Columns

Proposed Data Breach Disclosure Rules Leave Too Many Canadians in the Dark

News last week of a stunning data breach at a Toronto-area hospital involving information on thousands of mothers places the proposed Digital Privacy Act squarely in the spotlight. Bill S-4, which was introduced two months ago by Industry Minister James Moore, features long overdue data breach disclosure rules.

My weekly technology law column (Toronto Star version, homepage version) notes the new rules would require organizations to notify individuals when their personal information is lost or stolen through a data or security breach. Most other leading economies established similar rules years ago, recognizing that they create much-needed incentives for organizations to better protect our information and allow individuals to take action to avoid harms such as identity theft when their information has been placed at risk.

While the mandatory data breach rules can be an effective legislative privacy tool, they only work if organizations actually disclose breaches in a timely manner. Bill S-4 establishes tough penalties for failure to notify affected individuals, but unfortunately undermines its effectiveness by setting a high notification standard such that Canadians will still be kept in the dark about many breaches, security vulnerabilities, or systemic security problems.

June 9, 2014 — Comments are Disabled — Columns

Surveillance: America's Pastime by Jared Rodriguez / t r u t h o u t; Adapted: naixn, Jason Smith / feastoffun.com) (CC BY-NC-SA 2.0)

Why Has the Canadian Government Given Up on Protecting Our Privacy?

In recent years, it has become fashionable to argue that Canadians no longer care about their privacy. Supporters of this position note that millions of people voluntarily post personal information and photos about themselves on social media sites, are knowingly tracked by Internet advertising giants, and do not opt-out of “targeted” advertising from telecom companies. Yet if the past few months are any indication, it is not Canadians that have given up on privacy. It is the Canadian government.

My weekly technology law column (Toronto Star version, homepage version) notes the public response to the tidal wave of stories regarding widespread surveillance, the 1.2 million government requests to telecom companies for customer information, and the growing number of security breaches suggest that many Canadians are deeply concerned about the protection of their privacy. However, many feel helpless in the face on recent revelations and wonder whether the government is prepared to tighten privacy rules and establish stronger oversight.

June 3, 2014 — 10 comments — Columns

CBC Vancouver - Wanderin'-The-Corridors by kris krüg (CC-BY-SA 2.0), https://flic.kr/p/2jXse

What if the CBC Really Put Everything Up for Review?

The future of broadcasting has emerged as a hot issue with Canada’s broadcast regulator effectively putting everything up for grabs as part of its comprehensive TalkTV review of broadcasting regulation. Acknowledging the dramatic shift in the way Canadians access and interact with broadcasting, reforms to seemingly untouchable policies such as simultaneous substitution, genre protection, and over-the-air broadcasting are all on the table.

The Canadian Radio-television and Telecommunications Commission has effectively acknowledged that the world has changed and policies based on a different landscape merit a review. In the current market, scarcity has given way to abundance and broadcasters have ceded considerable control to consumers’ demands to watch what they want, when they want.

My weekly technology law column (Toronto Star version, homepage version) notes that Canada’s public broadcaster, the Canadian Broadcasting Corporation, is undergoing a similar review. If recent comments from its president Hubert Lacroix are any indication, however, there is no willingness to radically rethink its future. In a speech earlier this month to the Canadian Club of Montreal, Lacroix devoted much of his time to lamenting the budgetary challenges faced by CBC with unfavourable comparisons to support for public broadcasting in other countries.

May 27, 2014 — 15 comments — Columns

Google Main Search by MoneyBlogNewz (CC BY 2.0) https://flic.kr/p/92t8FA

European ‘Right to be Forgotten’ Ruling Fails to Strike Free Speech – Privacy Balance

The European Court of Justice shook up the privacy and Internet world last week by ruling that European data protection law includes a right to be forgotten with respect to search engine results that are “inadequate, irrelevant or no longer relevant.” As a result of the decision, search companies such as Google will be required to remove results from its index that meet this standard upon request.

My weekly technology law column (Toronto Star version, homepage version) notes that as people flock to remove content from the Google search index – reports indicate that the company began receiving removal requests within hours of the ruling – there remains considerable uncertainty about how to implement the decision, whether it will migrate to Canada, and if a new right to be forgotten will serve the cause of privacy protection or harm free speech and access to information.

May 20, 2014 — 8 comments — Columns

Five Measures to Help Counter the Tidal Wave of Secret Telecom Disclosures

The House of Commons engaged in an extensive debate on privacy yesterday in response to an NDP motion that would require the government to disclose the number of warrantless disclosures made by telecom companies. I’ll have more on the debate shortly (it’s worth reading), but the government has made it clear that it will not be supporting the motion.

My weekly technology law column (Toronto Star version, homepage version) notes that the revelations of massive telecom and Internet provider disclosures of subscriber information generated a political firestorm with pointed questions to Prime Minister Stephen Harper in the House of Commons about how the government and law enforcement agencies could file more than a million requests for Canadian subscriber information in a single year.

The shocking numbers come directly from the telecom industry after years of keeping their disclosure practices shielded from public view. They reveal that Canadian telecom and Internet providers are asked to disclose basic subscriber information every 27 seconds. In 2011, that added up to 1,193,630 requests, the majority of which were not accompanied by a warrant or court order. The data indicates that telecom and Internet providers gave the government what it wanted – three providers alone disclosed information from 785,000 customer accounts.

The issue is likely to continue to attract attention, particularly since the government is seeking to expand the warrantless disclosure framework in Bill C-13 (the lawful access bill) and Bill S-4 (the Digital Privacy Act).

May 6, 2014 — 8 comments — Columns