Federal privacy watchdog warns of growing dangers of 'surveillance capitalism'

The federal privacy watchdog is warning Canadians about the growing threat of "surveillance capitalism" — the use of personal information by large corporations.

In his annual report tabled Thursday in Parliament, Privacy Commissioner Daniel Therrien said state surveillance — a major concern after the 9/11 terrorist attacks — has been reined in somewhat in recent years.

Personal data, meanwhile, has emerged as a highly valuable asset and no one has leveraged it better than the tech giants behind web searches and social media accounts, he said.

"Today, the privacy conversation is dominated by the growing power of tech giants like Facebook and Google, which seem to know more about us than we know about ourselves," the report said.

"Terms like surveillance capitalism and the surveillance economy have become part of the dialogue."

Office lacks adequate enforcement power: Therrien

The risks of surveillance capitalism were on full display in the Cambridge Analytica scandal, now the subject of proceedings in Federal Court because his office did not have the power to order Facebook to comply with its recommendations, Therrien said.

The law also did not allow the commissioner to levy financial penalties to dissuade this kind of corporate behaviour.

Therrien, in his last year as privacy commissioner, is encouraging the federal government to make several improvements to planned legislation on private-sector data-handling practices when it is reintroduced in coming weeks.

Today, the privacy conversation is dominated by the growing power of tech giants like Facebook and Google, which seem to know more about us than we know about ourselves.- Federal privacy commissioner Daniel Therrien

At a news conference, the commissioner said he agreed with the intention behind the previous legislation — which died at the federal election call. The bill was intended to give organizations greater flexibility to use personal information, even without consent, if done for legitimate business interests.

"But this should be done within a rights-based framework that recognizes the fundamental right to privacy. Greater flexibility for corporations should come with greater corporate accountability," he said.

What's needed is not more self-regulation but true regulation, meaning objective and knowable standards enforced by the privacy commissioner's office, Therrien said.

"When we look at the experience of other countries that are innovators that are ahead of Canada, places like South Korea and Germany but many others, they do that within laws that protect privacy as a human right."

• Digital privacy law is being updated for the first time in decades, and it's imperative we get it right
• Privacy commissioner orders probe into government data leak that may have put Afghans in danger

Artificial intelligence, the newest frontier of surveillance capitalism, has immense promise for addressing some of today's most pressing issues, but must be implemented in ways that respect privacy, equality and other human rights, Therrien cautioned.

"Our office's investigation of Clearview AI's use of facial recognition technology was an example of where commercial AI deployment fell significantly short of privacy laws," the annual report said.

The commissioner found Clearview AI violated the private-sector privacy law by creating a databank of billions of images scraped from the internet without consent to fuel its commercial facial recognition software.

Digital technologies like AI, which rely on the collection and analysis of personal data, are at the heart of the fourth industrial revolution and are key to socio-economic development, the report said.

"However, they pose major risks to rights and values."

Advocating 'rights-based framework'

To draw value from data, the law should accommodate new, unforeseen but responsible uses of information for the public good, the report added. But the additional flexibility should come within a rights-based framework, given frequent violations of human rights.

Therrien highlighted another trend — the increase in public-private partnerships and the use of corporate expertise to assist state organizations, for instance the RCMP's association with Clearview AI.

• RCMP's use of facial recognition tech violated privacy laws, investigation finds
• As critics warn of genetic 'surveillance', RCMP explores use of DNA matching in criminal probes

Privacy issues arising from public-private partnerships were also evident in a number of government-led pandemic initiatives involving digital technologies in the last year, the report added.

"These issues underscored the need for more consistency across the public and private-sector laws."