More transparency needed on digital privacy, says Daniel Therrien

Canada's privacy watchdog is calling on companies to be more transparent on how they harvest and use personal data collected online.

Online privacy "has emerged as a significant concern," says Privacy Commissioner Daniel Therrien in his annual report on compliance with the federal privacy regime.

"It is becoming increasingly apparent that the protection of privacy demands a partnership between individuals and the corporations with which they interact," he notes.

"Like any successful partnership, this must be based on trust and therefore openness. Now that personal data has become such a precious coin of commerce, the rules governing its collection, use and disclosure must be crystal
clear, well understood, and actively accepted."

Given that trend, he thinks Canadian businesses "must develop dynamic, creative ways of sharing privacy-related information to allow individuals to make informed decisions."

The report, which was tabled in the House of Commons on Wednesday, reveals that the commissioner accepted 426 formal complaints under the act in 2013 — which, it notes, is "almost double the number accepted the previous year" — although it does point out that "much of the increase was a result of 168 complaints related to a new Bell Canada marketing initiative announced in October."

Those complaints have been grouped together as a single, Commissioner-initiated complaint that is expected to be completed this year, according to the report.

Google, Apple privacy complaints spark investigations

The report also summarizes the commissioner's findings in several other cases investigated this year, including the "free app frustration" brought on by an Apple Canada initiative that asked for credit card information and birth dates to create an ID to download even free applications on the Apple website.

Although the company did allow users to download the content without providing the information, the commissioner concluded that the workaround "was not evident."

He recommended that Apple "make it clear to users" that they could circumvent the request for credit card information, which they agreed to do.

He also looked into a complaint related to Google's use of cookies, which led one individual to be "bombarded with ads" for sleep apnea medical devices after searching for the information.

"The man asserted that he had not consented to the collection and use of his sensitive health information for this purpose," the report notes.

After investigating the complaint, the commissioner concluded that "the use of sensitive personal information in this manner did not correspond to the wording stated in Google’s own privacy policy."

It also revealed what the report describes as "shortcomings" in how Google monitors advertisers, which led the commissioner to make several recommendations "aimed at stopping privacy-intrusive ads."

Therrien also highlights the sharing of information between the private and public sector.

"More and more, it has been observed that personal information originally collected by the private sector can also flow into the hands of public sector agencies dedicated to law enforcement and national security," he points out.  

"The need for a constructive debate around greater transparency and accountability on all sides is evident."

NDP supports call for increased transparency

New Democrat privacy critic Charmaine Borg told CBC News that she was particularly struck by the call for more transparency on the sharing of personal information between private corporations and the public sector.

"That's something that we've seen a lot of debate about in the House of Commons, and the NDP has been calling for this for a while," she noted.

"It's almost ironic that the government failed to bring in that transparency — or any transparency mechanisms on the sharing of personal information from telcos, for example, when they're not shy about using these provisions, and making 1.2 million requests for that information."

She also concurred with the commissioner on the need for easily accessible, user-friendly privacy policies on websites.

"It's so hard for people to understand what they're signing on to when they're clicking yes or OK in these boxes," she said.

"That was at the heart of my bill — C-475 — that I proposed, but was unfortunately voted down by the Conservatives." 

The proposed Digital Privacy Act, which is currently before the Senate, does address some of those concerns, but is really just a "half measure," she said.  

"I'm hoping they will finally open their eyes to the need to protect the privacy of Canadians, but it's very difficult for them to say that they care about it when we know they're snooping behind our backs."

A spokesman for Industry Minister James Moore pointed out that the government's proposed amendments to the law are scheduled to go before a House committee this fall.

"During that time, we'll hear from expert witnesses, such as the privacy commissioner, on how we can best protect Canadians in this age, and we're looking forward to that debate occurring," Jake Enwright told CBC News.

"Obviously, we think it's a good thing any time a Canadian company is open and transparent," he noted.

"If he has recommendations on how we can better protect Canadians online or serve Canadians in that capacity, we'll hear him out."

Report dedicated to former commissioner Jennifer Stoddart

Like most of her caucus colleagues, Borg initially opposed Therrien's appointment, and went so far as to vote against it in the House.

But she told CBC News that those concerns were more about the process than Therrien himself.

"A lot of our reservations weren't specifically about the person, but […] having someone who had been responsible for writing the very legislation that he would be criticizing," she said.  

"So far, when he came to committee to testify on C-13" — the so-called 'cyberbullying' bill — "and when he has spoken about [the Digital Privacy Act],  he does seem to be very critical of certain aspects of it, which was good to see."

She hopes that Therrien "keeps that same critical eye on future legislation," she said. 

"He has big shoes to fill, obviously — Ms. Stoddart, who did a lot of great work — but this is one step in that direction."

Indeed, Therrien also paid tribute to his predecessor, Jennifer Stoddart, who retired in December after "ten remarkable years of leadership" on the privacy file.

 "Many of the private-sector privacy protections that Canadians have come to cherish over the past decade are a testament to her bold vision, and her unflinching determination to carry it out," he observed.  

 "As a result, this Office is more than proud to dedicate this report to her."

He also thanked former interim commissioner Chantal Bernier for stepping in between Stoddart's departure and his appointment.