law but
rather on the European law and part of
that of course is that our inboxes
nowadays filled with messages about the
GDP are reminiscent of what we faced
here in Canada with respect to castle
the anti-spam legislation and it also
reflects this conference and there are
an amazing array of panels including
many
on the GDP are many of you will walk out
of this and attend one of these two
panels that are focused on GDP our and
there are many more that run throughout
the course of the the next two days and
while I recognize the importance of
focusing and thinking about that
legislation and its implications for
Canada I have to admit it makes me a
little sad to be thinking about someone
else's law it's yes it's important and
yes it has implications for us but I
think much like in 1998 when there was
that pressure to think about someone
else's law and how we might ensure that
ours met the standard I kind of wish
that we would be spending more time
thinking about our own legislation I
think the Commissioner just did some of
that within the current construct and a
lot of the discussion that I think will
follow whether on consent or different
sorts of practices are critically
important but I note that he was
cautious to emphasize that this is
guidance that fits within the existing
framework and I guess what I want to
emphasize a little bit is whether or not
we have the opportunity indeed the
necessity to try to change that
framework itself recognizing that 1998
doesn't feel that long ago I must admit
to me but nevertheless it is a long time
ago a time that people weren't thinking
as much about privacy I think it's fair
to say and in the current environment so
many Canadians so many people around the
world are today identifying privacy
particularly online privacy and some of
the digital issues as a significant
concern a time that obviously predates
the commercial emergence of Google or of
social media or of Edward snowed it's a
different world from a privacy
perspective from the one that existed
back when we first introduced our own
legislation and it seems to me that many
of the kinds of issues that have emerged
can be made to fit we've just seen an
illustration of trying to do that but
I'd argue that I think we can do better
from a legislative perspective
indeed even from some of the examples
that we just heard from the Commission
the future is now with respect to issues
that a decade or more ago we might have
talked about as something in the
distance there is the sidewalk labs
initiative I should note that I'm the
interim chair of the digital Advisory
Panel for the Toronto Waterfront side of
the story but I'm speaking for we
haven't even met yet but I'm just
speaking obviously on my own behalf but
that notion of smart cities and how it
fits within privacy rules especially
when you can bring in federal
commissioners but there's provincial
commissioners there's a range of other
areas doesn't necessarily fit neatly
within our legislative framework it
artificial intelligence AI is on the tip
of everybody's tongue right now and so
to some of the privacy issues that come
alongside of it and of course the
implications of trade and privacy an
issue that frankly wasn't at all on the
agenda in terms of incorporating privacy
related issues within trade agreements
is the sort of thing we didn't think
about two decades ago but as we seek to
renegotiate NAFTA and conclude this now
the CP TPP tabled just this week in the
House of Commons containing provisions
that have direct implications for some
of our privacy rules our future is
really now with some of these issues now
20 years under pipit I'm not going to
spend 20 years cycling through
everything that we've experienced over
the last two decades but to pick up on a
theme again that the Commissioner raised
it seems to me that we have generally
been more reactive than proactive and we
didn't plan this but it is great to hear
the office emphasizing the notion of
taking a more proactive approach I want
to talk about being more proactive not
in the context of the advice that we
might get from a regulator but rather
being more proactive in terms of what
the rules themselves look like from a
legislative perspective we have had a
tendency I would argue in Canada to be
very reactive events happen and so we
call people before parliamentary
committees or we have commissioners or
other authorities say that they're going
to
investigate as these various issues
emerge and we've seen some of these
things of course literally just take
place over the last number of days now
in a sense that's natural events happen
the public becomes more engaged
concerned and there is that view that
well surely someone needs to do
something and so the most obvious
response is okay we'll investigate but a
more proactive approach both on the
investigative side that we just heard
about but potentially also in the way
that we might address this through
legislation I think would be valuable we
also have a tendency to look elsewhere
in Canada's still small and so we often
talk about not necessarily but our laws
look like but what other laws look like
and what they mean for us whether that
is of course the GDP you are and in that
sense we're joined by people from around
the world who are thinking about much
the same kind of things but so to u.s.
laws and other sorts of laws we're very
often our frame of reference isn't
necessarily what we have here but rather
what takes place elsewhere even when we
do have rules they've taken an awful
long time to come to fruition we will
finally of course get data breach rules
put in place and taking effect later in
a number of months but the length of
time it has taken for that to to run
through the legislative and regulatory
cycle is certainly not at internet speed
and yet while that has been happening
there have been any number of examples
sometimes it feels like on a weekly
basis of why these kinds of rules were
so essential we see it we saw it as well
with the anti-spam legislation I
recognize there are a diversity of views
about but it also took a very long time
to see some of those rules come to
fruition and indeed even some shelved
altogether with respect to the private
right of action in fact even when we get
Studies on these issues whether it's the
FE Committee or the most recent
consultation that we had on right to D
index or right to be forgotten
I think we've become accustomed in
Canada to timelines that really do run
almost in decades when it comes to these
kinds of changes as opposed to being
farm
more responsive in in the way that we
are seeing industry the way we're seeing
technology the way we're seeing the
public itself become more actively
engaged and interested in some of these
kinds of concerns I'd in fact argue that
if we take a look at the last number of
years certainly the last decade with all
respect to Canada's privacy
commissioners at the federal provincial
level some of whom are some of who are
the best in the world at what they do
and I think are recognized as such when
it comes to Canadian privacy law over
the last decade it is the courts that
have had far more influence on the way
that we conceive of privacy and the
kinds of rules that get implemented in a
range of different places we've got a
Supreme Court of Canada that on so many
issues has been the leader when it comes
to rethinking or at least thinking about
what privacy rules look like whether
it's the Spencer decision in terms of a
reasonable expectation of privacy with
respect to our personal information for
internet providers the duas case putting
at put it from the Supreme Court of
Canada involving Facebook and Debby do
as putting the issue of contracts and
privacy squarely before the court and
the ability or not to try to opt out of
certain rules we've seen of course more
recently with respect to privacy on text
messages in the Muraki case and there
are many others removed taking a look at
some of these issues in terms of search
and then even in some instances lower
courts that have taken a look at tower
dumps and those kinds of issues indeed I
would argue that the cutting-edge
privacy issues the place where
technology meets privacy in so many
instances we have gotten more answers we
have gotten more framing from courts
interpreting the existing law then we
certainly have had from legislature
legislators and I would think argue
belief from commissioners as well and
it's no fault of commissioners in some
ways they they are given the tools and
left to interpret them the courts are
are left with the same in the Supreme
Court of Canada of course when facing
these issues
has little choice but to grapple with
some of these kinds of issues and
concerns but I think it's high time that
we shift some of this dialogue back and
shift some of the framing and the rules
back to the rule makers not just the
courts in this regard and I've forgot
that it was also going to mention even
right to be forgotten with global 24h
case so if we were to take shift from
this more reactive approach to a more
proactive approach when it comes not
just to the enforcement side as we heard
about a few minutes ago but also with
respect to the legislative side what
might some of that look like as we stand
at this precipice of PIPA des at 20 I
would say that it's a pip at a 2.0 is
what we're thinking about and the
foundations I'd argue are pretty well
known we've there are many people in
this room that have contributed to the
dialogue around some of these issues the
kinds of things that we ought to be
thinking about should we choose to move
forward in a more aggressive proactive
fashion then we have to date when it
comes to some of these legislative
related issues now consent was at the
very top of my list and apparently at
the very top of the list of the OPC as
well and so what we've just heard is a
rethinking of some of the consent
related issues or at a minimum and
updating of some of the guidance to
better reflect the kinds of collection
use and disclosure of personal
information that we have and how we can
better ensure that all Canadians make
more informed choices when it comes to
the kinds of consents that they provide
now I think that discussion that we're
going to see take place and indeed the
implementation that we're gonna see take
place over the next number of months is
is incredibly valuable I was excited
just sitting in my chair hearing about
these kinds of changes in thinking about
what some of those implications might be
not so much for the workload of many
people here in this room but rather what
it will look like one once it gets
operationalized for individual Canadians
in the same way that we've seen any
number of other Privacy Rule
changed the way people conceive of and
understand the information that gets
collected whether it's those annoying
emails through gdpr or other related
issues if you get a security breach
notice and they're like this too has the
potential to put this squarely in front
of Canadians and say here's what he's
actually happening and allow them enable
them to make more informed choices but
as I've referred to just a moment ago I
am conscious of the fact that all of
this still takes place within the
context of guidance and within the
context of the current sets of rules I
think it is worth asking the question
and I think actually have the answer
about whether or not we would be better
off with the full certainty of taking
these kinds of updated notions of what
consent really ought to mean in today's
world and ensuring that it is better
reflected within our legislation so to
from an enforcement and penalties
perspective this is an old issue that
goes back now really since the very
origins of PIPA down
but we are an outlier when we compare
our rules at the federal level with
privacy and data protection rules around
the world and you can't have a truly
effective legislative lead set of rules
can't have truly effective legislation
without ensuring that the enforcement
side has real power I can recall
discussions on that anti-spam task force
many years ago as to whether or not PIPA
duck could be an effective tool to
counter spam and one of the real
questions was that well we've got we
know who some of the spamming
organizations are they are sometimes
engaged in criminal activity and the
question was why would they even listen
to a Privacy Commissioner whose rules
are by designed to issue findings and
has to ultimately go to a court in order
to enforce and the answer came that
ironically enough built into the
legislation those same organizations
engaged potentially an unlawful activity
and we were operating on the assumption
that many were in fact operating under
with unlawful activity would be happy to
comply
wouldn't be happy they would be willing
to comply with investigations because
there were real penalties if you fail to
cooperate with an investigation and yet
what at the end of the day if all you
were left with was finding it would take
years through the court systems before
any of that might be enforced we ought
to do better within our legislation from
the very outset we have to recognize I
think that this law was conceived of and
passed at a time when the online digital
world looked entirely different from the
one that it does today the phones in our
pockets the the the SIRT the social
medias that we interact with the search
engines the wide range of apps and other
companies simply didn't exist now there
may have been people who were involved
in the process at the time that will
argue that they had the foresight that
they had the knowledge that all of this
was coming I'm not so sure anyone could
have fully predicted what this world
looks like today there were people that
did but I don't think that the design of
the law which was largely as everyone
knows designed to piggyback over even
earlier work through the Kent Canadian
standards Association really envisioned
this kind of world and so when we engage
in activities like a right to D index
and those kinds of consultations trying
to find ways to fit those notions into
existing laws I think with all respect
we do a bit of a disservice I don't
think they fit well within our current
rules our rules need true updating with
respect to online reputation and some of
the emerging technological online issues
whether AI or machine learning and the
like and I don't think that the law as
it stands today fits as well as it might
closely aligned with that of course is
some of the big data related issues
where the collection of data surpasses
what almost anyone might have imagined
twenty years ago our laws haven't kept
pace and while we talk about
transparency as being an important
notion and we've seen any number of
Canadian companies become more
aggressive with respect to issuing
transparency reports we still don't have
anything close to uniformity with
respect to that in fact we have some of
the largest most important organizations
some of the largest data collectors in
Canada who still do not issue annual
transparency reports they still tell
their customers in effect we will
collect your data we'll use it you may
disclose it there any number of things
we might do with it but we will not tell
you how many requests we've had for that
information the number of disclosures
that we've had for that information the
sorts of things that today for I think
most credible organizations operating in
the space would be seen as simply a cost
of doing business would be seen as being
part of the quid pro quo for being
trusted with our personal data so when
you're a large telecommunications
company or a large marketing agency and
you still don't issue regular
transparency reports that's a problem
that the law itself still doesn't
require this as a core element within
the law I would say is an even bigger
problem and surely part of what a
foundational tip at a 2.0 auto look like
now those are and it said some of the
foundations I'd like to finish up in my
last couple of minutes by highlighting
at least three principles that I think
ought to be imbued with in some of that
discussion one is that this ought not to
be just a discussion about the private
sector I think what we have also learned
whether through Snowden or otherwise is
the growing realization is we ping-pong
between are we more concerned with what
the private sector is doing with our
information are we more concerned with
what government might be doing with our
information I think the answer at the
end of the day of course is both that's
not to say that people have ill-will I
think that most organizations and
virtually all organizations in virtually
all in government have best of
intentions whether it's to keep us
secure whether it's to do business in
the right way and yet what we also know
is that if the rules and the enforcement
systems don't fully grapple with some of
these issues mistakes are made or more
aggressive interpretations of the law
are made and what we end up with is
people whose information is
collected sometimes misused and
sometimes used in ways that they never
would have imagined or envisioned now
from a governmental perspective the
holes here are huge as well it is well
known to everybody in this room that the
Privacy Act hasn't been updated for even
in a longer period of time and so the
government itself doesn't even hold
itself to the same standard that it
would expect of the private sector and
that represents a problem government
ought to lead in this regard lead by
example
not just in terms of what it does as a
government but also what it will do when
they we find these leaders within their
political parties so for example bill C
76 just introduced with respect to some
changes in terms of our elections and
our political parties ought to embarrass
every one of those political parties
idea that they refuse to hold themselves
to even basic standards in terms of the
kinds of information they collect and
the disclosures and the rules applicable
to that is embarrassing but it is not
surprising as I think we all know that
whether it's then Do Not Call list or
the anti-spam legislation politicians
and political parties have been quick to
exempt themselves at the very very start
of of those sorts of pieces of
legislation now perhaps in light of
things like Cambridge analytical
analytic I and others there is a growing
awareness of why that simply can't
continue to happen but a willingness of
a government that likes to paint itself
as a progressive government on these
issues to introduce a piece of
legislation and it doesn't even have
basic kinds of privacy safeguards built
in for what has been an obvious hole and
an obvious area of potential misuse is
that I say embarrassment that ought to
be addressed I think it's also bigger
than PIPA not just in the context of
we've also got to think about government
but in the sense that it is tough as I
even refer to a moment ago to rap PIPA a
private sector or public sector into
some of these emerging issues in smart
cities is a perfect example of a place
that sits somewhere between public and
private and different layers of
government at the same time with global
activities as well I don't know that
we've
good answers for what the legislative
framework looks like for some of these
issues I know that we need the
participants to proactively be concerned
with some of these issues but at the
same time when we think about what the
privacy frameworks might look like we
have to I think recognize that they
don't fit in as neatly as they once did
so to the overlap of these issues with
other areas and I mentioned a few
moments ago trade law I don't think
people would have much thought about
trade negotiations as a place where
privacy rules get made and yet when you
have data transfer rules when you have
data localization rules embedded within
some of our trade agreements there is a
discussion taking place around the
legislative frameworks that we all
operate under and think about that
largely excludes the very people who are
actively engaged in it we don't get a
say typically certainly not behind
closed doors when these negotiations
take place much of this is presented a
fete accompli and that I think ought to
concern us finally I think we need to
also be strategic when it comes to these
issues I think other countries have
recognized that data protection privacy
big data this isn't just about
protecting the public this isn't just
about compliance it's also about being
strategic in terms of some of the
advantages that we want to ensure the
Canadian businesses have data
localization for example is a tough
issue it's tough because there are I
think perfectly good arguments for why
we'd want to retain data within the
jurisdiction there are also good
arguments for why we want open networks
and want to ensure that data flows
freely across those borders not impeded
by restrictions that may not provide
real privacy protection in any event may
lead some to think that they've gotten
more of an illusory privacy protection
and so being strategic with our rules
with the in the hope that we ensure not
just that we have a cutting-edge
proactive set of rules that better
reflect the current environment today
but also ensure that those rules provide
the advantages economic and otherwise
for the Canadian
is critically important I'll conclude by
noting that the focus is as I started
very much right now in this room on this
clock but there's another clock it has
been six thousand six hundred and
fifteen days since Pippa de took effect
on April it was 13 2001 so that's not
even the day the clock since this was
first introduced it's rather the clock
since the law itself took effect that's
a long time and as we start thinking
about making sure that our rules are
relevant not just from an enforcement
perspective but also ensure that our
rules better reflect the environment
today let's start paying attention to
this clock and find ways to reset it
back to zero thanks very much for your
attention
[Applause]