In the 15 years that Ann Cavoukian has been the Ontario Information and Privacy Commissioner, the very definition of privacy itself has evolved with the digital age.
Cavoukian is the first commissioner to hold her position for three terms and during that time, the digital era has disrupted notions of privacy in ways that few could anticipate. Trends such as the rise of social networking, the need for government to protect digital personal information of citizens, and aggressive digital marketing practices were unheard of in the ’90s. In her role, Cavoukian has had to fight to protect the privacy of Ontarians even as they flock to share their personal information in more open ways than ever before.
As a result her time as the province’s privacy watch dog has been spent guarding the gates of technology. She’s worked with social networks, technology vendors, and tech startups to build privacy into their products from the beginning, designed on her “Privacy by Design” framework that she says is a positive-sum model – meaning that it’s possible to have both security and privacy for the individual and no need to trade one for the other.
We spoke with the commissioner, reflecting on the past 15 years and looking forward to her new role at Ryerson University at the helm of the new Institute for Privacy and Big Data:
Brian Jackson: You’ve been the Information and Privacy Commissioner of Ontario since 1997. Has the privacy of Ontarians improved since then or gotten worse?
Ann Cavoukian: I think in Ontario it has improved. It seems that people in government are scared of me, that’s what I hear all the time. I think what they mean is that on privacy we don’t cave, we don’t back down, we stand firm. The government has started adopting my Privacy by Design principle and has opened a a centre of excellence for it, so they take it very seriously and I’m proud of that.
If you’re hearing a reticence, it’s about access more so than about privacy, which is a different story. Because of the record deletion last year [at the Premier’s office and Minister of Energy]. I’m not surprised the government want to withhold information that might cause them embarrassment. But provincially, we excel at meeting freedom of information requests compared to federally, there’s no question.
Mobile Device Management is one of the ways we can address costly data leaks. “It’s important to try and prevent them in the first place, almost like a medical approach. We want to minimize the risk and eliminate harm right from the outset.”
BJ: What do you think was your biggest accomplishment?
AC: It has to be Privacy by Design. It has been unanimously voted in as an international standard in 2010. We simply no longer have the capacity as regulators to protect prviacy after the fact. You can’t rely exclusively on regulatory compliance, it’s like an iceberg where most of the harm done is below the waterline. With online activity and massive data sharing, it’s impossible to contain all the privacy breaches happening and most of them go unknown and unreported.
So it’s important to try and prevent them from happening in the first place, almost like a medical approach. We want to minimize the risk and eliminate the harm right form the outset. The cost is staggering, not only in terms of class action lawsuits but the damage to your brand. Think of Target – the president of Target in the U.S. resigned, the Target CEO in Canada was fired and their sales are down 50 per cent.
Privacy by Design has been translated into 37 languages around the world. Recently Barcelona contacted me and said they’d translated it into Catalan, and Japan let us know that it now insists on private sector companies delivering a positive sum privacy model. It’s truly a global phenomenon that beneifts Ontario because people associate it with us.
BJ: You’re moving on to a new role with Ryerson University as the executive director of the Institute for Privacy and Big Data. What do you hope to achieve in your new position?
AC: Once I gave word I wanted to depart my post, Ryerson University called with a good offer and asked me to head up the Big Data Institution. I wanted to put the privacy is the title. Everything we do will emanate with privacy and big data analytics. It will be all about the Privacy by Design model. Big data sets will be huge and valuable, but must be used in a way that doesn’t infringe on privacy.
The branding of the institute was done intentionally to show that privacy doesn’t stifle big data. First comes the honeymoon where everyone is enamoured with big data and there’s no room for privacy. Then comes the reality phase and that’s what we’re seeing right now. Everyone is questioning the expectations around big data. The ask was too much without giving thought to the privacy implications. We are going to survey all the existing protections that we can do right now. We’re also going to develop new technologies that will give you better assurance and better quality of your data. I think you’re going to see great results.