The Privacy Commissioner of Canada says Canadians fear they are losing control of their personal information due to technology, and more needs to be done to restore their confidence in technology.
Commissioner Daniel Therrien tabled his Annual Report to Parliament yesterday. He included recommendations for restoring public confidence in technology, like legislative amendments for order-making powers, and the ability to impose administrative monetary penalties.
“The digital revolution has brought us important benefits and will continue to be a major contributor to economic growth,” says Therrien. “Few of us would like to go back to the pre-digital age, but no one has agreed to give away their privacy on the basis of 50-page privacy policies written in legalese most lawyers don’t understand. Canadians have told us privacy policies are broken and they want better information to exercise their right to give or withhold consent meaningfully.”
The report included the results of a consultation on the challenges facing consent. The consultation received more than 50 written submissions from businesses, civil society, academics, lawyers, regulators and individuals, and held five stakeholder roundtables across Canada.
“What we heard is that, while consent remains central to personal autonomy, other mechanisms are also needed,” said Therrien.
“It is clear, for example, that Canadians need to be supported by an independent regulator with the legislation and resources necessary to properly inform citizens, guide industry, hold businesses accountable, and sanction inappropriate conduct. Canadians do not feel protected by a law that has no teeth and businesses held to no more than non-binding recommendations.”
The Commissioner said that the Office would work to make improvements, including:
- Shifting towards a proactive enforcement and compliance model, rather than a complaints-based ombudsman model of privacy protection. The OPC may be better placed than individuals to identify privacy problems related to complex new technologies.
- Updating key guidance on online consent to specify four key elements that must be highlighted in privacy notices and explained in a user-friendly way.
- Developing new guidance that would specify areas where collection, use and disclosure of personal information is prohibited, for example, situations that are known or likely to cause significant harm to the individual.