What Do We Want? Stronger Privacy Laws. When Do We Want Them? Now

What do we want? Stronger Privacy Laws. When do we want them? NOW. It has become routine to start all commentary on privacy laws in Canada with a warning that modernization is imperative. It’s not trite, it’s true. As artificial intelligence and machine learning applications burn through more and more data to allow those using such tools to analyze, predict, and ultimately influence human behaviour, protecting and controlling the way information about us is used becomes more consequential and more difficult. It is in this context that CCLA welcomed the opportunity to participate with written submissions in BC’s review of their private sector privacy law, the Personal Information Protection Act. Many residents of BC (and across Canada) were living lives where online transactions and interactions were an important part of daily life before COVID-19 hit. Now, in times of pandemic, our interactions with businesses are even more likely to be mediated by systems that collect more information than we may realize, for purposes that may not be clear, and with consequences that are hard for individuals to anticipate. But it’s not just about stores and shopping. Our education system may be relying on private sector vendors for online platforms. Our doctors may be using vendor-based apps for our healthcare appointments. Our political representatives are using the same kinds of big data analytics as our insurers and our retailers. Privacy law reform isn’t top of mind for most of us, but it’s near the top of what our governments can do to make sure that residents can trust in the systems we need to use, now and moving forward. CCLA’s submissions included the following:

1. Privacy should be recognized formally in legislation as the human right that it is, essential for dignity, autonomy, and foundational in the digital age to the facilitation of other rights including free expression and equality.
2. Biometric data (like our faces, fingerprints, irises, gaits, and DNA) is inherently sensitive and must be explicitly and effectively protected.
3. When AI tools are used to make decisions about people, they deserve to know that’s happening—and no decisions about humans should be made solely by an algorithm.
4. De-identification is a process used to remove personal information from data sets to protect privacy, and sometimes when data is deidentified, companies say that means privacy law doesn’t apply because it’s not personal information any more. However, not only does research increasingly show that de-identification isn’t 100% effective, the information in those data sets is still about us, whether our names are attached or not. That means we should have a say in whether it’s collected and how it gets used. Privacy law needs to apply to de-identified data.
5. Workers need better privacy protection.
6. Young people need explicit privacy protection.

Quebec, Ontario, and the federal government are all either working on new privacy laws or will be soon as well. BC is leading the way, and their review is a timely opportunity to make sure that the laws that allow BC residents to go about their business online are appropriately protective of the right to privacy. Our submissions to this important process is one way that CCLA is advocating for stronger, more effective privacy laws as governments across Canada begin to grapple with the urgent need to provide effective privacy protections for everyone.