An Interview with Professor Andrew Clement

May 19, 2015

AndrewClement copyAndrew Clement is a Professor in the Faculty of Information at the University of Toronto, where he coordinates the Information Policy Research Program. He holds a cross-appointment (status-only) in the Department of Computer Science. His recent research has focused on public information policy, internet use in everyday life, digital identity constructions, public participation in information/communication infrastructures development, and community networking.

This article is part of a series of interviews with advocates, legal thinkers, community organizers and academics on issues related to Canadian civil liberties produced by CCLA volunteers. All responses are the interview subject’s own, and do not necessarily represent the viewpoint or positions of the CCLA.

CCLA: What do Canadian citizens need to know about their privacy rights and how to protect them?

AC: Here are some of the most important things I believe Canadians should know about their privacy rights and how to protect them:
1. Canadians officially enjoy, through the Charter and legislation, a range of fundamental privacy rights essential for maintaining the integrity of their personal lives as well as the health of our democracy.
2. Our privacy rights are currently not well protected and are under increasing threat from a variety of political, economic, cultural and technological challenges.
3. Privacy rights are typically treated as simply an individual concern, but we need also to understood privacy as a shared public good. If someone else’s privacy is eroded, so is ours. Someone else exercising their privacy rights, helps strengthen our own.
4. Privacy rights are typically conceived of as focused on protecting personal information – of keeping it private, but often ignored are the legal requirements of organizations that handle our personal information to be open and accountable for their practices.
5. Many organizations that collect and use large amounts of personal information are by policy and practice not respectful of privacy rights. Many are not fully compliant with their current legal requirements. Even when they do meet the formal requirements, precious few organizations go beyond this minimum and in the spirit of their protective obligations proactively advance citizen privacy interests.
6. While individuals should exercise care in the handling their personal information, ultimately of greater importance is holding the organizations that collect and use our information accountable for their responsibilities. Individuals need to be more demanding of these organizations when passing information to them, but given the asymmetries of power in the usual situations of data collection, holding organizations to account will require concerted collective citizen action.
7. Like other basic rights, if privacy rights are not exercised and respected in an on-going way, they won’t be there when we really need the. As the saying goes. “Use it or lose it.”
CCLA: Why should the average law-abiding Canadian citizen care/be concerned about government surveillance and/or breaches to their privacy rights if, as the argument goes, they “have nothing to hide” and therefore nothing to fear?

AC: The “nothing to hide, so nothing to fear” argument is the justification data trafficking organizations use most often to encourage people to relinquish their privacy rights. Sadly, it also appears to be widely accepted by those who wish to deny that there is any risk in the current situation. However, it is a remarkably flimsy argument that wilts in the face of scrutiny. Leaving aside the obvious fallacy that there are people who have nothing to hide (who among us is willing to make everything they do publicly visible?), there is some superficial merit on the face of it – at least for those in relatively privileged positions and whose views are currently not at odds with the prevailing political/cultural norms. Few such people are likely to run afoul of abuse by organizations handling their data. However, this argument relies on the assumption that such organizations are both benign in their intentions and reliably accurate in their practices. This is especially problematic in the case of security, law enforcement and other agencies that can make life very unpleasant if one becomes a ‘subject of interest’ or somehow suspicious in their eyes. There are abundant recent examples of innocent Canadians who have been very badly treated by security agencies that have inappropriately interpreted, shared and acted on information about them. Maher Arar is the most visible scandalous case, but there are too many others. Numerous Canadians who have been placed on no-fly lists, in some cases simply because their name is similar to that of a suspected ‘terrorist’, offer further examples of ‘false positive’ profiling, suffering discrimination when they’ve don’t nothing wrong and should not have anything to fear.

CCLA: Is there not a “necessity” to limit Canadians’ privacy rights to ensure their safety and national security?

AC: Another suspect argument popular among those promoting security over privacy protection is the claim that we need to sacrifice some of our privacy in order achieve security. An extreme form of this is the claim that privacy doesn’t matter if you’re dead from a failure of security. This is frequently a strawman argument relying on a false dichotomy that deflects attention from the real issues. No one seriously claims that privacy is an absolute right that must prevail over all others, such as a right to security of life. Typically those arguing we need to strike a balance between privacy and safety or security, simply assert greater security as a given, without demonstrating how security is actually to be achieved, or how exercise of privacy rights actually interferes with security. Before conceding that privacy rights need to be relaxed to achieve an appropriate balance, it should first be shown that any proposed security measures are real, and not as often is the case in anti-terrorism discourse, more ‘theatre’ than substance. To not insist on convincing evidence of a security benefit, makes a unnecessary concession that significantly weakens the ability to protect privacy rights. Where there is a real promise of security benefits, we need to ask why we can’t achieve security without compromising privacy. Finally, if we actually do need to consider tradeoffs between privacy and security or safety, we have by now a well established approach for achieving appropriate balance. Based on the R. v. Oakes Charter case, Canadian privacy commissioners have for years applied a ‘four part test’, assessing necessity, proportionality, effectiveness and minimization, to determine whether security measures that threaten privacy are justified or not.

CCLA: What do you think is the most important protection currently in place to ensure citizens’ privacy rights are being protected?

AC: It is hard to single out any particular aspect of privacy protection that is more important than any other, since effective privacy relies on the interplay of many different factors. I would like to say that our privacy is well protected by the tight coupling of pro-privacy laws, judges, lawyers, legislators, politicians, journalists, media, civil society advocates and citizens, each robust in themselves and actively engaged in maintaining the overall privacy protection network. However, it is currently the case that each of these actors are weak or limited in terms of their privacy protective capacities. And both reflecting and reinforcing their individual weaknesses, they are inadequately connected with each other.

As has been the case throughout history, when the institutions that depend for their legitimacy on serving citizens are widely seen to be failing in this mission, it ultimately depends on social movements to critique, challenge and develop alternatives. Currently, as it is becoming increasingly clear that the established instruments for protecting our privacy are not sufficiently up for the job, developing a more vigorous rights oriented social movement is becoming essential. In this, the CCLA and allied civil society advocacy organizations have a vital role to play.

CCLA: Your work and research looks at privacy, surveillance and public spaces. With surveillance cameras in Canadians’ everyday lives, what are the implications of becoming complacent to and accepting the idea that being constantly monitored and watched in the 21st century is a fact of life?

AC: Most forms of everyday surveillance are invisible, hidden within the infrastructures we rely on for communication, shopping, traveling, you name it…, quietly collecting vast roves of fine-grained personal information about our practices, preferences, relationships and so on. ‘Security’ cameras are among the very few devices that are devoted exclusively to surveillance purposes and actually visible to anyone who looks for them. The image of a security camera has thus become the most easily recognizable icon or symbol of the surveillance society we live in. Surveillance cameras collect vast amounts of information about personal lives, and overtly violate of core privacy principles essential to maintaining effective control of information about oneself. Typically it is very hard to know who operates these cameras and for what purposes. Who is looking at you? How long is this information stored? Where does it go? What is done with it? Who is accountable? … With so much going on in the shadows, and new automated techniques such as facial recognition and behavioral analysis being incorporated into the surveillance, the situation is increasingly ripe for abuse. While there is little evidence that camera surveillance is actually effective for the legitimate purposes typically claimed, there are growing signs of its harmful implications, esp. in terms of discrimination and victimization of marginalized people.

Surveillance cameras, especially in public places where they are on display and most visibly challenge our privacy rights, therefore provide a useful starting point for understanding and addressing surveillance issues more generally. How we treat camera surveillance gives a good indication of whether we can effectively regulate the other more ubiquitous and less visible aspects of surveillance that permeate our lives. So far, we are not doing well in this regard, which raises the concern that unless things change, we’ll progressively lose our ability to exercise control over our information, and hence our personal affairs, in the many other areas of our ever more digitally mediated lives.

CCLA: As you have studied, surveillance cameras operated for commercial purposes seldom comply with privacy regulations and legislation. Why is this so widespread? What can be done about it?

AC: In researching camera surveillance over several years, I and my colleagues have consistently found very widespread lack of compliance with Canada’s private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). This is most obvious in the lack of signage that should readily provide the minimal information required under the law, such as purpose, who is responsible and how to contact them. Anyone walking city streets with a basic knowledge of this law can determine this for themselves. (For more details, including maps of crowdsourced data about camera surveillance (non-)compliance, see ) Deeper probing of behind the scenes handling of surveillance images reinforces the finding that companies do not meet their legal obligations for privacy protection.

While there are several factors that contribute to this pattern, likely the most important one is that companies have learned they can get away with it – no one is holding them to account. Most people whose images are captured are not affected directly. It is therefore something they feel they can safely ignore. Few individuals understand their rights are routinely violated in relation to such surveillance, and fewer still are willing to go through considerable effort to exercise them. Corporate management consequently appear to conclude that this is not a matter that concerns their customers, so they don’t need to change their practices. They can thus avoid the added burden of treating captured images as personal information in need of protection rather than exclusively as corporate property to use as they wish. In the absence of pressure, the federal Office of the Privacy Commissioner takes a similar view, reckoning that camera surveillance is not a priority for Canadians, and so devotes its education and enforcement efforts in other areas perceived to be of more concern. This is a vicious cycle that is hard to break. As long as most people are in the dark about their rights and even if they are concerned, feel helpless about doing anything to fix the situation, little will change. One way to change this dynamic is to launch a high profile public campaign, that makes files a formal complaint about this widespread privacy non-compliance and engages Canadians in a public debate on the subject. People need to see that they do have rights, that they have something to contribute and that the situation can be improved as a result of their action.