New Digital Privacy Law Will Punish Companies That Misuse Our Personal Data; But Does It Go Far Enough?

With the holiday shopping season upon us, an ever-increasing number of older Canadians will be shopping online, chatting with grandkids over Zoom or posting Christmas greetings on social media, all the while unwittingly exposing their personal information to tech giants, stores and financial institutions.

If there’s one silver lining to this pandemic,  it’s that it has pushed older Canadians into the digital age. It has allowed many to overcome the isolation caused by social distancing and quarantine restrictions by forcing them to go online to keep up with family members by video, book virtual appointments with doctors, pay bills or shop for groceries.

An Environics poll released in July 2020 captures the rise of digital adoption among the older set. Surveying 2,000 Canadians over 50,  it shows that 65 per cent now own a smartphone (compared to 58 per cent in 2019); and 88 per cent use the internet daily, with 40 per cent making video calls and 37 per cent keeping in touch regularly on social media.

 

The Hidden Cost of Digital Engagement

 

But while it’s certainly encouraging to see that more of us are boldly entering this connected world and becoming good digital citizens, this online participation comes with a hefty price – we pay for it with our personal information.

While making a video call, posting a picture or buying a present is inarguably cheap, easy and super-efficient, there’s a hidden cost for every digital engagement. Each time we use social media, email or e-commerce, we’re sharing highly important personal and financial information with the website we’re using.

And unless we want to parse through the lengthy legal jargon found in the user agreements (which isn’t a bad idea), most of us have no idea how safely these groups will store our data, what they’re doing with it and with whom they’re sharing it.

This uncertainty is causing a great deal of concern for those who are new to the digital world, says David Cravit, chief marketing officer at C.A.R.P. “The big worry about the demographic push to go online is that our personal information will fall into the wrong hands and that more will fall victim to the many scams and frauds that have surfaced since the COVID-19 pandemic,” says Cravit.

 

Bad Actors

 

Companies collect this data to build a digital profile of users, which they then sell to companies for marketing and analytical use. Many consumers are uncomfortable by this behind-the-screen data collection, an anxiety stoked by articles such as Kashmir Hill’s New York Times exposé, where she discovered that one marketing firm had built up a massive history of her online habits – including Airbnb bookings, food orders – and had stored her data for years.

“Right now, many Canadians worry that the dangers online outweigh the benefits – especially when it comes to privacy,” suggests Byron Holland, president and CEO of the Canadian Internet Registration Authority, which manages website domains while fighting against online fraud and privacy violations.

“COVID-19 has shown us that going ‘off the grid’ is no longer an option,” he says. “Digital forces are knocking on the front doors of our homes through new smart, internet-enabled technologies and digital surveillance tools.”

These invasive tech tools have brought about the age of what’s often called Surveillance Capitalism, creating a landscape where digital companies are able to collect and sell the reams of data from our online biographical information, including our name, age, email address, purchase history, social media likes and comments that we put online everyday.

Companies “harvest” this data to build an online portrait of users, which they sell to marketing firms or campaign strategists. It’s why if we mention in an email that we’d like to take a vacation to Europe, within hours we’ll be inundated with travel-related emails and banner ads. And though this targeted advertising always feels a bit eerie to the user, it’s a massive source of revenue for tech behemoths like Google, Amazon, Facebook and Apple.

The fine line between what’s an acceptable use of personal data and what’s not was famously crossed in 2018 when a whistle-blower from Cambridge Analytica, an online polling firm, admitted that his company had spent millions of dollars “harvesting tens of millions of Facebook profiles,” which they then sold to election campaigns, including Donald Trump’s successful 2016 bid.

And in December of the same year, we learned the worst-case scenario of what could happen to our private data when LifeLabs, a medical testing company, fell victim to a huge data breach, which exposed private health information – health card numbers, dates of birth, log-ins and passwords – of up to 15 million Canadians.

 

New Privacy Legislation

 

To protect against future invasions of privacy of these kinds, the federal government recently announced its new Digital Charter Implementation Act, pending legislation that would protect the personal information we share online and punish companies that misuse it.

“The COVID-19 pandemic has accelerated the digital transformation, which is changing how Canadians work, access information, access services and connect with their loved ones,” said Navdeep Bains, minister of innovation, science and industry, who is sponsoring the legislation known as Bill C-11. “This transformation is making concerns about privacy and how companies handle Canadians’ data more important than ever.”

The bill is an attempt by the government to modernize the legislative framework that protects how companies gather, store and use our personal information. If the law is passed, companies will still be able to collect data, but they’ll have to strip away all personal information, such as your name, age, email address and personal attributes.

It aims to give online citizens more power over their personal information, to demand that their data be “destroyed” upon request as well as empowering Privacy Commissioner Daniel Therrien with more clout, including the ability to impose drastic fines – up to $25 million – on companies that are loose and free with our information or don’t set up proper safeguards to protect it.

 

Level Playing Field?

 

Bill C-11 will help level the playing field that has for so long been tilted in favour of business and tech giants, says Brian Short, a digital rights campaigner for OpenMedia, a non-profit organization that campaigns to keep the internet open, accessible, affordable and surveillance-free.

“We were really excited to see the new enforcement powers,” says Short of the section of the bill that will allow Canada’s privacy commissioner to impose huge fines (the highest in the G-7) on “bad actors.”

“Privacy laws are only as good as the enforcement mechanisms behind them,” he says. “We’ve been calling for that for a long time.”

However, Short feels that the current bill is still too permissive in what it allows business to do with our personal data. He says that even if companies are obligated to strip away the personal information on all the data they collect, they can still reconnect it later and, in effect, “re-identify” the individual. Even without a name and email address, they’ll still essentially know who the user is. “This is a big concern,” says Short.

Even the Privacy Commissioner Therrien has concerns about the new legislation. He feels amendments should be make to make it a “more readable law that sets out rights and obligations rather than recommendations.” And though he feels that “it is possible to concurrently achieve both commercial objectives and privacy protection,” when the two are in conflict, the rights of Canadians to have their privacy protected should “prevail.”

While the law is being debated in committee, OpenMedia is devising a grassroots campaign to lobby MPs to strengthen it with amendments that will level the playing field for individuals. In its current form, Short feels that  it favours business interests over consumer needs.

But isn’t flawed legislation better than no legislation? Short doesn’t think so.

“If we do the wrong thing now, we’ll be setting ourselves on a path that we can’t return from,” he says. “Privacy reform doesn’t happen often, and if this bill passes in its current form, there may be decades before we see any changes.”

RELATED:

Life Simplified: 15 Tips for Safer Shopping Online

Cyber Security Awareness: Stay Ahead of Online Scams

Fraud Prevention Month: 10 Ways to Stop the Scammers