Canada’s privacy commissioner says ‘urgent need’ for laws to make privacy a human right

Open this photo in gallery:

The federal Privacy Commissioner says there is an “urgent need” to reform Canadian laws to enshrine privacy as a human right, and is calling for greater powers to regulate and reprimand abusive data collectors.

In his annual report to Parliament, released Tuesday, Daniel Therrien wrote that data-driven technologies have become “harmful” to human rights, including privacy, equality and democracy. He recommended that MPs revise Canadian laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Privacy Act, to give his agency or another public body greater ability to levy administrative fines against data abusers.

“The responsibility to protect privacy shouldn’t be mostly on the shoulders of individuals,” Mr. Therrien said in an interview. Instead, he believes laws should recognize that privacy is a right that both underlies and protects other rights, such as dignity and freedom of expression. As technology evolves and becomes more integrated with society, he said, such revised legislation could put the burden of privacy protection on data collectors – so Canadians can use modern tech without fear of surveillance or manipulation.

Canada lags behind jurisdictions such as Europe in modernizing privacy regulation in today’s data-driven economy. The European Union, which considers privacy a human right, spent years working on its consumer-first General Data Protection Regulation before data-misuse and data-breach scandals from companies such as Facebook Inc. and Equifax Inc. brought the consequences of unchecked data collection into public discussion.

The report also recommends putting limitations on public bodies, singling out Statistics Canada for having collected credit histories and proposing to collect transaction information from banks without consumers’ consent. While the commissioner did not find Statscan had violated laws, it “did not demonstrate the necessity of collecting so much highly sensitive information about millions of Canadians."

“A human-rights based approach to privacy protection makes it clear that, although organizations may have an interest in collecting and processing personal data, privacy is a human right that is also central to the exercise of other human rights,” Teresa Scassa, Canada Research Chair in Information Law and Policy at the University of Ottawa, said in an e-mail. European-style rights “are becoming the foundation for new models of data governance that place individuals at the centre, with much greater agency and control.”

Justin Trudeau’s Liberal government unveiled details of a “digital charter” late in their first term to rein in tech giants’ power; it recommended fines and data-collection restrictions for companies that violate privacy laws. But the proposal was thin on details about financial penalties or the types of behaviour that could lead to a fine.

Mr. Therrien told The Globe and Mail that the Liberals’ proposal “does not go far enough.” While it would grant his office powers over privacy-violating entities, it would require seeking legal permission to proceed, including seeking permission from the federal Attorney-General, creating vast delays for Canadians who want their rights upheld.

Speaking to reporters later Tuesday, Innovation Minister Navdeep Bains said that his government’s digital charter “has been very consistent with the issues raised by the Privacy Commissioner,” adding that “we will make sure there’s strong enforcement mechanisms consistent with what the Privacy Commissioner has said.”

The commissioner said current privacy laws effectively allow for self-regulation among industry players, preventing meaningful reform: “It is untenable that organizations like Facebook are allowed to reject my office’s findings as mere opinions,” he told a news conference Tuesday morning. “… The discussion with the company is a bit different if they know if they don’t comply, they may be exposed to a fine.” (Facebook declined to comment.)

In a statement Tuesday, Statscan said that it would “be more transparent about our programs and the ways in which we collect, process and store data,” and would respect Canadians’ privacy as it modernized its data-collection methods.

Conservative industry critic Michelle Rempel said in a statement that the report “underscored the Liberal government’s lack of action to protect the value of data and the privacy of Canadians."