Canadian Privacy Law Blog

This blog has moved

2010-04-17T18:02:00.001-03:00

This blog is now located at http://blog.privacylawyer.ca/. You will be automatically redirected in 30 seconds, or you may click here. For feed subscribers, please update your feed subscriptions to http://blog.privacylawyer.ca/feeds/posts/default.

Some thoughts on street photography

2010-04-11T09:53:00.003-03:00

Simon Fodden, the head slawer over at http://www.slaw.ca/ has a great post to end the week (The Friday Fillip – Slaw), pointing to a great piece of photographic excellence "We're all gonna die". It's a 100m long photograph of people taken from Warshauer Strasse in Berlin. Go take a look at it, then come back here.

Simon notes that you can't go and see the location on Google Street View, presumably because of the supposed privacy issues that the German government has with street level imaging. That's too bad.

Simon brings up the broader topic of the privacy issues of photographing people, particularly in public places. It's an issue that has come up in all the discussions about Google Street View and other street imaging products out there on the 'net. I've given this topic a bit of thought, being simultaneously a privacy nerd, photo nerd and history nerd. Obviously, taking photos of people raises privacy issues but I don't have much of a problem when photos are taken in public places. People simply have diminished expectations of privacy on a public street. I like that Google and some others have allowed individual "vetoes", so that anyone who does not want to appear online can have the image taken down.

That's not to say that wholesale surveillance is ok, but when the images are being taken primarily of places and the people are incidental, I don't think this is what privacy laws were designed to protect us against. (The line can blur towards stalking or harassment if you follow a person in a public area and continue to take their photo, but that's not at issue here.)

Canadian privacy laws are meant to address commercial activity. To me, this sort of imaging is not "commercial" but fits under the exception of "journalistic, artistic and literary" expression, which is expressly excluded from PIPEDA.

My firm's property department has some great historical publications on the original property grants for Halifax. They include all sorts of info, like what was where, who owned what. For a history nerd, it is fascinating. It's a cool city with a neat history. I've spent hours looking at historical photos of Halifax. Many of them have people in them, which only adds to the value. I don't care who they, but what they are doing, where they are going and what they are wearing add so much to the historical significance of the photos.

I can't wait until the technology has been around long enough so that not only will you be able to stroll down a virtual street, but you'll be able to scroll back through history. Imagine looking at a downtown street in Street View and being able to choose to see what it looked like last year, five years go, ten years ago and fifty years ago. Not only will that be immensely cool, academics will have an incredibly valuable resource at their disposal.

RCMP changes rules for criminal records checks

2010-04-09T15:39:00.000-03:00

Today's post at slaw.ca:

RCMP changes rules for criminal records checks
Late last year, the RCMP changed its policy for access to criminal records information via the Canadian Police Information Centre (CPIC). Reputable companies, up until that point, had been able to obtain police records clearances through local police departments. These clearances were conditional upon the background checking company obtaining signed consent from the individual and making those consent forms available for spot audits. Provided the proper consent was obtained, background checking companies had been able to provide same-day results if the name, address and date of birth provided did not result in any “hits” in CPIC. In most cases, where there may be derogatory information, the individual would have to appear for fingerprinting so that his or her identity could be confirmed. This practice meant that those who had clear records could go on to the next stage of the process for their job application, volunteering application or whatever.
For records where a pardon has been granted for certain sexual offences, a notation is made in CPIC’s databases. It used to be that the police would provide, with the individual’s written consent, confirmation that no such notation exists provided that the person was being screened for working or volunteering with vulnerable populations.
These checks were facilitated by professional background screening companies, in cooperation with law enforcement, who would often be able to provide an “all clear” within the day.
Now, all screening requires fingerprints and about 120 days’ wait. The RCMP is saying that they are simply doing what the Criminal Records Act requires them to do. I don’t buy it. The Act says that the RCMP can disclose the existence of a notation if the person has provided written consent and the check is made for a paid or volunteer position that is one of authority or trust relative to children or vulnerable persons.
According to an article in today’s Globe & Mail, a number of volunteer-staffed organizations have cancelled programs because the 120 day wait cannot be accommodated. What may be worse, some organizations may be foregoing these checks and permitting unscreened people to work closely with vulnerable populations.
This is untenable, in my view. I’m not in favour of widespread criminal records checking where it is not relevant to the position, but these checks are very often relevant for certain employment or volunteer positions. Provided the person has provided clear, informed, unambiguous consent, there is no reason why an “all clear” can’t be given forthwith. I can understand that you would want to avoid the possibility of erroneously saying that a person has a criminal record or a pardoned sexual conviction, so the practice of fingerprinting should continue where there might be a “hit”. But where there is no reason to think a person has a record, that information should be provided right away.
Volunteerism is important. Silly policies should not have the effect of impeding volunteer efforts, nor should they discourage prudent screening that keeps predators away from the vulnerable.

Saskatchewan amends privacy regs to permit soliciation of former patients

2010-04-07T12:58:00.000-03:00

One controversial aspect of health privacy laws, at least when they are implemented, is whether hospitals or supporting foundations can use patient information without consent for fund-raising purposes. It appears that Saskatchewan is about to amend the health privacy regulations for that province to permit solicitation after a sixty-day waiting period. See: Saskatchewan gives local health foundations the OK to contact former patients for fundraising purposes.

US Federal judge declares warrantless wiretapping program unlawful

2010-04-01T06:55:00.001-03:00

A US Federal Court has declared that the Bush-era "warrantless wiretap" program was unlawful. The administration, up to and including the Obama administration, argued that in a time of war, it was lawful to eavesdrop on communications without a warrant, particuarly international communications. The decision is here: http://cryptome.org/alharamain-v-nsa.pdf and the New York Times' has an article on the decision here: Federal Judge Finds N.S.A. Wiretaps Were Illegal - NYTimes.com.

Commisser releases discussion paper on cloud computing

2010-03-29T16:48:00.000-03:00

The Privacy Commissioner of Canada has released a discussion paper on privacy issues related to "cloud computing". This is part of their broad outreach and consultation process on privacy and new technology. You can read it here: Reaching for the Cloud(s).

On a related topic, I will be one of the keynote speakers at the Town Hall being put on by the Commissioner in Calgary next month.

Heathrow worker given police warning for body scanning co-worker

2010-03-28T07:27:00.000-03:00

The Guardian is reporting about an incident that seems at odds with the official pronouncements that body scanners at airports protect privacy:

Airport worker given police warning for 'misusing' body scanner UK news guardian.co.uk
... A Scotland Yard spokesman said: "Police received an allegation regarding an incident that happened at Heathrow Terminal 5 on March 10. A first-instance harassment warning has been issued to a 25-year-old male."
The BAA employee took a photo of his co-worker, Jo Margetson, when she inadvertently went through a scanner.
"I can't bear to think about the body scanner thing," she told the Sun. "I'm totally traumatised. I've spoken to the police about it. I'm in too much of a state to go to work."...

How Privacy Vanishes Online, a Bit at a Time

2010-03-17T09:49:00.000-03:00

Thanks to advanced statistical analysis and the plethora of digital crumbs scattered around the internet, every bit of data you leave behind (no matter how small) online can be used to piece together a link to your full identity and details. Scary stuff from the New York Times.

How Privacy Vanishes Online, a Bit at a Time - NYTimes.com
By STEVE LOHR
If a stranger came up to you on the street, would you give him your name, Social Security number and e-mail address?
Probably not.
Yet people often dole out all kinds of personal information on the Internet that allows such identifying data to be deduced. Services like Facebook, Twitter and Flickr are oceans of personal minutiae — birthday greetings sent and received, school and work gossip, photos of family vacations, and movies watched.
Computer scientists and policy experts say that such seemingly innocuous bits of self-revelation can increasingly be collected and reassembled by computers to help create a picture of a person’s identity, sometimes down to the Social Security number.
“Technology has rendered the conventional definition of personally identifiable information obsolete,” said Maneesha Mithal, associate director of the Federal Trade Commission’s privacy division. “You can find out who an individual is without it.”
In a class project at the Massachusetts Institute of Technology that received some attention last year, Carter Jernigan and Behram Mistree analyzed more than 4,000 Facebook profiles of students, including links to friends who said they were gay. The pair was able to predict, with 78 percent accuracy, whether a profile belonged to a gay male.
So far, this type of powerful data mining, which relies on sophisticated statistical correlations, is mostly in the realm of university researchers, not identity thieves and marketers.
But the F.T.C. is worried that rules to protect privacy have not kept up with technology. The agency is convening on Wednesday the third of three workshops on the issue.
Its concerns are hardly far-fetched. Last fall, Netflix awarded $1 million to a team of statisticians and computer scientists who won a three-year contest to analyze the movie rental history of 500,000 subscribers and improve the predictive accuracy of Netflix’s recommendation software by at least 10 percent.
On Friday, Netflix said that it was shelving plans for a second contest — bowing to privacy concerns raised by the F.T.C. and a private litigant. In 2008, a pair of researchers at the University of Texas showed that the customer data released for that first contest, despite being stripped of names and other direct identifying information, could often be “de-anonymized” by statistically analyzing an individual’s distinctive pattern of movie ratings and recommendations.
In social networks, people can increase their defenses against identification by adopting tight privacy controls on information in personal profiles. Yet an individual’s actions, researchers say, are rarely enough to protect privacy in the interconnected world of the Internet.
You may not disclose personal information, but your online friends and colleagues may do it for you, referring to your school or employer, gender, location and interests. Patterns of social communication, researchers say, are revealing.
“Personal privacy is no longer an individual thing,” said Harold Abelson, the computer science professor at M.I.T. “In today’s online world, what your mother told you is true, only more so: people really can judge you by your friends.”
Collected together, the pool of information about each individual can form a distinctive “social signature,” researchers say.
The power of computers to identify people from social patterns alone was demonstrated last year in a study by the same pair of researchers that cracked Netflix’s anonymous database: Vitaly Shmatikov, an associate professor of computer science at the University of Texas, and Arvind Narayanan, now a researcher at Stanford University.
By examining correlations between various online accounts, the scientists showed that they could identify more than 30 percent of the users of both Twitter, the microblogging service, and Flickr, an online photo-sharing service, even though the accounts had been stripped of identifying information like account names and e-mail addresses.
“When you link these large data sets together, a small slice of our behavior and the structure of our social networks can be identifying,” Mr. Shmatikov said.
Even more unnerving to privacy advocates is the work of two researchers from Carnegie Mellon University. In a paper published last year, Alessandro Acquisti and Ralph Gross reported that they could accurately predict the full, nine-digit Social Security numbers for 8.5 percent of the people born in the United States between 1989 and 2003 — nearly five million individuals.
Social Security numbers are prized by identity thieves because they are used both as identifiers and to authenticate banking, credit card and other transactions.
The Carnegie Mellon researchers used publicly available information from many sources, including profiles on social networks, to narrow their search for two pieces of data crucial to identifying people — birthdates and city or state of birth.
That helped them figure out the first three digits of each Social Security number, which the government had assigned by location. The remaining six digits had been assigned through methods the government didn’t disclose, although they were related to when the person applied for the number. The researchers used projections about those applications as well as other public data, like the Social Security numbers of dead people, and then ran repeated cycles of statistical correlation and inference to partly re-engineer the government’s number-assignment system.
To be sure, the work by Mr. Acquisti and Mr. Gross suggests a potential, not actual, risk. But unpublished research by them explores how criminals could use similar techniques for large-scale identity-theft schemes.
More generally, privacy advocates worry that the new frontiers of data collection, brokering and mining, are largely unregulated. They fear “online redlining,” where products and services are offered to some consumers and not others based on statistical inferences and predictions about individuals and their behavior.
The F.T.C. and Congress are weighing steps like tighter industry requirements and the creation of a “do not track” list, similar to the federal “do not call” list, to stop online monitoring.
But Jon Kleinberg, a professor of computer science at Cornell University who studies social networks, is skeptical that rules will have much impact. His advice: “When you’re doing stuff online, you should behave as if you’re doing it in public — because increasingly, it is.”

Facebook plans to allow users to "share" location

2010-03-10T20:08:00.000-04:00

According to the New York Times, Facebook is going to roll out full-blown location sharing in April. From the NYT's Bits Blog:

Facebook Will Allow Users to Share Location - Bits Blog - NYTimes.com
In preparation for the introduction, Facebook updated its privacy policy last November. The new policy states: “When you share your location with others or add a location to something you post, we treat that like any other content you post.”
At that time, the company also offered some foreshadowing of the new feature: “If we offer a service that supports this type of location sharing we will present you with an opt-in choice of whether you want to participate.”
Facebook has been working on a location-based tool for close to a year, but decided to wait until the product was completely ready for mainstream adoption before announcing it, said the people with knowledge of the project.

Drawing the curtain on ISP cooperation with law enforcement

2010-03-01T21:14:00.000-04:00

My latest posting on slaw.ca:

Drawing the curtain on ISP cooperation with law enforcement – Slaw
I've been a faithful follower of Cryptome for quite some time. Cryptome has been posting very interesting and controversial content on the internet since 1996. It was the first WikiLeaks. Recent readers would note some publications that are very interesting for those who are interested a look at the level of cooperation of between internet service providers and law enforcement. Some of the reaction has been overblown, in my view. Nobody should be surprised that service providers hand over customer information in response to warrants and subpoenaes. Where the law requires it, banks do it, pharmacies do it, libraries do it and credit card companies do it. I think it would be shocking if service providers didn't have policies and procedures for this. What would be more troubling would be the extent to which service providers hand over information in the absence of a lawful requirement.
Most recently, Microsoft served a DMCA notice on Cryptome and its hosting provider, demanding that their Global Criminal Compliance Handbook be removed. Cryptome countered and Microsoft ultimately caved. My personal view is that service providers should make this information public so that customers really understand their digital footprints.
So if you want to see what Facebook, AOL, PayPal, MySpace, AOL and Skype will provide in response to a lawful demand, check out Cryptome.
And for lawyers, these documents will tell you what you can expect to get in response to a lawful demand.

Alberta Privacy Commissioner tells retailer not to do routine credit checks of sales staff

2010-02-25T08:59:00.000-04:00

The Information and Privacy Commissioner of Alberta has just ordered Marks' Work Wearhouse to stop carrying out routine credit checks on prospective employees in Investigation Report P2010-IR-001.

From the Commissioner's website:

February 23, 2010
Mark’s Work Wearhouse investigated under the Personal Information Protection Act
The Office of the Information and Privacy Commissioner has found that Mark’s Work Wearhouse (MWW) contravened the Personal Information Protection Act (PIPA) when the organization conducted pre-employment credit checks for its job applicants.
The complainant had applied for a job with MWW as a sales associate. During the complainant’s in-person interview with the organization he signed a declaration of understanding for a credit check. Shortly after the interview he was contacted by MWW and asked to explain his credit rating and how he was resolving his credit issue. The complainant explained to MWW that in the past an error in processing his paper work between the federal government and his bank concerning his student loans had occurred. Due to a lack of financial resources he could not resolve the matter.
The complainant was unsuccessful in obtaining the sales associate position with MWW. MWW advanced that the organization conducted a pre-employment credit check in regard to the complainant as the information provides an assessment of how job applicants will handle financial responsibilities and tasks with their employment duties as a sales associate; and it is an assessment of whether the job applicants have a probable risk of in-store theft or fraud. The investigator found that the personal credit information collected by MWW was not reasonably required to assess the complainant’s ability to perform the duties a sales associate, or to assess whether he might have a tendency towards committing in-store theft or fraud.
MWW agreed to cease the collection of personal credit information of sales associate applicants as part of its hiring process.

Some coverage: Canadian HR Reporter - Article View.

Saskatchewan Privacy Commissioner cuts services due to lack of funds

2010-02-23T09:22:00.001-04:00

The Privacy Commissioner of Saskatchewan is reportedly having to scale back services after the provincial government nixed a request for additional resources to hire another investigator. Gary Dickson's office not only administers the public sector access and privacy law, but he has to deal with the health privacy law that covers public and private sector healthcare.

I'm not sure you can truly be independent of the government if you have to go begging to it for adequate funds.

Saskatchewan privacy commissioner cuts services citing lack of resources - Winnipeg Free Press
REGINA - Saskatchewan's privacy commissioner says his office is in crisis and is being forced to cut back services because of a lack of funding from the provincial government.
Gary Dickson says surging demand for service has overwhelmed his office and the current three investigators cannot sustain the caseload.
He says despite his plea, the government's Board of Internal Economy has denied a request for $129,000 to hire another investigator and set up office space for that person.
"I've said to the board when I appeared in front of them, and I used the word very consciously, our office is in a crisis in terms of being swamped with demands for service from the people who live in the province," Dickson said Monday.
"We just cannot possibly ... respond to that demand in any kind of reasonable time frame."
Dickson says the number of reviews and complaints is up by 113 per cent over last year. Requests for advice and inquiries from public bodies and health trustees are also up.
Some people have been waiting for more than three years for a resolution to their case file, he says. The three investigators currently have a caseload of 376 reviews and investigations.
"Something has to give," says Dickson.
"So what we've decided to do is try and be transparent to the people of the province in terms of how this is going to translate into waits and delays."
The commissioner says his office will send letters to everyone who requests an investigation or review alerting them that they should not expect any action on their file for approximately 12 to 18 months.
Dickson also says all public organizations should expect significant cutbacks and delays if they need consultation on a project.
The privacy commissioner's office oversees some 3,000 bodies including ministries, Crown corporations, boards, commissions, agencies, schools, regional health authorities, municipalities, universities, colleges and health trustees.
The commissioner says the decision by the board will diminish how accountable public bodies are to the people of Saskatchewan.
"Manitoba, with roughly the same population, would have six investigators. Newfoundland and Labrador I think has more than six investigators (and) half the population. They certainly don't oversee 3,000 public bodies and health trustees," says Dickson.
Saskatchewan Justice Minister Don Morgan, who sits on the board of internal economy, says the privacy commissioner's budget has been steadily rising since 2002. That can't continue during tough financial times, he says.
"We're in times of fiscal restraint and we're expecting all ministries, all government agencies to try and work within existing budgets wherever they can," says Morgan.
The province is trying to cope with a big hole in last year's budget when potash revenue fell $1.8 billion.
The Saskatchewan government will deliver its new budget March 24, but Premier Brad Wall has already warned there won't be big spending increases - in fact, cuts are in the works.
Morgan said there's no way of controlling how many complaints the privacy commissioner's office receives, but he wants to cut the number if possible.
"We would like to work with the privacy commissioner to find ways that we can reduce the backlog in their office and try and find some efficiencies by having more of the requests dealt with at the ministry levels rather than through his office," he says.

Don't tell the world where you aren't

2010-02-19T00:30:00.000-04:00

There's a lot of power in social media, but many tweet or update their status withouth thinking about what they are telling the world. This issue is especially acute when it comes to location-based information. If you're telling the world you're at your local Starbucks, you're telling everyone that you're not at home. Burglars may be interested in that, if they can match your tweets with your home address. A new website, Please Rob Me, vividly illustrates the issue. See also: Please Rob Me Makes Foursquare Super Useful For Burglars.

Newfoundland court concludes Information and Privacy Commissioner may not review privilege claims

2010-02-17T12:42:00.000-04:00

The Supreme Court of Newfoundland has released what I think is a very important decision under that province's access to information legislation. The dispute in Newfoundland and Labrador (Attorney General) v. Newfoundland and Labrador (Information and Privacy Commissioner), 2010 NLTD 31 (not yet on CanLII) centered around whether the Information and Privacy Commissioner has the authority to request and review documents that were alleged to be subject to solicitor-client privilege.

The relevant portion of the Act on which the Commissioner was relying provides:

52. (1) The commissioner has the powers, privileges and immunities that are or may be conferred on a commissioner under the Public Inquiries Act.
(2) The commissioner may require any record in the custody or under the control of a public body that the commissioner considers relevant to an investigation to be produced to the commissioner and may examine information in a record, including personal information.
(3) The head of a public body shall produce to the commissioner within 14 days a record or copy of a record required under this section, notwithstanding another Act or regulations or a privilege under the law of evidence.

The Court concluded that solicitor-client privilege, though it may have started as a rule of evidence, is a substantive right that it not interfered with by Section 52(1). This is consistent with Privacy Commissioner of Canada v. Blood Tribe Department of Health, 2008 SCC 44 (S.C.C.).

Justice Marshall wrote:

[90] Section 52(3) of the ATIPPA does not oblige the DOJ to provide the Commissioner with solicitor-client records. The language of section 52(3) does not capture solicitor-client privileged documents. Similarly, section 52(2) does not give the Commissioner power to demand solicitor-client records. The open-textured language of section 52(2) is to be read as not including solicitor-client documents (Blood Tribe). Similarly, a restrictive interpretation of section 52(3) dictates that describing privilege solely as a rule of evidence is not broad enough to capture solicitor-client privilege. While this finding is based on a restrictive interpretation, it is also consistent with the objects of the ATIPPA. The “mischief” has been remedied by the legislature which has given the Commissioner the power of review; but not the power to violate solicitor-client privilege which is a “fundamental civil and legal right”.

Bar watch program coming to Halifax

2010-02-15T11:38:00.001-04:00

Following in the footsteps of British Columbia and Alberta, bar owners in Halifax are talking about rolling out a "Bar Watch" program. You can read about other programs here: id swiping.

What is particularly troubling or at the very least needs close scrutiny is the suggestion that the banned list is going to originate from the police. So far, I haven't seen what gives the police the right to decide who goes into licensed establishments and what criteria they will use. I haven't seen any detail about how it with be implemented and what information will be demanded from all bar patrons.

Stay tuned.

Bar owners see police role in managing ban (UNews)
The group spearheading a citywide bar-goer blacklist may rely on police to provide personal information of banned patrons, according to a spokesperson for the group.
"I'm assuming that the police would hand it over to us, I can't see why they wouldn't," said Richard Stevens of the Restaurant Association of Nova Scotia. "I'm fairly certain that that's the way it would go."
Stevens is a co-owner of the Pogue Fado Irish Public House, as well as chair of the association's government-affairs committee. That committee met Thursday with its partners in this project - the municipality, police and provincial liquor enforcement officials - and agreed in principle to proceed with the plan.
The Bar Watch program, as it's been dubbed, may begin as early as April, but there's a lot still up in the air. Though Stevens said he's just speculating at this point, maintaining a database of patrons barred from Halifax's drinking establishments would be key.
This list would likely contain "very basic biographical information about the person," such as name and address, he said. Some details of the incident that earned them their spot on the list may also be included, including names of witnesses and security staff involved.
The list would be maintained by the association, and only bar owners and general managers would be able to add people to it. Bar security would only see the names of banned patrons, not their full details.
"It would take a significant incident (to get on the list). This isn't anything that any of the owners take lightly," Stevens said.
"I'm assuming that probably 75 to 80 per cent of the people that end up getting barred, the police would probably end up getting involved anyway ... because it would be that serious."
Even if bar security have to restrain patrons involved in a fight or another serious incident, the bouncers have no right to search them for ID, he said.
"If they fail to provide identification, if and when they've been restrained after an incident, we'd call the police," he said. "The police would come and the police would get that information."
Stevens said he believes the police will provide the information necessary for the blacklist. Arrest records are public.
Police advising, but no word on further role
Halifax Regional Police spokesperson Cst. Brian Palmeter said the police's role "is to provide any guidance or assistance that they would ask from us."
"All that we're really saying about it is that we're aware the Restaurant Association has had some preliminary discussions about this ... We would support anything that any business would do to make it safer for their customers ... but as far as this goes, this is something that they're looking at doing. It's not a police matter."
At the time, Palmeter was not asked and did not comment on whether police would provide the association with personal information of patrons.
Stevens said the police have been advising the association on the administration of the program.
"They have a lot more experience with these programs than we do," he said. "They're guiding us along, providing advice, and they're going to stay by our side ... until we get this thing up and running."
Stevens said the police could be involved in this capacity for one to two years.
The next step in getting this program off the ground is a meeting with "the key stakeholders around HRM," which Stevens said he expects within the next two or three weeks.
"We'll target, with the help of the police force, 10 or 12 key establishments, contact the owners, and call them in for a meeting where we'll describe the program, its objectives, what we hope to accomplish, and ask them to get onboard."

Privacy Commissioner consultations on new technologies: a few thoughts

2010-02-12T16:42:00.002-04:00

Over the last month, the Office of the Privacy Commissioner of Canada has launched two public consultations related to new and emerging technologies. The first, called for in January of this year, relates to "online tracking, profiling and targeting of consumers by marketers and other businesses." The second, which will focus on cloud computing, was announced yesterday. The consultations call for written submissions and will culminate with public events in Toronto, Montreal and Calgary.

It will be interesting to see what these consultations bring to the fore, particularly in light of the Commissioner's observation that PIPEDA has been "sorely tested" over the last decade and may need fortification for the next decade:

Speech: The Future of Privacy Regulation – February 10, 2010
"But what we can say for certain is that the regulatory framework we have in place now for the protection of privacy and personal information is already being sorely tested. We have bent and stretched it in many different ways.
And, if we don’t want it to snap, we need to figure out how to fortify it for the decade ahead.
For that, we need to look at our privacy laws and administrative structures. We need to dramatically modernize the Privacy Act, which governs the public sector, and to consider whether PIPEDA, the private-sector Personal Information Protection and Electronic Documents Act, remains suited for the next 10 years.
But we cannot function in isolation. We need to examine what’s happening in other jurisdictions, and work with them on common approaches to the challenges we all share."

PIPEDA, for all its weirdness as a statute, is in my view surprisingly resilient. It is because it is based on flexible principles rather than prescriptive rules that it can accommodate various industries and new technologies. The defects that were there on day one are generally still there, but its technological neutrality was well drafted and has withstood the test of time.

For example, it is firmly based on the idea of reasonableness, notice and consent. Provided the purposes are reasonable, there is notice and consent it obtained, the law fits and will work. This is regardless of whether the information is collected online, in person or via stone tablets. It works if the information is directly indentifiable to the individual (name), can lead to the identification of the individual (other identifier) or relates to some characteristic of the individual (house price). The exceptions to the law, such as journalistic collections of information, are generally reasonable and in fact necessary in light of the Charter of Rights and Freedoms.

Perhaps some guidance is useful. For example, it would help to have some consensus on best practices for notices to individuals related to the use of persisent cookies or when information will potentially cross borders. But ultimately all of these are within the domain of a judge interpreting the statute, who will have a pretty robust, principled, technologically neutral lens to look through.

Those are just my thoughts ... it will be interesting to see what the participants have to say.

Interim BC privacy commissioner appointed

2010-01-25T21:13:00.000-04:00

The BC Government has appointed an interim Information and Privacy Commissioner to fill the role until the legislature resumes in the spring:

Interim privacy commissioner appointed - The Globe and Mail
... Instead, Paul Fraser, B.C.'s Conflict of Interest Commissioner, is taking over as acting commissioner.
Mr. Barisoff said Ms. Carlson's letter didn't make it to him on Friday because it was sent after business hours. However he downplayed the delay, saying the government needed time to find the right candidate.
“You have to have someone who can do the job and you can't simply take someone out of nowhere,” he said. “I don't think it's that long to wait for someone to do a good job… The world wasn't coming to an end in three business days.”
He added that Mr. Fraser is a good choice for the interim position, since he is already an independent officer of the legislature. The permanent commissioner won't be selected until the legislature resumes its next sitting in the spring....

BC Privacy Commissioner's resignation leaves office in limbo

2010-01-23T11:53:00.000-04:00

I posted earlier this week that David Loukidelis has resigned as Information and Privacy Commissioner for British Columbia to take on the post of Deputy Attorney General for the province. He resigned effective January 19, 2010. This has apparently left a significant gap, as there was no interim Commissioner appointed. Without a commissioner, the operations of the office have ground to a halt:

CBC News - British Columbia - Privacy official sounds 'urgent' alarm
Work at the office of B.C.'s Information and Privacy Commission in Victoria is reported to have ground to a halt after the commissioner resigned suddenly this week.
Privacy Commissioner David Loukidelis resigned unexpectedly Wednesday to take a job as deputy attorney general.
Commission executive director Mary Carlson circulated a letter labelled "extremely urgent" at the B.C. legislature Friday calling for a quick resolution of the situation.
The letter was addressed to the legislature Speaker Bill Barisoff and copied to Premier Gordon Campbell, Opposition Leader Carole James and senior legislative staff.
In the letter, Carlson said she sent an urgent request to Campbell Thursday.
"I wrote to the premier's office to raise this pressing concern," she wrote.
"Despite having attempted to learn if an acting commissioner has been appointed or, if not, when this will occur … this office has received no response."
Work was piling up quickly in the busy commission office, but her hands were tied, according to Carlson.
She said she had received legal advice that the office could not perform its job of reviewing requests for information and could not provide independent oversight for 3,000 public bodies until an appointment is made.
"It has been necessary to suspend the entire operations of the office," Carlson said.
The Office of the Information and Privacy Commissioner is independent from government and monitors and enforces British Columbia's Freedom of Information and Protection of Privacy Act and Personal Information Protection Act.

BC Commissioner to leave post, become Deputy AG

2010-01-20T19:46:00.001-04:00

BC Information and Privacy Commissioner David Loukidelis is leaving the post to become Deputy Attorney General of BC. Here's the official release:

GOVERNMENT ANNOUNCES KEY APPOINTMENT
Jan. 20, 2010
Office of the Premier
GOVERNMENT ANNOUNCES KEY APPOINTMENT
VICTORIA – David Loukidelis has been appointed Deputy Attorney General. The appointment will be effective February 1, 2010.
Loukidelis will replace acting Deputy Attorney General, Jerry McHale, Q.C., who was appointed in October 2009 on an interim basis after Allan Seckel, Q.C., was appointed Deputy Minister to the Premier, Cabinet Secretary and Head of the British Columbia Public Service.
Loukidelis previously served as the Information and Privacy Commissioner for the Province of British Columbia since 1999. Loukidelis has become an internationally-recognized expert in access to information and privacy protection issues, and has written hundreds of access-to-information and privacy decisions under B.C.’s public and private sector access and privacy laws. In addition to serving as Information and Privacy Commissioner, he has served as Registrar of Lobbyists under the Lobbyists Registration Act.
Loukidelis received his law degree in 1984 from Osgoode Hall Law School and qualified as a lawyer in British Columbia in 1985. He served as a clerk to a Justice of the Supreme Court of Canada before moving on to the University of Oxford, where he received his bachelor of civil law in 1987. In 1980, he received a master of arts degree in English language and literature (medieval studies) from the University of Edinburgh.
An all-party committee of the legislature will select a new Information and Privacy Commissioner. An acting Information and Privacy Commissioner will be named in the near future.

From local media:

C-FAX 1070 - News
PRIVACY COMMISSIONER TO MOVE TO DEPUTY ATTORNEY GENERAL
Jan 20, 2010
BC'S PRIVACY COMMISSIONER, DAVID LOUKIDELIS IS CHANGING JOBS. IN A STATEMENT FROM THE PROVINCE TODAY, IT WAS ANNOUNCED THAT LOUKIDELIS HAS BEEN APPOINTED DEPUTY ATTORNEY GENERAL EFFECTIVE FEBRUARY 1. AN ALL PARTY COMMITTEE WILL SELECT THE NEW PRIVACY COMMISSIONER, NONE OF THE CANDIDATES WERE NAMED WEDNESDAY. LOUKIDELIS REPLACES ACTING DEPUTY ATTORNEY GENERAL JERRY MCHALE, APPOINTED IN OCTOBER 2009 AFTER ALLAN SECKEL WAS APPOINTED DEPUTY MINISTER TO THE PREMIER.
- LIZ MCARTHUR

New privacy rules for Crown-run casinos in Saskatchewan

2010-01-11T20:28:00.000-04:00

The Saskatchewan Privacy Commissioner has told government run casinos in the province to requiring the addresses of people who buy show tickets with cash. The amount of personal information collected by casinos is breathtaking, so I'm most surprised by the revelation that only now is Gaming Saskatchewan appointing a privacy officer.

The Canadian Press: New privacy rules for Crown-run casinos in Sask. after complaint investigation
(CP) REGINA — Two Crown-run casinos in Regina and Moose Jaw, Sask., are no longer demanding personal information from people who pay cash for tickets to live stage shows.
Gary Dickson, the province's information and privacy commissioner, says Saskatchewan Gaming has adopted new privacy rules to stop the practice.
He says his agency launched an investigation in 2008 after someone who tried to buy a ticket with cash was told they would still have to provide personal information, such as a home or email address.
Dickson says when his agency investigated, they were told that one of the reasons the information was collected was to notify ticket holders in case a performance was cancelled or delayed.
But he says their investigation found that didn't happen very often and it wasn't a credible reason to collect the information.
Dickson says Saskatchewan Gaming now has a senior official in charge of privacy issues, has developed new privacy policies, provided more training to staff and has developed signs and brochures telling customers that providing personal information is not mandatory.

EPIC reports that body scanners can store, send images

2010-01-11T09:58:00.000-04:00

According to documents obtained by EPIC and made available to CNN, body scanners procured by the TSA are designed to be able to record and transmit images, whcih appears to contradict assurances given by the agency:

Body scanners can store, send images, group says - CNN.com
Washington (CNN) -- A privacy group says the Transportation Security Administration is misleading the public with claims that full-body scanners at airports cannot store or send their graphic images.
The TSA specified in 2008 documents that the machines must have image storage and sending abilities, the Washington-based Electronic Privacy Information Center (EPIC) said.
In the documents, obtained by the privacy group and provided to CNN, the TSA specifies that the body scanners it purchases must have the ability to store and send images when in "test mode."
That requirement leaves open the possibility the machines -- which can see beneath people's clothing -- can be abused by TSA insiders and hacked by outsiders, said EPIC Executive Director Marc Rotenberg.
EPIC, a public-interest group focused on privacy and civil rights, obtained the technical specifications and vendor contracts through a Freedom of Information Act lawsuit.
The written requirements also appear to contradict numerous assurances the TSA has given the public about the machines' privacy protections....

I wasn't able to find the documents themselves on the EPIC website.

Alberta Privacy Commissioner has some choice words about airport body scanning

2010-01-07T18:25:00.003-04:00

The incomparable Frank Work, Information and Privacy Commissioner of Alberta, appears to have an opinion on body scanning technologies.

Privacy boss pans scans
New naked body security measures at airports don't fly, he says

By MICHAEL PLATT
The thin edge of the wedge -it's not the happiest of analogies when the subject is naked body scans and orifice-probing technology.
But that's the uncomfortable warning from Alberta Privacy Commissioner Frank Work, following a federal decision to install full-body security scanners at major Canadian airports, including Calgary and Edmonton.
Blasting the move as a serious blow to personal privacy and dignity, Work says he expects the obvious flaws in body-scanning security will result in more high-tech "toys" to fill the gaps.
"What will they do next, after the next incident? We're running out of toys and technological silver bullets," said Work, one day after the federal government announced the new airport security measures.
Work guards the privacy of Albertans, be it information or images.
If this was an Alberta rule or an airport decision, Work would surely step in and prevent the visual strip-search.
But being federal legislation, Work fears there is nothing he can do to block the airport scanners, which expose naked images of passengers to the eyes of prying security staff.
"The bottom line is it's a dignity issue, and either out of fear or because we don't want to stand in line too long, we've forsaken any notion of dignity -- it's like, all right, we'll assume the position," said Work.
He's awaiting a call from federal Transport Minister John Baird, but Work believes his hands are tied.
Work said that because human-monitored body scanners aren't perfect, showing only a surface view of the nude passenger, he believes it's a matter of time and/or tragedy before the next step is taken.
"The system is still prone to failure, so let's say the next guy packs his ass with however many grams of (plastic explosive) he can shove up there, and either successfully or unsuccessfully detonates it. What do they do next?" said Work.
"How do they trump full body scans? There actually is a device called the BOSS -- the Body Orifice Security Scanner -- where you sit in a plastic armchair and it can detect plastic or metal in body orifices. Is this next?"
The privacy boss knows his technology, and the chair he references is used in U.S. prisons, in lieu of the old rubber glove approach. That it could easily be installed in airport security areas is a squirmy thought.
Work believes it's just a matter of time.
"At what point do we say, 'Holy crap man, you're patting me down, you've got pictures of me naked, you've got me squatting on a chair, and you've taken my water bottle away'. I mean at what point is enough, enough?"
The federal government is installing 44 of the $250,000 body-scanners across Canada, as well as implementing a new system of visual observation, where security staff will monitor passenger behaviour.
The changes come in response to a Christmas Day attempt to blow up a jetliner over Michigan, when a Nigerian man failed to ignite explosives sewn into his underwear.
While the new body-scanners reportedly wouldn't have caught the underwear bomber -- the explosives were spread too thin -- U.S. demands for extra security have forced countries like Canada to follow suit.
Work says Canada obviously has little choice, if citizens want to travel internationally.
While the U.S. is forcing Canadian travellers to surrender their dignity, Work said the real danger is people starting to believe in safety, purchased through an invasion of privacy.
"The thing that troubles me most as the privacy commissioner, is we're getting more and more used to this stuff.
"Maybe we have to throw in the towel on the body scanners, but the next time the police or authorities come along wanting to blanket the city in cameras for safety reasons, we'll be that much more compliant."

Scary and funny: Undressing the naked truth about the future of airline travel

2010-01-07T09:22:00.001-04:00

This is too funny, scary and prescient:

Undressing the naked truth about the future of airline travel
Cavity searches, complementary catheters, cryogenic suspension will be the norms
By Paula Simons, Edmonton Journal
January 7, 2010 2:07 AM
The Edmonton Journal
January 7, 2011
The federal government says Canadian air travellers will soon be asked to undergo full-body cavity searches.
The move comes after full-body scanners, of the same type installed in Canadian airports last year, failed to detect bomb-making materials that a group of alleged would-be bombers had secreted within their personal body cavities.
Transport Canada says passenger privacy will be fully protected, because all individuals being stripped-searched will wear paper bags over their heads, preventing security officers from seeing their faces.
"We feel this strikes the necessary balance between protecting passenger safety and avoiding unnecessary traveller embarrassment," said Transport Canada spokesman Winston Smith.
Health Canada will compensate travellers by including complementary prostate exams and PAP smears as part of the inspection process.
"We won't just be striking a blow in the war on terror," said Reductio Ad-Absurdum, a spokesman with the Prime Minister's office. "We'll also reduce the burden on our public health-care system by screening early for cervical and prostate cancer. We think Canadians will be open to the value-added benefits."
While a few civil libertarian academic-types raised concerns about the invasion of privacy, most of those commenting on The Journal's web-site were enthusiastic.
"Flying is a privilege, not a right," said one.
"If you don't have anything to hide, why would you object?"
"The world is a scary place," said another. "I don't mind having my government stick its nose into every nook and cranny."
The Edmonton Airport Authority is asking all local passengers to arrive at the airport at least five hours before flight time to allow enough time for the new inspections.
---
The Edmonton Journal
January 7, 2015
In a new policy initiative designed to flush out terrorist plots, Transport Canada has announced that airline passengers will no longer be allowed to use on-board washrooms while the plane is in flight.
"Letting people move freely through the cabin, allowing them access to a private space where they couldn't be monitored, well, it's just too big a risk," said Transport Canada spokesman Winston Smith.
Passengers will be required to stay in their seats, with their belts securely fastened, for the duration of the flight. For short-haul flights, passengers will be provided complementary adult diapers. Long-haul flyers will be issued personal catheters.
"We feel this strikes the necessary balance between protecting passenger safety and avoiding unnecessary traveller embarrassment," Smith said.
While civil libertarians and others soft on terrorism suggested the new policy was an affront to human dignity, public response was muted.
"This is public safety we're talking about here," said Edmonton passenger Saaphtee Pherst, 52.
"If you have a problem with it, then don't fly."
The Edmonton Airport Authority is asking long-haul passengers to arrive six hours ahead of their departure time to be fitted for catheters.
---
The EdJour.com
January 7, 2020
In a move designed to restore public confidence in air travel, Transport Canada has announced it is moving to align with a new American policy that requires that all airline passengers be placed in pre-flight cryogenic suspension.
"We believe that flash-freezing will maximize both passenger safety and passenger comfort," said federal spokesman Winston Smith. "Ever since we banned people from taking books, magazines, computers and food aboard planes, and made it illegal for them to get out of their seats, air travel has become unduly tedious. This way, we eliminate any terrorism and boredom, and allow passengers to arrive safe and well-rested, without jet lag. And since we'll be able rip out the seats and stack passengers like cordwood, we'll be able to make more efficient use of space and fuel."
Federal spokesman Reductio Ad-Absurdum said cryogenics was a proven technology with minimal health risks.
The Edmonton Airport Authority is asking all passengers to report to the airport 24 hours before their flight for freezing.
The EdJour.com
January 2, 2021
---
Air UnitedCanNorthWestDeltaKLMVirginJALEl-AlJet, the world's sole surviving airline, filed for creditor protection this week in the wake of a disastrous Christmas travel season. A climate of fear, combined with fears about climate change, meant no one flew anywhere.
"Flying was no longer exciting or convenient," said business analyst Noitall Pundit. "The Age of the Airplane is over."
Travel Alberta is now asking people to travel by low-carbon donkey instead, and to stay strictly within a 100-mile radius of home.
"Foreign travel is dangerous and overrated. So are foreigners," said spokeswoman Pollyanna Xenophobe. "Alberta is the promised land. Really, no one should ever want leave it again."

We need a debate on the privacy impact of body scanners

2010-01-07T07:19:00.002-04:00

I was interviewed by the Halifax Chronicle Herald on the need for a thorough debate about the privacy impact of body scanners and to make sure that we are actually dealing with the problem. And if we're going to use the technology, we need to ensure that all steps are taken to mitigate the privacy impact.

Safety vs. privacy: - Nova Scotia News - TheChronicleHerald.ca
Safety vs. privacy: Legal expert warns tradeoff of agreeing to virtual strip search might not be worth it
By KELLY SHIERS Staff Reporter Thu. Jan 7 - 4:47 AM
A Halifax privacy expert says airline passengers willing to undergo virtual strip searches are trading privacy for security in an equation that may not result in increased safety in the air.
"Because this is almost unprecedented in its intrusiveness, that means we really need to have a debate about it," David Fraser said Wednesday.
"If you throw out people’s privacy, it doesn’t necessarily mean you’re going to end up with the best security.
"I think we need to have all the facts in front of us about how effective these things are, what sort of impact they’re having on privacy, and how (we can) increase the effectiveness of security while trying to mitigate the impact it can have on privacy."
RELATED» Privacy czar probes Ottawa’s plan for airport surveillance » Slovaks plant explosive in traveller’s luggage in failed security test» Airport security: Last line of defence
Mr. Fraser, a privacy lawyer with McInnes Cooper, said most of the people he has spoken with have reacted positively to the news that airports across the country, including in Halifax, will soon use scanners that see through clothes.
The machines show a three-dimensional outline of a naked body that allow screening officers to see whether someone is carrying dangerous items.
"When they balance their safety versus their privacy, they’re happy to give up their privacy in exchange for their safety," he said.
The scanners have been used at some airports outside Canada and were expected to be introduced in this country at some point.
But on Tuesday, the federal government announced it will buy 44 machines as part of an international response to a man’s attempt to blow up a jet approaching Detroit on Christmas Day. The man was wearing explosives sewn into his underwear.
The devices are only supposed to be used on passengers who have been singled out for secondary screening. Those passengers can choose to go through the machines or be frisked.
Mr. Fraser said he would prefer to be scanned rather than have the kind of intrusive pat-down that would be required in order to detect explosives sewn into underwear.
But he said he believes technology is only part of the answer to combating terrorism in the air.
"It’s convenient to throw technology at the problem and I think there may be an assumption this is going to make everybody safe, but I’m not sure this is necessarily the case," he said.
The devices have shortcomings, even if they are better than what is now in place, he said.
And technology, he said, may not be as effective as "strategic investments in humans" who are collecting, analyzing and using the massive amounts of data about possible threats and possible terrorists.
He said the public should ask questions about the use of the images and the safeguards that will be in place to protect them.
Under a plan approved by Canada’s privacy commissioner, an officer would view the image in a separate room and never see the passenger. The images are supposed to be erased automatically and no copies kept.
Other possible safeguards could include scanning screeners to ensure they’re not carrying cameras or cellphones capable of taking pictures of the images, Mr. Fraser said. And just as pat-downs are only done by members of the same sex, perhaps that rule should apply to viewing the naked images, he said.

TMI: The backfiring of the surveillance state?

2010-01-06T13:14:00.000-04:00

This is an extremely interesting read: The backfiring of the surveillance state. Glenn Greenwald takes the position that intelligence and national security agencies in the US are so buried in data from surveillance and other sources that it has led to paralysis