Researchers at the University of Toronto are highlighting trust issues between Canadian customers and the businesses they deal with. Access My Info is a web site that enables organizations to query business about how they’re collecting and using personal data.
The site aims to put the power back in Canadians’ hands, by automating their ability to find out what companies know about them. A joint project between the Munk School of Global Affairs’ Citizen Lab, CIRA and non-profit privacy research group Open Effect, the site creates letters for Canadians to send to a variety of companies, asking for the information stored about them. It uses Canada’s commercial privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA).
The project originally began as a tool to help Canadians retrieve the information held on them by telecommunications companies, said Andrew Hilts, executive director of Open Effect and researcher at the Citizen Lab.
“We felt that we could have greater impact on starting a public conversation about the use of personal data by developing a tool that would allow Canadians to exercise their right of access,” said Hilts.
The expanded version of the tool, launched last month, broadens the coverage to dating applications, fitness tracker companies, and selected agencies from the Government of Canada. “We’re especially excited to see the results about the various dating applications because they’re collecting incredibly sensitive information,” he said.
The tool comes at a time when trust among Canadian customers is low – and businesses need to try harder. In February last year, the Canadian Privacy Commissioner’s office released a survey of 1500 Canadians, and found that seventy seven per cent of Canadians had refused to give personal data to an organization. A third of respondents had asked a company how it uses information that it holds about them, and over four in ten of those people refused to do business with a firm on that basis.
More recently, the Privacy Commissioner surveyed a thousand Canadian businesses, and found that fewer than half of them had privacy policies to information customers about the personal information that they collect, and how they use it. Canada clearly still has some work to do.
Telecommunications firms at least have been responding positively to this pressure, said Hilts.
“In the last few years there’s been a lot of progress especially in the Canadian telecommunications industry, and a lot of that is because of the release of the transparency reports,” he said.
The major Canadian telcos have been releasing reports answering some of the questions that Access My Info originally asked, he explained. They also discussed what kinds of data requests they have been getting from government authorities.
“As a reality of doing business, you necessarily have to interact with law enforcement, but it’s important to be as up front as you can with customers about how that works, so that they can be more informed and make appropriate decisions based on the information available to them,” he said.
In other sectors, some incidents show that Canadian companies have more work to do. Last summer, one customer found that TD Bank reserved the right to examine all of his Internet browsing activity, for example.
