Teresa Scassa - Blog

Canada’s Privacy Commissioner, Jennifer Stoddart, along a number of her international counterparts and the commissioners of B.C., Quebec and Alberta have issued a joint letter written to the CEO of Google raising concerns about privacy in relation to Google Glass. This product, still at the beta stage, consists of a kind of interactive mobile computer worn as eyeglasses. Among other things, the glasses have the capacity to record audio and video data, and will be able to run all manner of third party applications.

The Commissioners are justifiably concerned about a product that once launched might raise a host of new and troubling privacy issues. In the letter they call on Google to enter into a dialogue with data protection commissioners with a view to ensuring that the design of the product and of its applications respects privacy values.

What is interesting in this letter is the frank admission by the commissioners of their own precarious jurisdiction when it comes to this technology. While there is no doubt that Google Glass poses significant privacy risks, they are not necessarily ones which would fall within the scope of private sector data protection laws in Canada. These laws generally apply to organizations that collect, use and disclose personal information in the course of commercial activity. Certainly, some of the concerns raised in the letter fall within the scope of these laws. For example, the Commissioners demand to know what information Google might itself collect via Glass when it is in use by individuals. They also seek to know what information will be shared with third parties, including the developers of apps for this product. These are clearly questions that fall within the scope of data protection legislation, as Google is clearly an organization that collects, uses and discloses personal information in the course of commercial activity.

However, Glass will also have privacy implications as between the wearers of the technology and those persons who may fall within the field of view of the user. The Commissioners specifically address the use of this product to surreptitiously film or record individuals. This is a serious privacy concern. It is one that is already raised by the recording capacity of smartphones and tablets; the particular concern with Glass is that it will be possible to be even more surreptitious in making such recordings. Yet the privacy issues raised by this type of activity are not ones to which private sector data protection legislation would apply. For example, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) specifically does not apply to “any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose.” The scope of this exception is potentially very broad; the law would not apply, for example, to recordings made by individuals and posted to their Facebook accounts or to YouTube.

The Commissioners, of course, are well aware of this gap in their powers. In their letter they explicitly acknowledge it: “We are aware that these questions relate to issues that fall squarely within our purview as data protection commissioners, as well as to other broader, ethical issues that arise from wearable computing.” Nevertheless, they use the opportunity presented by the privacy issues within their mandates to raise the “broader ethical issues”.

This gap in jurisdiction over privacy is of growing importance. Where once high powered technologies of surveillance were only affordable by professionals, low cost, high powered technology is increasingly moving into the hands of ordinary individuals. In addition, the ability to disseminate audio and video recordings to a global audience – also something that was once only within the powers of established private sector corporations – is now something that can be done by any individual with an internet connection. As the corporate intermediaries become obsolete, so too do data protection laws that are framed exclusively around private sector actors engaged in commercial activity. The appropriate legislative response is not clear; legislated limits on how individuals can interact with and communicate information about themselves and their experiences would raise significant freedom of expression issues.

The data commissioners’ letter to Google is thus most interesting. Acknowledging both the limits of their powers and the enormous gap in the protection of the public in a rapidly changing information technology environment, they have chosen to publicly raise both privacy and ethical issues with Google. Law- and policy-makers should be watching and should be thinking about how this gap should be filled.

The US government is in damage control mode after it was leaked to the press this week that it had established a massive surveillance program under which it obtained comprehensive communications data from telecommunications and technology companies. Privacy advocates have decried this secret and massive data mining exercise.

Canadians should not sit back complacently to watch this unfolding spectacle south of the border. It was only last year that our own government tried to introduce legislation that would have provided for the building of the physical and legal infrastructure for substantially increased Internet surveillance. Although Bill C-30 was ultimately defeated, there are nonetheless other laws already on the books that leave Canadians vulnerable to unwarranted and invisible surveillance. For years privacy advocates in Canada have been warning of legal provisions that allow police and national security agencies to seek personal information from private sector companies, and that allow these companies to hand over this information without a court order and with no accountability.

The first of these provisions is s. 7(3)(c.1) of the Personal Information Protection and Electronic Documents Act, which provides that an organization “may disclose personal information without the knowledge or consent of the individual” where the disclosure is made to a government actor that has made a request for the information, and has indicated that the information may be related to national security issues, may be relevant to an investigation related to the enforcement of any law, or is sought for the purpose of “administering” any federal or provincial law.

The second provision is s. 487.014 of the Criminal Code, which provides that no court order is required for a law enforcement official “to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing.” In other words, as long as no other law prohibits such a disclosure, the information may simply be handed over.

Both PIPEDA and the Criminal Code permit private sector companies in Canada to voluntarily disclose the personal information of their customers to police officers or national security officials without the knowledge or consent of the individuals in question, and without an order from a judge. Companies may still refuse to make such disclosures without being ordered to do so by a court, and while some do in some circumstances, plenty of others do not. According to the federal Privacy Commissioner, “We have no way of knowing for certain the number, scale, frequency of, or reasons for, such disclosures although we understand that they are substantial.”(The Case for Reforming the Personal Information Protection and Electronic Documents Act at p. 13). Nothing obliges companies to disclose to the public how many requests for information they receive or with how many they have voluntarily complied. Similarly, nothing obliges public authorities to disclose how many requests they make, to what companies, or for what types of information.

Given the vast amounts of personal information of increasingly fine detail that private sector companies collect about all of us, this should be a matter of some concern. Telecommunications companies can match our personal information to IP addresses, which in turn can be linked to all of our online activities. Telecommunications companies also have rich stores of data regarding our calling activities; in the case of smart phones, this information may also include fine-grained location information. Other companies gather our location information, as well as information about our purchases, transactions, conversations, friends, associates and activities. These vast stores of information in the private sector may be simply a request away from disclosure to authorities – and we may never know just how much information is being shared or in what circumstances.

In response to this highly troubling set of circumstances, the federal Privacy Commissioner, Jennifer Stoddart, recently called for reforms to PIPEDA that would impose some level of accountability where public authorities access information in this manner. In a document titled The Case for Reforming the Personal Information Protection and Electronic Documents Act the Commissioner recommended that the law be amended to require private sector organizations “to publicly report on the number of disclosures they make to law enforcement under paragraph 7(3)(c.1), without knowledge or consent, and without judicial warrant, in order to shed light on the frequency and use of this extraordinary exception.”

This call for greater transparency in determining just how often the personal information of Canadians is disclosed to government authorities without the knowledge or consent of the individual and without judicial authorization is well-timed. As disturbing as the news of the US surveillance program is, we should not lose sight of the fact that there are vast personal information resources that sit within easy reach of our own government and its officials – and that there are laws currently on the books that facilitate easy and virtually traceless access to it.

In case there was any doubt, the Office of the Privacy Commissioner of Canada (OPC) produced a report this week that confirms that Canada’s private sector data protection legislation is simply not up to the task of adequately protecting the personal information of Canadians. The report is aptly titled: The Case for Reforming the Personal Information Protection and Electronic Documents Act.

The introduction to this report makes plain the frustration of those charged with administering the Personal Information Protection and Electronic Documents Act (PIPEDA). Enacted with much fanfare in 2001, this statute contains a provision that requires that it be reviewed every 5 years to ensure that it remains adequate for the task of protecting the personal information of Canadians in commercial contexts. As the introduction to the Report notes, the first 5 year review ended with a Bill to amend the statute – this Bill died on the order paper and in spite of attempts to resuscitate it, it has never been passed. The second 5 year review has simply stalled. In the meantime, as the report notes, the personal data landscape has been dramatically transformed with the rise of social networking, mobile communications, increased cross-border data collection and sharing, and the growing use of personal information for the profiling and targeting of consumers

PIPEDA is a fairly tentative piece of legislation, giving only ombudsperson powers to the Privacy Commissioner, and favouring an approach that encourages compliance rather than mandating it. This new report issued by the Office of the Privacy Commissioner (OPC) makes it clear that this approach is no longer effective nor is it appropriate to the current data protection context. The Report notes that comparable jurisdictions have moved towards giving data commissioners more powers of enforcement, including order-making powers and the ability to impose fines or other administrative penalties on companies that play fast and loose with personal information. PIPEDA even lags behind the laws of those few provinces that have their own private sector data protection statutes: Commissioners in Quebec, B.C. and Alberta have order making powers, and Alberta also has mandatory data breach notification requirements. The report observes that not only is the toothless PIPEDA a difficult tool to use to gain compliance from large web-based collectors of personal information that are based outside of Canada, it also relies too heavily upon the willingness of domestic companies to take the Commissioner’s findings or audit reports seriously.

The OPC report identifies four pressure points based on their 12 years of experience with the legislation, and makes four recommendations for legislative reform to address each of these. The first pressure point is enforcement. The report explains how the lack of enforcement powers has hindered the ability of the OPC to address data protection issues. It notes, for example, that there is “nothing in the law that provides enough incentive for organizations to invest in privacy in significant ways.” (at p. 6). It notes as well that even when complaints lead to investigation and recommendations, companies may renege on agreements to change practices because there is nothing to compel them to do so. The report laments that other jurisdictions have taken steps to enhance their enforcement powers while nothing is done in Canada. As a result, the report recommends that stronger enforcement powers be added to the legislation. It identifies as possibilities: adding statutory damages powers to enhance the damages available to complainants who ultimately take their issues to Federal Court; giving the Commissioner order-making powers; and giving the Commissioner the power to impose administrative monetary penalties. Ideally, all three should be added. I note in particular that while statutory damages will improve the individual recourse under the Act, this on its own will not greatly improve compliance under the legislation (see my earlier blog post on individual recourse in privacy cases).

The second pressure point identified in the report is the lack of mandatory reporting for data breaches. The Report notes that as things currently stand, organizations who voluntarily report a data breach face negative publicity, while those who cover up breaches are insulated from reproach. A mandatory data breach reporting provision (which is what the report recommends) would ensure that Canadians are made aware of data breaches, would give Canadians a much clearer picture of the state of personal data security, and would create strong incentives for organizations to improve their privacy practices.

The third pressure point identified is an interesting and important one. PIPEDA contains a provision which allows organizations to voluntarily share personal information with police or other authorities without the consent of the individuals to whom the information relates. Given the increasingly high volumes of personal data in the hands of private sector actors, and the fine grain of detail of much of this information (for example, it may include detailed location information about the movement of individuals over extended periods of time), this should be a matter of great concern. At present there is little or no transparency about the number of requests made by law enforcement for this type of information, nor is there any transparency about the number of times private sector organizations voluntarily share information without insisting upon a warrant. The report’s third recommendation is to require organizations “to publicly report on the number of disclosures they make to law enforcement. . . without knowledge or consent, and without judicial warrant, in order to shed light on the frequency and use of this extraordinary exception.” (at p. 14)

The final pressure point identified in the report is that of demonstrating accountability. Although accountability of organizations for compliance with data protection laws is one of the privacy principles set out in PIPEDA, the report notes that the record of accountability of private sector actors is not all it should be. Not only does the OPC expend significant resources on investigations and audits, they are forced to invest additional resources in follow ups to ensure that there has been compliance with their recommendations. The report recommends that the accountability principle in PIPEDA be amended to require organizations to demonstrate, on the request of the OPC, that they are actually compliant with the law. Further, the report recommends that the law provide for “enforceable agreements” – in other words, undertakings by organizations to comply with the legislation that can be enforced by the OPC if compliance is not actually forthcoming.

Commissioner Jennifer Stoddart is approaching the end of the second term of her appointment. Her leadership of the OPC has been exemplary; she has taken it from a beleaguered and unstable agency to one that has proven its expertise and effectiveness. It has worked with great effectiveness with federal departments and agencies, it has developed effective strategies for public outreach and education, and it has worked tireless to improve data protection in the private sector. The Commissioner has also maintained a high level of communication and collaboration with other data commissioners in Canada and abroad. In short, she has done as much – perhaps more – than one could expect to address the privacy of Canadians in both the public and private sectors under two neglected and outdated privacy statutes. This report is notable for the frank and direct way it publicly addresses the deficiencies in Canada’s private sector data protection legislation. Since the mandated legislative review process set out in PIPEDA has proven utterly ineffective in doing so, the Commissioner has taken the initiative, addressing Canadians directly to explain in plain and direct terms what the problems are and how they might be fixed. Let us hope that the government is listening.

Privacy is big news these days, particularly when it comes to online activity. Internet users are increasingly being tracked by websites they visit, by advertisers on those sites, and by their mobile apps. Profiling practices are ubiquitous. Information and activities on social networking sites are mined by “big data” for purposes that are hardly transparent to users. It is in this context that the Standing Committee on Access to Information, Privacy and Ethics has just released its report on Privacy and Social Media in the Age of Big Data.

The report outlines many of the challenges and issues facing individuals and regulators in the social media context. There are significant issues around how consumer consent is obtained to the collection, use and disclosure of their personal information, the unlimited nature of information collected, the uses to which harvested information is put, and the length of time information is retained. Some testimony before the Committee specifically addressed the added challenges raised by the collection of the personal information of children. Issues of accountability, transparency and security are also considered in the report, and the Committee heard testimony regarding the practices of specific social media companies, and the measures being adopted by the Federal Trade Commission in the US.

Given the broad scope of the inquiry and the importance of the issues, the Committee’s recommendations are a letdown. The first three recommendations consist largely of statements urging the Privacy Commissioner of Canada to develop new guidelines to address privacy challenges with social media. The recommendations which follow encourage both government and social media companies to support education, to promote safe online activities and to support digital literacy. While guidelines and education clearly have a role to play, the recommendations do not go far enough, and in particular, they ignore the sorry state of Canada's private sector data protection law.

During the course of its inquiry, the committee heard plenty of evidence about the lack of movement on long overdue legislative reform to the Personal Information Protection and Electronic Documents Act (PIPEDA), and about how the proposed amendments to this law in Bill C-12, which has languished for some time now, may already be out of date. The Committee also heard evidence about the need for enhanced powers of enforcement for the federal Privacy Commissioner who managed to do her job admirably well with largely only the power to cajole and encourage compliance. That the recommendations of the Committee are entirely silent on the need to amend PIPEDA to add data breach notification requirements, the power to levy fines, order-making powers or other enforcement measures is simply stunning.

One can be grateful, at least, for the recommendations contained in the Supplemental Report of the New Democratic Party of Canada. The NDP members of the Committee clearly took away a different message from these hearings than did the other members. The NDP makes a number of recommendations for legislative amendments that would enhance the enforcement power of the Privacy Commissioner. These include recommendations for legislative change to require companies to notify the Privacy Commissioner in cases of serious breaches of data security, to enhance the enforcement powers of the Commissioner, and to implement “do not track” functions. Indeed, earlier this year, the NDP’s Charmaine Borg (who sits on the Standing Committee) introduced a private members bill (Bill C-475) that would amend PIPEDA so as to implement some of these recommendations around data breach notification and enforcement powers.

The soft approach to privacy protection has not proven adequate to deal with the pervasive, intensive and ubiquitous data collection practices which have become the norm in our digitized society. The almost daily accounts of data breaches and their negative impacts on individuals are evidence of the failure of gentle encouragement to achieve regulatory compliance with even the most basic privacy norms. It is past time to update and upgrade Canada’s data protection legislation. It is most disappointing to see a Standing Committee report that can study these issues and conclude only that gentle encouragement is still the path to follow.

Recently, the decision of the Ontario Court of Appeal in Jones v. Tsige was celebrated by privacy advocates for recognizing a new privacy tort in Ontario. The plaintiff/appellant Jones received an award of $10,000 in damages for harm suffered as a result of the defendant’s unauthorized access to her bank records over a period of time.

An even more recent dispute between Jones and her lawyer has highlighted a chronic problem with privacy law in Canada: the lack of meaningful recourse. Last week, a judge ordered Jones to pay her lawyer the balance of the legal fees she incurred in her ground-breaking lawsuit. These fees were in excess of $125,000 – more than 12 times Jones’ damage award. The judge made it clear that the lawyer had provided first rate representation for his client. The lesson here is that legal services are expensive, and frankly, the majority of Canadians cannot afford to go to court.

The new tort that resulted from Jones v. Tsige is similar to statutory torts in provinces such as British Columbia, Manitoba, Saskatchewan and Newfoundland and Labrador. They are fairly narrowly framed; these torts require a wilful violation of privacy. They are meant to apply in cases of stalking, voyeurism, and other deliberate privacy intrusions. The high cost of litigation combined with the fact that courts give relatively small damage awards for the difficult-to-quantify harms that flow from privacy invasion mean that these torts are of little practical use to most Canadians.

Arguably, the most pervasive threats to personal privacy come from routine over- collection of personal information, and poor information handling practices. The tort of invasion of privacy does not apply in such cases. Instead, private sector data protection legislation is meant to provide recourse to individuals when their personal information is inappropriately collected, used or disclosed by private sector organizations. Yet the Personal Information Protection and Electronic Documents Act (PIPEDA) has its own substantial defects. This law applies to activities in the federally regulated private sector, and to the private sector more broadly in those provinces without their own legislation (all provinces and territories except B.C., Alberta, and Quebec fall under PIPEDA),. Individuals may make complaints under PIPEDA; the outcome of any such complaint is a report by the Office of the Privacy Commissioner (OPC). This report may contain recommendations as to how an organization should correct deficiencies in its practices, but these recommendations are not binding. Once a report has been issued, an individual may choose to take the matter to Federal Court to get an order requiring the organization to change its practices. The individual may also seek compensation for any harm they have suffered. Once again, it costs money to go to court, and those few individuals who have exercised this option have had little success. Nammo v. Transunion of Canada Inc. has become the benchmark for awards of damages in such cases; Mr. Nammo was awarded a whopping $5000 after a credit reporting agency failed to collect accurate information about him, and shared the incorrect (and negative) credit information with a bank. It is no surprise that the majority (if not all) of those who have pursued their PIPEDA claims before the Federal Court have represented themselves. The cost of legal representation would far outstrip any likely award of damages.

The OPC does excellent work within the limits of its mandate, and it has no doubt had some success in improving how (receptive) businesses handle personal information. There is, however, little in the legislation to seriously motivate compliance. PIPEDA is a relatively toothless statute: the Privacy Commissioner has no order-making power, there is no mandatory breach disclosure provision, and there is little in the way of economic consequences for those who flout privacy principles. Yet PIPEDA has passed its first five-year review without much-needed legislative amendment (the Conservative government’s Bill C-12 died on the order paper and has yet to be revived), and it is now well overdue for its second five-year review. It is into this context that Charmaine Borg of the NDP has introduced a private member’s Bill C-475, which would impose a mandatory data breach disclosure requirement on organizations, would provide the Privacy Commissioner with order-making powers, and would create the potential for significant financial penalties for those who refuse to comply with orders.

Measures of this kind could provide a real incentive for organizations to take data protection more seriously. And let’s face it, for the vast majority of Canadians, it is not the right to go to court to sue for invasion of privacy or to seek damages for violations of PIPEDA that will make any kind of difference. These rights are rendered meaningless by both the cost of litigation and by the resultant lack of deterrent effect on bad behaviour. The best protection for individuals is a regime that gives organizations clear reasons to improve their practices and systems.

Recently I have blogged about the controversial interactive map created by the New York Journal News which showed the names and addresses of gun permit holders in two New York counties. I then followed this up with another posting about how the data on the map was substantially inaccurate. Both the map and its aftermath raise interesting issues about public data, open government and privacy rights.

This week, a New York court has given us more to think about on the issue of public government information and privacy. The New York Times sought access to an electronic copy of a database of the names and addresses of all residents of New York City who hold handgun licences. In Matter of New York Times Co. v. City of New York Police Dept., the appellate division of the New York State Supreme Court denied disclosure of the database notwithstanding that the information it contains is a matter of public record. The court stated: “The fact that Penal Law §400.00(5) makes the name and address of a handgun license holder “a public record” is not dispositive of whether respondent can assert the privacy and safety exemptions to FOIL [Freedom of Information Law] disclosure.” The court went further, noting that this was so “especially when petitioners seek the names and addresses in electronic form.” It also indicated that other case law supported the view that the disclosure of a person’s home address “implicates a heightened privacy concern.”

This decision is an interesting one in that it tackles head on the thorny problem of what to do with public record information that includes the personal information (names and addresses) of individuals. When made available in electronic form, this information can be used to create all manner of information maps (among other things) that might generate far greater privacy concerns than the original government record. The infamous gun permit map is an example of this. Consider also the Proposition 8 map – a map that plotted the names, addresses and donation amounts of all contributors to a campaign to ban gay marriage in California.

Open government and open data principles favour the disclosure of government information in digital “re-usable” formats to serve a variety of public purposes which include promoting transparency and accountability. While access to information legislation generally permits a government department or agency to refuse disclosure of third party personal information in response to an access request, this limitation does not apply to information that is already part of a public record. In Canada, the Personal Information Protection and Electronic Documents Act (which governs the private sector use of personal information) creates exemptions to rules around the collection, use and disclosure of “publicly available information”. According to the regulations, this category of information expressly includes “personal information that appears in a registry collected under a statutory authority and to which a right of public access is authorized by law”. While it is true that the exemption is limited to instances “where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the registry”, given that the information appears in the registry for purposes of transparency and accountability, republishing the information would likely fit within those purposes. In any event, newspapers are largely exempt from the application of this law where personal information is collected, used or disclosed for journalistic purposes. The result is a significant gap in Canadian privacy law when it comes to public registry data.

The Office of the Privacy Commissioner of Canada is already aware of the problems that open government and open courts principles may raise when it comes to the electronic dissemination of “public record” information. For example, the Commissioner has issued guidelines to administrative tribunals to assist them in their decision-making around the online publication of decisions that might contain detailed personal information. Clearly the OPC is of the view that open online access can change the privacy equation.

Balancing the interests of open government and privacy is a significant challenge – and not an easy one. I doubt we have heard the last on this issue.

In a recent blog post I wrote about the issues raised by the mapping of public information. The issue that prompted this blog post was the creation, by the Journal News of New York State, of a map featuring the names and addresses of all gun permit holders in two counties. The map prompted outrage although it merely represented data made available to the newspaper on an access to information request.

A recent development in the story highlights another issue both with open data and with the mapping of public information. The Journal News reports that a substantial amount of the posted information was inaccurate. Apparently this was attributable to the fact that one of the two counties at issue did not require permit renewals, and thus contained a significant amount of outdated information. In fact, the data for this county was only about 25% accurate. The other county required renewals every five years, which made the data more current, though not entirely up-to-date.

The open data movement promises significant social and economic benefits. Making government data freely available in appropriate formats for reuse is meant to increase government transparency and accountability, and to provide individuals and the private sector with raw data for research or innovation. Many already use such information to create useful apps, or to develop information maps that place government data in an interactive and accessible geographic context.

One of the challenges, however, is ensuring that the data sets provided by government are accurate, complete and fit for the purpose to which they are put. Not only must governments ensure that they are providing current data and appropriate updates, they must also include the meta data necessary for users to understand the scope and limitations of the data set.

Where the data includes personal information (including home addresses) it would seem that the onus should be even higher on governments to ensure that the information being provided is current, or that the limitations of the data set are clearly identified. Of course, there is also an onus on the party using the information to ensure that they understand the limits of the data set.

Voltage Pictures LLC has brought a motion in Federal Court seeking a court order that would compel Internet Service Provider Teksavvy Solutions Inc. to disclose the identities of customers using certain IP addresses that have been linked to Internet file-sharing of works in which Voltage owns the copyright. If the court were to order the disclosure, the identified individuals could be sued for copyright infringement by Voltage.

The University of Ottawa’s Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC) has brought a motion to intervene in the proceedings. CIPPIC has an established track record in representing the public interest in cases of this kind; they have argued for a balance between individuals’ privacy interests in their online activities and copyright holders interests in previous litigation. The Federal Court has adjourned its hearing of Voltage’s motion in order to consider the issue of CIPPIC’s intervention.

A New York newspaper created a furore by publishing, in the wake of the tragic school shooting in Newtown, Connecticut, an interactive online map that displayed the names and addresses of residents holding permits for guns. The newspaper obtained the data through an access to information request. The map was accompanied by an article with the title: “The gun owner next door: What you don't know about the weapons in your neighborhood." The map and article provoked outrage. Gun owners were concerned about their privacy, and one news agency ran an interview with a retired burglar who suggested that the map would make burglars’ work much easier. A blogger responded to the map by creating another map which featured the names and addresses of the staff of the newspaper. The newspaper has reportedly had to hire armed guards to protect its main office.

This is, of course, not the first time that controversial information maps have been created by news agencies or by others. In California, for example, information about election donors is a matter of public record. Someone used this information to publish a map detailing the names, addresses and contribution amounts of individuals who had donated to a campaign to amend the State’s constitution to prohibit gay marriage.

Widely available Web 2.0 tools and resources have made it easy for almost anyone to create online maps. The ability to present information in a geographical context is an attractive option. Information maps are visually appealing, and can reveal patterns and permit connections that might not be evident from data presented in the form of lists or plain text. For example, Patrick Cain, a Canadian journalist, has been creating innovative and fascinating information maps for many years. Perhaps one of his most useful maps is his annual map of busted grow-ops in Toronto. There are real risks associated with purchasing a house which was once used for a grow op, and there is no obligation on sellers to disclose this information. The grow-op maps provide important and easily accessible information for those searching for a new home.

While there is no doubt that information maps can be useful and important, there are also potential risks. There is a great deal of publicly available information collected by different levels of government. For example, many registers of public documents, and decisions of administrative tribunals are already accessible to the public. The Privacy Commissioner of Canada has expressed concerns about the consequences of placing this sort of information online; in the past, public access was available only to those who took the trouble to show up at specific sites to view the entries in the register. This implicitly limited access to this information. While some of this public information might be very usefully presented to the public in map form (see, for example, the maps of crime reports in Ottawa) other information may have serious privacy or security consequences if disclosed online and in map form.

Privacy and data protection laws in Canada do not offer a great deal of protection in this regard. While governments are bound by privacy legislation that protects against the disclosure of personal information in the context of access to information requests, a great deal of other government information is part of public registers. Individuals who disclose information on maps for personal, non-commercial purposes may be exempt from the application of national or provincial private sector data protection laws, and these laws also create exceptions for information that is collected, used or disclosed for “artistic, literary or journalistic purposes”. (I recently published a law journal article on this issue.)Thus, for example, a news outlet in Canada that did something comparable to the New York-based newspaper described above might well be insulated from recourse under data protection laws because of their “journalistic purposes” in doing so.

There is, of course, a tricky balance to be struck. Personal privacy and individual security are important values, but so are those served by open government (transparency, accountability) and by the freedom of expression. Indeed, the Supreme Court of Canada is expected to rule sometime in the coming year on the constitutionality of the exception for journalistic purposes in Alberta’s private sector data protection legislation. That decision may give us some guidance on the tricky balance between freedom of expression and the protection of privacy. In the meantime governments must continue to examine how best to achieve the goals of openness while at the same time protecting individual privacy and security.

Note: this piece was first published by me at:http://www.bloggingforequality.ca/2013/01/information-maps-freedom-of-expression.html

“Location-Based Services and Privacy”, (T. Scassa & Anca Sattler) (2011) 9:2 Canadian Journal of Law and Technology 99-134

The last decade has seen a rapid growth in the number and variety of location-based services that are available to consumers. While some of the older location-based services are tools such as GPS and other navigation systems, more recent innovations include applications that permit users to call up a variety of different information about their current locations, such as the nearest Italian restaurant, or the best deals at a favourite store. Location-based services (LBS) also allow individuals to share their location with friends in a wide range of social networking contexts. Location-based services are already shifting from pull to push applications. Information can now be pushed automatically to users based on their location. The options for such services are virtually limitless, and include mobile-marketing, public transportation applications, information about local points of interest, health care applications connected to remote treatment systems, or tools to find the closest election-day polling booth.

There is no doubt that many location-based services offer real benefits to users. Yet location-based services raise inevitable user privacy concerns. These concerns operate on multiple levels and involve many players. In some applications, privacy issues will arise between individual users, where, for example, applications permit the tracking of movements of family members, co-workers or “friends”. Location-based services may also result in the collection of a new layer of personal information about consumers by private sector companies. Information about individuals and their movements has meaningful commercial value, and the potential for the collection, use and disclosure of this information is significant. Location-based services also raise the spectre of state surveillance of individual activity – either concurrent with an individual’s movements (tracking), or retrospectively, through searching records of individual patterns of movement. These are just some of the contexts in which privacy issues are raised.

In this paper we describe location-based services, their evolution and their future directions. We then outline privacy issues raised by such services. We consider how current Canadian data protection laws apply to location-based services, and indicate where such laws fall short of addressing the full range of issues raised by location-based services. We also explore some technological methods to address the privacy challenges raised by location-based services. The paper concludes with a series of recommendations.