(Un)Lawful Access Legislation – Ottawa Public Forum

(Un)Lawful Access Legislation – Ottawa Forum

ABOUT ONLINE SPYING : The government is trying to push through a set of electronic surveillance laws that will invade your privacy and cost you money. The plan is to force every phone and Internet provider to allow “authorities” to collect the private information of any Canadian, at any time, without a warrant. Learn more and sign the petition at stopspying.ca
FORUM LOCATION: Wednesday, Feb. 8 Amphitheatre – St. Paul University 223 Main Street, Ottawa, ON 6-10 pm
6:00-7:00 pm Book launch—The Internet Tree; The State of Telecom Policy in Canada 3.0
Refreshments in the Atrium next to the Amphitheatre—sponsored by the Canadian Centre for Policy Alternatives (CCPA)
7:00 – 7:30—(Un)Lawful Access—a mini-documentary that features some of Canada’s leading legal and privacy experts, who explain the dangers of the federal government’s impending “Lawful Access” legislation, dubbed “Online Spying” by Canadians. (15min)—Moving Toward a Surveillance Society—mini-documentary from the B.C. Civil Liberties Association presenting the findings of new report on proposed law. (10 min)
7:30-8:30 Technical Panel + questions – Christopher Parsons Lawful Access: Stepping towards a harmonized surveillance complex?—Kirsten R. Embree Devil in the details: what will be the impact on ISPs? more to come…..
8:45-9:30 Political Panel + questions Moderator: Michael Geist—Charlie Angus, NDP—Elizabeth May, Green Party more to come…..
9:30 Summary; actions; continuing activities
SPONSORING ORGANIZATIONS // Canadian Internet Policy and Public Interest Clinic (CIPPIC)—Council of Canadians (COC) – International Civil Liberties Monitoring Group (ICLMG) – National Union of Public and General Employees (NUPGE) – OpenMedia – Public Interest Advocacy Centre (PIAC) – The Rideau Institute
More information at: unlawfulaccess.ca
Download the poster:

(Un)lawful Access Legislation – Ottawa Public Forum
Download File: lawful_access_event_poster.pdf [size: 0.46 mb]

Change data breach bill to notify more consumers, New PIAC report

The Public Interest Advocacy Centre (PIAC) today released a report entitled “Data Breaches: Worth Noticing?”. The report examines data breach notification in Canada in the private sector in general and in particular whether the proposed federal data breach notification law (Bill C-12) is adequate to protect Canadian consumers.
“Data breaches affect consumer confidence in the new economy,” said John Lawford, PIAC legal counsel and co-author of the report. “Government must require business to report all data breaches to the Privacy Commissioner of Canada or their provincial privacy commissioner.”
The report recommends that Bill C-12, An Act to amend the Personal Information Protection and Electronic Documents Act, be significantly toughened to require all data breaches be reported promptly to the Federal Privacy Commissioner, who in turn should have the power to order companies to notify individual consumers when there is a real risk of significant harm to them. The report also recommends Bill C-12 be amended to give the Privacy Commissioner of Canada order-making power to enforce the requirements and a fining power for non-compliance.
PIAC’s study is based in part on focus groups of Canadian consumers regarding their attitudes to data breaches.
“Consumers clearly think that they should always be notified when a company has lost their personal information unless the Privacy Commissioner says there’s no real risk of harm to them” said Lawford. “Bill C-12 is too weak to assure them that will happen,” he noted.
PIAC called for other amendments to Bill C-12, including increased audit powers for and a special data breach division at the Office of the Privacy Commissioner of Canada.
The Public Interest Advocacy Centre received funding from Industry Canada’s Contributions Program for Non-profit Consumer and Voluntary Organizations. The views expressed in this report are not necessarily those of Industry Canada or of the Government of Canada.

Data Breaches: Worth Noticing?”
Download File: data_breaches_worth_noticing_publication_version_final_final.pdf [size: 0.92 mb]

Executive Summary
Download File: executive_summary_data_breaches.pdf  [size: 0.11 mb]

Sommaire: Ce rapport examine la notification des atteintes à la protection des données au Canada dans le secteur privé en général et, plus particulièrement, si le projet de loi fédéral sur la notification des atteintes à la protection des données (Projet de loi C‐12, Loi modifiant la Loi sur la protection des renseignements personnels et les documents électroniques) permet de protéger de façon adéquate les consommateurs canadiens.
Download File: sommaire_data_breaches.pdf [size: 0.14 mb]

Appendix 1: Focus groups
Download File: databreachesappendix_1_focus_groups_1.zip [size: 0.17 mb]

Data breaches: Appendix 2: Environics Report
Download File: appendix_2_environics_report_2.pdf [size: 0.32 mb]

 

Consumers Anonymous? The Privacy Risks of De-Identified and Aggregated Consumer Data

Private sector companies may aggregate personal information about their customers for internal purposes and analysis and some companies may sell their aggregated data for profit. Other companies’ business models are founded on combining various sets of aggregated data with sets of publicly available information to produce valuable data sets that help companies make predictions about customers and better target customers or engage in “data mining” practices. When data is aggregated, organizations often claim that they anonymize data such that it no longer fits within the definition of “personal information” under PIPEDA.
However, several researchers have recently shown that de-identified data is often not very anonymous and pieces of data can easily be re-identified or “reattached” to information about an identifiable person. This practice of re-identification is problematic because oftentimes consumers do not realize that the commercial bartering of their personal information is a burgeoning and profitable industry.
As organizations collect an increasing amount of personal information about consumers, their practices of de-identifying this personal information should be scrutinized to ensure that the data has been de-identified to a sufficient degree to protect the consumer from re-identification and potential harms that could flow from the use of de-identified data. Industry best practices regarding de-identification and anonymization would serve to bring increased transparency to garner consumer trust in personal information practices.
De-identified data and the questions around re-identification are growth industries. PIAC’s report explores these questions and privacy concerns with de-identification practices. Given the potential harms to consumers and citizens, the OPCC must monitor this question closely and provide timely guidance to industry – and comfort to consumers – to assure all parties they are aware of how identifiable individuals are or may become in the course of regular commercial data processing.
PIAC also provides a fact sheet (FAQ) to explain de-identification and aggregation practices and privacy risks to consumers. The FAQ also provides information about what consumers can do to protect their privacy.
 

PIAC Consumers Anonymous Paper
Download File: piac_consumers_anonymous_paper_final_6oct2011.pdf [size: 1.15 mb]

PIAC Consumer Fact Sheet FAQ on De-identification and Privacy Risks
Download File: fact_sheet_faq_final_6oct2011_2.pdf [size: 0.07 mb]

PIAC Report: Can We CAN SPAM in Canada?

(OTTAWA)— The Public Interest Advocacy Centre (PIAC) in a report released today entitled, “Can We Can Spam in Canada?” lauded Canada’s recently passed anti-spam law, Bill C-28, as providing real hope for consumers in the fight against unwanted email.
PIAC’s report includes a survey of Canadians’ attitudes to spam. While those attitudes are changing to be more accepting of “legitimate” commercial email, it is clear that Canadians overwhelmingly favour the requirement in the new law for marketers to ask consumers for express consent prior to emailing them.
PIAC counsel and report co-author John Lawford noted that although most Canadians may see slightly less spam than a decade ago in their inboxes, that much more of it now is malicious and spam is moving to new platforms, like social networking sites: “The new law likely will not only reduce unwanted commercial messages but, crucially, phishing and other fraudulent emails that cost Canadians millions every year. This is reason for hope in the fight against spam.”
The report recommends that the Canadian Radio-television and Telecommunications Commission, who are primarily responsible for the fines and penalties spammers now face in Canada, undertake “intense enforcement efforts” in the early days of the law to send a message to violators of the new law and to bolster Canadians’ confidence in using online commerce.
PIAC received funding from Industry Canada’s Contributions Program for Non-Profit Consumer and Voluntary Organizations to prepare the report. The views expressed in the report are not necessarily those of Industry Canada or the Government of Canada.
The full report is available for download here:

PIAC Report: Can We CAN SPAM in Canada?
Download File: can_we_can_spam.pdf [size: 0.7 mb]

 
For more information, please contact:
John Lawford
Counsel
Public Interest Advocacy Centre
ONE Nicholas Street, Suite 1204
Ottawa, ON K1N 7B7
(613) 562-4002×25 (Tel)
(613) 562-0007 (Fax)
lawford@piac.ca
 

PIAC Submission to Ontario government re: proposed privacy legislation

Comments to the Ontario MCBS on the Consultation Draft of the Privacy of Personal Information Act, 2002

Key Points

• The draft legislation’s opt-in approach to consent for marketing strikes the right balance between individual privacy and business needs, and reflects clearly expressed public opinion.
• If negative option consent is permitted, it should only be so in limited, specified circumstances, and only where specific conditions have been met. Those conditions should require that the negative option be brought to the individual’s attention, be clearly worded and sufficiently detailed, and be easy to execute at minimal cost.
• The proposed “definition” of implied consent in subs.8(5) is appropriate and should not be revised. If negative option consent is permitted, it should be subject to a different set of requirements, given important distinctions between it and normal implied consent.
• Express consent should not be required where consent can be implied under the proposed test in subs.8(5). Nor should exceptions to the rule of consent be provided where the test for implied consent is met. Such duplication creates unnecessary confusion, suggesting as it does that consent cannot be implied where indeed it can.
• If necessary to address stakeholder uncertainty as to when consent can reasonably be implied under subs.8(5), the legislation or regulations can be used to elaborate further on the circumstances in which consent can be implied, outside the negative option context.
• Exceptions to consent for collection, use and disclosure of personal data in both the health and non-health contexts should be much more limited than in this draft. Particularly where Ontario is proposing broader exceptions than those in the federal PIPEDA, explanation is required as to why such new or broader exceptions are necessary and appropriate. In each case, the most privacy-protective safeguard appropriate (e.g., notice or negative option consent) should be included.

• Regulation-making powers should be far more limited than in this draft. For example, it should not be possible for the government to fundamentally alter the legislation’s scope of application by regulation. Governments should not be able to fundamentally change the application of legislation, or the substantive rights and obligations in it, through a process that does not involve full public scrutiny. Regulation-making powers should be limited to technical matters of implementation. PIAC cannot support legislation which leaves the door open to such substantial narrowing of scope through regulations.

PIAC Comments to Privacy Commissioner of Canada on Cloud Computing

PIAC today submitted comments to the Office of the Privacy Commissioner on the privacy implications of cloud computing. This is the second topic in a series of issues that pose a serious challenge to the privacy of consumers. The cloud computing consultation event is scheduled to take place on June 21, 2010 in Calgary.
A link to the Privacy Commissioner’s 2010 Consumer Privacy Consultations is here
An electronic copy of PIAC’s comments to the Office of the Privacy Commissioner is available here:
 

PIAC Comments on Cloud Computing
Download File: piac_comments_cloudcomputingconsultation_final.pdf [size: 0.05 mb]

PIAC Comments to Privacy Commissioner of Canada on Behavioural Targeting

On March 15, 2010, PIAC submitted comments to the Office of the Privacy Commissioner on issues that pose a serious challenge to the privacy of consumers. First topic: consumer tracking, profiling and targeting of consumers by businesses. PIAC will be attending the two consultation events discussing consumer tracking, which take place on April 29, 2010 in Toronto and May 19, 2010 in Montreal.
This consultation is the first in a series. The Office of the Privacy Commissioner is hosting consultations on issues that pose a serious challenge to the privacy of consumers. The next privacy consultation discusses the trend of cloud computing and the consultation event is scheduled for June 21, 2010 in Calgary.
An electronic copy of PIAC’s comments to the Office of the Privacy Commissioner is available here:

PIAC files Privacy Complaint Against Nexopia

(OTTAWA)— The Public Interest Advocacy Centre (PIAC), a consumer advocacy group based in Ottawa, yesterday asked the Privacy Commissioner of Canada to investigate alleged violations of Canadian privacy law by Nexopia.com Inc., creator of the Edmonton-based popular youth and teen social networking site, Nexopia.
PIAC’s 35 page complaint identified six Nexopia privacy practices that it says violate the Personal Information Protection and Electronic Documents Act (PIPEDA). In particular, PIAC alleges that Nexopia fails to obtain proper consent to disclose its young users’ profiles and personal information to the general public via the Internet.
“Social networking is massively popular with children and teens,” said John Lawford, counsel for PIAC. “Kids can use social networking positively to socialize with their friends and express themselves in different ways in different communities. But young users often post personal details about themselves online without realizing that these details are available beyond Nexopia to the public Internet.”
Lawford notes that Nexopia also provides a very advanced search function to search for members. “Nexopia’s member search engine can be used by everyone with an Internet connection and is a worrisome tool: it permits a very fine-grained search of Nexopia members. Using this search engine, for example, you could search for females between the ages of 13 and 16 in a particular city or attending a specific school with certain interests. This tool does not respect youth privacy.”
“Nexopia’s default settings are set to share information with the whole world. We believe that many Nexopia users, especially young people, don’t appreciate the extent to which their personal information is being shared beyond their circle of friends,” said Janet Lo, co-counsel for PIAC on the complaint. “Even where a Nexopia user has restricted their privacy settings to the most privacy-protective settings, the user’s username, age, sex and location will remain publicly visible to all members and non-member visitors to Nexopia’s site. We believe this goes beyond the purpose of social networking and violates Canadian privacy law.”
Nexopia has more than 1.4 million registered users, with more joining every day. Nexopia is being used by approximately 70% of teenagers and young adults in western Canada.
“Nexopia is a social networking site with a target market of teenagers aged 13 and older,” says Lawford. “The Privacy Commissioner has identified youth privacy issues as a priority for her office in 2010. PIAC would like to see the Privacy Commissioner investigate Nexopia’s privacy practices for compliance with Canadian privacy law, with special consideration to how Nexopia handles the privacy and personal information of minors.”
Under PIPEDA, the Privacy Commissioner has up to a year to investigate and deliver her findings on the complaint.
PIAC is a non-profit organization that provides legal and research services on behalf of consumer interests, and, in particular, vulnerable consumer interests, concerning the provision of important public services.
A redacted version of PIAC’s complaint to the Privacy Commissioner is available for download.
UPDATE: 12 February 2010
PIAC files supplementary letter regarding Nexopia’s reduction to minimum age requirement from 14 to 13 and requirement to post actual photograph of user to access the site. Copy of the letter is available here. [pdf file: 0.01mb]
For more information, please contact:
John Lawford
Counsel
Public Interest Advocacy Centre
ONE Nicholas Street, Suite 1204
Ottawa, ON K1N 7B7
(613) 562-4002×25 (Tel)
(613) 562- 0007 (Fax)
lawford@piac.ca
Janet Lo
Counsel
Public Interest Advocacy Centre
ONE Nicholas Street, Suite 1204
Ottawa, ON K1N 7B7
(613) 562-4002×24 (Tel)
(613) 562-0007 (Fax)
jlo@piac.ca

Tracking Consumers Online – Behavioural Targeted Advertising and a “Do Not Track List” in Canada

(OTTAWA)— The Public Interest Advocacy Centre (PIAC) today released a report entitled “A ‘Do Not Track List’ for Canada?”, that examines online behavioural targeted advertising and online behavioural tracking. This practice consists of tracking consumers’ online activities to target advertising to individual consumers based on their online history, preferences and attributes. In recent years, online consumer tracking and online behavioural targeted advertising have become industry standard for marketers and website operators and consumers are at the mercy of online advertisers. These advertising practices are conducted covertly and offer consumers few options to control how their personal information is collected, used, disclosed and retained.
The report calls for Canadian regulators to study the issue of online behavioural advertising, as American and European regulators have already done and issue clear guidelines for online behavioural targeted advertising practices. “Consumers want the ability to control their personal information online – not only when and how it is collected, but how it is used and shared with other parties,” said Janet Lo, Legal Counsel for PIAC. “Canadian regulators must set down clear guidelines for online behavioural targeting and online consumer tracking practices. Only clear, enforceable rules can make a significant impact to protect consumers from unwanted online surveillance and behavioural targeted advertisements.”
A survey undertaken by PIAC from April 1 to 8, 2009 among 1,570 adult Canadians with Internet and analyzed in the report revealed that Canadian consumers are uncomfortable with online tracking for the purpose of targeted and behavioural advertising and that Canadians support the creation of a “Do Not Track List” for the internet. However, a “Do Not Track List” likely would face strong opposition and lobbying by the advertising industry.
The report also calls for special attention to the issue of behavioural advertising targeting children and youth.
“Full report – A Do Not Track List for Canada? [pdf file: 0.62mb]
Executive summary [pdf file: 0.01mb]
Sommaire [pdf file: 0.03mb]
PIAC received funding from Industry Canada’s Contributions Program for Non-Profit Consumer and Voluntary Organizations. The views expressed in the report are not necessarily those of Industry Canada or the Government of Canada.
For more information, please contact:
Janet Lo
Legal Counsel
Public Interest Advocacy Centre
ONE Nicholas Street, Suite 1204
Ottawa, ON K1N 7B7
(613) 562-4002×24
(613) 562- 0007 (Fax)
 

Children’s Privacy Threatened by Play Websites and Social Networking

Attention: News and Business Editors
November 4, 2008
Children’s Privacy Threatened by Play Websites and Social Networking
(OTTAWA)— The Public Interest Advocacy Centre (PIAC) today released a report, “All in the Data Family: Children’s Privacy Online”, calling for amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA) that would prohibit collection, use, and disclosure of the personal information of children under 13 in Canada.
PIAC counsel John Lawford noted that many apparently kid-friendly websites and social networking sites routinely use personal information of even young children for behavioural marketing and market research: “There quite simply are no special rules for use of kids’ personal information in Canada. Right now, Internet play websites like Neopets, Webkinz and social networking sites like Facebook use kids’ personal information for profit but are not making it clear that this is their business model.” The report concludes that such personal information collection, use and disclosure for children under 13 violates privacy in all cases and should be explicitly made illegal under Canada’s privacy laws.
The report also calls for prohibition of disclosure of personal information of children aged 13 to 15 to any other entity, including marketers. The report goes on to recommend that disclosure of personal information collected by websites only be allowed for information collected from children aged 16-18, and then only with the opt-in consent of the teenager and the explicit consent of the teen’s parent or guardian.
The report also recommends that personal information collected from children no longer be retained by websites once the child reaches age 18, unless the newly adult child explicitly consents to the website carrying this information forward. “This recommendation is a `get out of marketing jail free card’ for when kids become adults – so that any profile the website or other marketers have created about them won’t typecast them in adulthood,” said Lawford. “Kids will have control when they start their adult life without the marketing baggage they collected just to play online or socialize with friends.”
The report also calls for increased enforcement of these new children’s privacy rules via fines and other new powers for the Office of the Privacy Commissioner of Canada as well as specific rules governing the social networking sites, such as requiring these sites to opt children into the highest possible privacy settings on the website by default and to restrict access to children’s profiles from the general internet and by adults from within the social networking site.
PIAC’s report is based upon research with focus groups of children in Toronto aged 11-17 who use the Internet for play and for social networking.
Full text of the report:

All in the Data Family: Children’s Privacy Online
Download File: children_final_small_fixed.pdf [size: 0.81 mb]

For more information, please contact:
John Lawford
Counsel
Public Interest Advocacy Centre
ONE Nicholas Street, Suite 1204
Ottawa, ON K1N 7B7
(613) 562-4002×25 (Tel)
(613) 562- 0007 (Fax)