Even before Facebook’s Cambridge Analytica scandal started making headlines, experts were sounding the alarm about how the mountains of data generated by Canadians’ online activities was being collected and used – and the federal government wants them to know they’re listening.
On Tuesday, Minister of Innovation, Science, and Economic Development Navdeep Bains announced that the federal government would be launching a series of consultations regarding a national data strategy.
In the June 19 press release that accompanied the announcement, Bains said that while technologies such as artificial intelligence and big data are presenting “new opportunities for innovators to create jobs and generate prosperity… to spur digital innovation, investment, and job creation in Canada, citizens must have trust and confidence that their data and privacy will be protected.
“This consultation is a first step in making this vision a reality,” Bains said.
According to the Ministry, the consultations will take the form of several roundtable discussions that will be held over the summer in cities across Canada, with businesses, educational institutions, and private citizens invited to participate. Anyone not attending the consultations is invited to share their views online.
“Because there is strength in our diversity, the roundtables will include women, Indigenous peoples, and other under-represented groups,” the Ministry said in the June 19 release.
Kris Klein, a partner at Ottawa’s nNovation LLP and managing director of the International Association of Privacy Professionals’ (IAPP) Canada chapter, called the announcement “welcome news among the thousands of privacy professionals in Canada who have been calling for this for several years now.”
“Our only hope is that the consultations don’t drag on too long and, more importantly, result in significant legal and policy amendments that recognize the brave new world we find ourselves in,” Klein told IT World Canada. “After all, we have been living in a world where big data has been used for years already, most often for good, but we have seen nefarious uses that put a strain on the legal mechanisms we currently have.”
“It is high time to get moving on this and I’m quite certain I’m simply echoing what all privacy professionals in Canada have been saying already,” he said.
Information Technology Association of Canada (ITAC) CEO Robert Watson also praised the announcement, saying in a June 19 release that it shows “the federal government recognizes that a strategy is required to balance privacy, consumer trust and the security needs of Canadians – and is making the necessary changes to help put Canada in a position of growth and as a data-driven economy.”
A necessary step to keep American businesses in check – Balsillie
A key reason many privacy experts support building a national data strategy is the need for Canadians to retain ownership and access to the data that so many American companies collect from them. A statement issued Tuesday by Benjamin Bergen, executive director of technology CEO association the Council of Canadian Innovators said that “if Canada is to be a leader in the data-driven economy, we need policies that enable Canadian innovators to capture the scale and scope of data generated by Canadians, which will cause more businesses to be more innovative, create more jobs and generate wealth in Canada.”
A presentation made last December provided greater context for Bergen’s statements: he warned that without new federal policies Canadians risked becoming “data cows” for the likes of Facebook, Amazon, Netflix, and Google.
Bergen’s concerns have been echoed by BlackBerry co-founder, Council of Canadian Innovators chair, and privacy think-tank Centre for International Governance Innovation (CIGI) founder Jim Balsillie, who was not available for an interview but in a May 10 presentation to the House of Commons said that “Canada’s innovators know that data flows have transformed commerce and made data the most valuable asset in today’s data-driven economy.”
“Businesses use data to create as well as access new markets and also interact globally with both customers and suppliers,” Balsillie said during the presentation. “Control over data and networks allows dominant firms to hinder competition to extract monopoly rents from their customers and to deceive consumers via their data collection strategies.”
“Vast troves of data are collected and controlled by foreign, unregulated digital infrastructures,” Balsillie continued. “If Canada doesn’t create adequate data residency, localization and routing laws that protect Canadians, then our data is a subject to foreign laws making Canada a client state.”
…And governments – Cavoukian
Former Ontario privacy commissioner Ann Cavoukian, who currently leads the Privacy by Design Centre of Excellence at Toronto’s Ryerson University, welcomed the news as well, calling privacy “the foundation of our freedom.”
“You cannot have free and open societies without a foundation of privacy,” Cavoukian told IT World Canada. “If you value your freedom, which we can take largely for granted here in Canada, then you value privacy. We ought to preserve that for future generations.”
Cavoukian admitted, however, to being taken aback by the focus of her peers and the Ministry alike on ensuring that businesses respect user privacy, when government use of citizen data can be just as invasive, if not worse.
“With due respect, they should worry about the growth of the surveillance state, because the government is as bad as any private sector entity in terms of collecting massive amounts of personal information,” she said. “Law enforcement does it – without a warrant, they impersonate cellphone towers with IMSI [International Mobile Subscriber Identity] catchers – and that’s who we should be worried about in terms of what they’re doing with our information.”
Current standards not a problem?
Whether the target is businesses or government, however, not every privacy expert believes Canada’s current data standards are an issue.
Halifax-based internet, technology, and privacy lawyer David Fraser called the data gathering policies employed by tech giants such as Google and Facebook – including Cambridge Analytica, which may have harvested the data of up to 87 million Facebook users through online quizzes they or their friends may have taken – nothing more than “simple reality.”
“The reason Facebook has information on 28 million Canadians is because 28 million Canadians choose to use Facebook,” Fraser told IT World Canada. “The reason Amazon has information on Canadians is because Canadians choose to buy stuff from Amazon. There’s no competing Canadian online retailer that comes close. Same with Google, there’s no competing search engine, online document suite, or email product.”
“I’ve been hearing a lot over the last little while from [BlackBerry and CIGI’s] Balsillie and others advocating for a data strategy mainly by pointing out bogeymen without suggesting a solution,” he continued. “They’ll say, ‘these American companies have all this data on us,’ as though that’s a creepy thing, or ‘all of our data is stored outside of Canada,’ as though that’s a creepy thing, or that ‘Cambridge Analytica was able to do creepy things with our data, and that is a creepy thing.'”
“There’s nothing inherently nefarious about their actions,” he said. “These are just the companies that are, frankly, the best at what they do, and they happen to be from the United States.”
Referring again to Balsillie, Fraser said that given how much information is collected by mobile devices, BlackBerry could have leveraged its network in a similar way during its heyday, and arguably lost its leadership position in the mobility space by failing to do so.
He acknowledged that many of his peers want to revise Canada’s data privacy laws to match the higher standards of the European Union’s General Data Protection Regulation (GDPR), and while arguing that current privacy laws are a 95 per cent match, recognized that for others, that means matching the GDPR’s restrictions on cross-border transfers. But he wonders if that’s possible.
“If you’re concerned about information about Canadians that’s outside Canada, what do you really do about it?” Fraser said. “Because if your answer is, ‘Canadians don’t get to use Facebook anymore,’ or ‘Canadians don’t get to use Google anymore,’ or ‘Canadians can’t buy stuff from Amazon anymore,’ that’s absurd.”
Not a zero-sum equation
Former Ontario privacy minister Cavoukian told IT World Canada that she agrees with experts such as the Council of Canadian Innovators’ Bergen who say that Canadian businesses must be free to innovate – but added that by emphasizing business interests, such arguments create a false zero-sum equation by implying that privacy inhibits innovation, when the opposite is the case.
“If you embed privacy into the design of your operations – if you tell your customers the lengths you’re taking to respect their privacy – they’ll value it enormously, and reinforce what you’re doing by giving you repeat business, which will attract new opportunities,” Cavoukian said, noting that this is the foundation of the privacy by design principles that she developed and which are now incorporated into the GDPR.
