Six months ago Ontario’s internationally-known privacy commissioner, Ann Cavoukian, left the government to become executive director of Ryerson University’s Privacy and Big Data Institute.
She’s spoken almost two dozen times at conferences since, but on Jan. 22 the institute will hold a coming-out of sorts by hosting its first seminar for organizations and the university’s faculty to explain what it’s all about.
By coincidence, when I interviewed Cavoukian last Friday afternoon as news broke that police in Paris had just taken down three terrorists who combined killed 17 people. She worried the event will be used to erode security and privacy rights.
“Any time there’s a major terrorist incident the pendulum swings back and there are calls to forget about privacy, we have to focus on security,” she said as we sat down. “It’s always a zero-sum proposition — ‘It would be nice if we could do both, but we can’t so we’re going to focus on public safety.’ And that premise is what I want to banish … you can do both. We’ve demonstrated that in countless studies and papers we produced.”
Appointed the provincial privacy commissioner in 1997 after working in the commissioner’s office for a decade, Cavoukian had taken an interest in information privacy for some time. In 1995 she and the Dutch data protection commissioner published a paper on ways of protecting identity in information systems.
That led to the creation of the concept of Privacy by Design, which urges organizations to build privacy into their entire operations.
As a privacy commissioner, Cavoukian was responsible for enforcing provincial legislation and handling complaints. Now she and her staff of three can focus more on research and advocacy, particularly around big data — which almost every organization feels it has to take advantage of these days.
“I honestly feel that’s the most important role I can fill,” she says. “Demonstrate to both business and government you can have privacy and various other functions, such as security.”
It’s a message she says is increasingly heard in many quarters — the Pentagon, for example, where’s she’s been invited to speak twice. On the other hand, she doesn’t hold much hope for agencies like the FBI and Canada’s electronic spy agency, the Communications Security Establishment Canada (CSEC).
It’s not that privacy has no role in law enforcement, she adds. But any organization has to make sure the personal data it holds is protected, and that only the necessary amount of personal data is held.
As for the private sector, she insists that “you don’t have to forgo privacy in order to conduct data analytics.”
In fact, she insists, it’s good business. Think Target or Home Depot.
“Wouldn’t you rather use that data (your organization has) with confidence than have a fear that it will come back to bite you?” she asks
“When I talk to companies and tell them to embed Privacy by Design into their operations (I say) don’t just do it because it’s a good thing to do, or you’re following the law. Treat privacy as a business issue, not a compliance issue.
“Because if you treat it as a business issue you will build trust and confidence of the customers you already have, and you’ll attract new customers because you will give them the assurance you are using the information to provide them with a service they want, and the information won’t go to a third party without their consent — you make them a player. If you give them the privacy assurance they will give their trust and repeat business.”
Her institute is also just getting started on research into ways people can protect personal data on the Internet, such as a token that allows information to be used in different ways by separate Web sites.
To futher that there’s an upcoming project with the Southern Ontario Smart Computing Innovation Platform, a consortium of 11 universities funded in part by IBM, Ottawa and the province of Ontario.
Cavoukian’s passion for protecting personal data hasn’t waned over the years, and, she notes, since the revelations of former NSA contractor Edward Snowden public distrust over government has only increased.
Businesses don’t want to be seen to be allies of governments, so companies like Google and Apple are changing their mobile operating systems so data is encrypted by default. That’s being fought by law enforcement agencies. “That’s the big fight of this decade,” predicts Cavoukian.
“To me the saddest thing is there is such a focus on public safety and surveillance that we lose our freedoms. And if we lose our freedoms, to me the terrorists have won.”
