With Parliament back in session, we are seeing more attention on the proposed “lawful access” legislation. There is good reason for that. Many of us believe the proposed legislation is an affront to privacy, and gives law enforcement overly intrusive rights without court supervision that will in practice be no more than expensive, invasive, privacy offensive security theatre.

In this CBC interview, Ann Cavoukian, the Ontario Privacy Commissioner, does an excellent job of explaining the issue. Well worth investing 7 minutes to watch.

Getting the privacy balance right is not easy, from both theoretical and practical perspectives. As examples, here are some recent developments that go both ways.

Pro Privacy

• Proposed Bill C-12 amendments to PIPEDA that would mandate privacy breach notification in certain circumstances.
• The Ontario Court of Appeal decision in Jones v Tsige that created a tort of breach of privacy, or “intrusion upon seclusion” for intentional, offensive privacy invasions.
• The US Supreme court decision in US v Jones that decided police need to get a warrant before attaching a GPS tracking device to a vehicle.

Anti Privacy

• Proposed Bill C-12 amendments to PIPEDA that encourage private entities to give personal information to law enforcement without warrants.
• Proposed “Lawful Access” legislation that allows police to obtain a significant amount of information about our mobile phone and internet accounts without a warrant, and would require ISP’s to retain certain information about us.
• The Supreme Court of Canada’s refusal to hear the appeal of the Leon’s case where the Alberta Court of Appeal said that license plates are not personal information.

Here are some of the sites that are going dark today, or changing their home pages in protest over the proposed US legislation. For more information on why this legislation is so bad, check out these sites, or search for “SOPA” on Slaw or Techdirt.com, or just Google it.

Wikipedia:

Boing Boing

WordPress

EFF

This is Google’s US site. Google’s Canadian homepage does not seem to be affected.

Michael Geist

As Connie mentioned, the annual Consumer Electronics Show is now underway in Las Vegas. The tech press is full of commentary on the latest and greatest things at the show. One trend is that everything is becoming more intelligent and more connected, ranging from TV’s to appliances.

That results in many great features and new capabilities. At the same time, a Washington Post article entitled Privacy rights activists worry about potential abuse of high-tech devices featured at CES event points out that we can’t forget about the privacy issues that comes along with this technology.

The article starts off by saying:

The thousands of devices debuting Tuesday at the Consumer Electronics Show here demonstrate how tech companies are poised to gather unprecedented insights into consumers’ lives — how much they eat, whether they exercise, when they are home and who they count as friends.

Silicon Valley is in a gold rush for information, highlighted by Google’s announcement Tuesday that it would incorporate data posted by users on its social networking service into the results of its main search engine.

Many of the companies providing this technology are certainly cognizant of the privacy issues, and will do the right things regarding use, disclosure and consent. But we can’t forget that we don’t all have the same sensibilities or thresholds for privacy issues. Some of us may indeed care about who our washing machine tells that our laundry is done, or who knows what the temperature is in our house.

This is an issue that we can’t just brush aside.

Pending legislation always makes good fodder for lawyers to comment on in annual predictions articles. The pending anti-spam legislation has resulted in several such comments.

In my predictions article scheduled for publication next week, I comment that:

The Federal anti-spam legislation that was expected to be in force in 2011 is still waiting for regulations to be passed before coming into force. The draft regulations received a lot of criticism, and may be revised prior to the Act coming into force. The Act will be a compliance headache for many organizations, unless the regulations effectively narrow the broad definition of Spam. The Act is intended to provide tools to stop what we all understand to be spam. But the Act defines spam to include e-mails that many businesses or charities routinely send that the recipients probably would not consider to be spam.

Michael Geist predicts that in July:

Nearly one year after proposing anti-spam regulations, the government unveils modified regulations and seeks further public comment before the law takes effect. The new regulations establish a series of new exceptions to the law consistent with the demands of several marketing groups.

Barry Sookman has written a detailed analysis entitled Will it be illegal to recommend a dentist under Canada’s new anti-spam law (CASL)? in which he suggests that the legislation may indeed be that overreaching. It is worth a read to get a flavour for how complex this can get, and what the unintended consequences may be.

This legislation and its pending regulations merit a close watch this year. While its intentions are good, I believe it has the potential to waste far more time, money and effort for businesses and charities attempting to comply, than it will save by the amount of real spam it might reduce. And I’m not sure whether appropriate regulations can temper it sufficiently.

Another wrinkle is that the Supreme Court of Canada’s December decision that said the proposed Canadian Securities Act was not within the legislative authority of Parliament has some wondering if the same fate might be in store for parts of the anti-spam legislation.

Ann Cavoukian – the Ontario Privacy Commissioner – has written an excellent op-ed in the Financial Post entitled Beware of ‘Surveillance by Design’.

It starts off with:

I feel the need to raise a growing concern regarding the lack of understanding of a key privacy issue – the ease of data linkages in an ever-increasing online world.

In this day and age of 24/7 online expanded connectivity and immediate access to digitized information, new analytic tools and algorithms now make it possible, not only to link a number with a name, but also to combine information from multiple sources, ultimately creating an accurate profile of a personally identifiable individual.

The Commissioner weighs in on the controversial Alberta Leon’s case that decided license plates are not personal information – which differs from other provinces.

She also expresses her concerns about the pending federal “lawful access” laws, saying that:

In my view, this represents a looming system of “surveillance by design,” that should concern us all in a free and democratic society.

Several amendments are proposed to PIPEDA, (Bill C-12) the federal private sector privacy legislation. It is sitting now at first reading stage, and we are not yet sure how long it will be before it is passed.

This post summarizes an IT.Can teleconference on the subject presented today by David Fraser of McInnes Cooper and Lisa Lifshitz of Gowling Lafleur Henderson LLP.

The definition of personal information has been changed slightly. It is now simply defined as: “information about an identifiable individual”. Along with that comes a new definition of “business contact information”, which expands the “business card” exception that does not now include e-mail address. It also adds a requirement that the reason for the use or disclosure of business contact information be “in relation to their employment, business or profession”.

A new section 6.1 clarifies “valid consent” in terms of the need for the individual to understand what they are consenting to – including the nature, purpose and consequences. This may lead to some practical challenges in how to communicate that effectively – particularly “consequences”.

It will add mandatory breach notifications in certain situations, the provisions for which are very detailed.

Material breaches of “security safeguards” must be reported to the Privacy Commissioner.

Notifications must be made to individuals involved if the breach could lead to a “real risk of significant harm to the individual”.

There is also a 3^rd possible notification to a third party organization if that organization could reduce the risk of harm. It is unclear who that might be.

It adds a business transactions exemption, which is long overdue. Most practitioners have proceeded as if these amendments were already there.

It includes a broad definition of “business transaction” (business sale, merger, financing…), and allows personal information to be transferred without consent, provided that certain safeguards are complied with. These rules do not apply if the primary purpose of the transaction is the disposition of the personal information. If that is the case (such as the sale of a customer list), then the basic PIPEDA requirements come into play.

PIPEDA has the concept that information can be given to “investigative bodies” as approved by regulation. That concept will be removed, and replaced with a more flexible arrangement that allows disclosure to another organization if “necessary” to investigate a breach of an agreement or law, or to prevent, detect or suppress fraud.

To call a smart-phone a phone is really a misnomer. We need to think of them as computers with internet connections that we carry around in our pockets.

Why is this an important distinction? From a legal perspective, that changes the perspective tremendously. Consider Connie Crosby’s Slaw post “Digital Wallets on Their Way” , and the comment on the post musing about privacy and the warrant-less search of cellphones that is being debated in various jurisdictions.

The privacy aspects of a phone that just makes phone calls without retaining any information, and the consideration of whether law enforcement needs a warrant to look at it – are much different than for the devices we have now. Legislators and courts need to consider that looking at a person’s phone may be the equivalent of walking into their house and looking at their bank statements, credit card bills, reading material, photo albums, and mail, and while they are there, nosing around on their computer to see all the files, email and whatever else is there including the sites they visit.

Considerering just the phone aspect for the moment, they track and save data on not only what calls you made, to who, and for how long – but also where you were when you made the call.

Other information that might reside on our cell phones include personal and confidential information such as banking information, health information, where we have been and when, and records of communications on various platforms that are meant to be private. Also consider that for many it is not only personal use, but also business use that will contain personal and confidential information of others.

And while you can make phone calls on smartphones, consider the other devices that they replace, and other things that they do:

Digital wallet, GPS, map, tracking device, camera, video camera, email client, social media client, phone directory, calendar, note pad, to do list, grocery list, book reader, magazine reader, newspaper reader, web browser, clock, alarm clock, file storage, dictation device, music player, video player, video game player, radio, video-phone, TV, dictionary, encyclopedia, research assistant, comparison shopper, calculator, wi-fi hot spot, bar code scanner, ephemeris, music composer, video / music editor, cookbook, translator, metronome, flashlight, level, … and the list goes on.

The trend to more invasive surveillance and control by North American governments (indeed, by many countries that we consider civilized democracies), or their granting of too much control to others is disturbing. Too many things are making creeping (and sometimes creepy) inroads into privacy rights, along with the usual specious “if you’ve got nothing to hide… ” argument. Too many things are tending towards shoot first, ask questions later. And governments are too eager to look to ISP’s and others who run the internet pipes to control what flows through.

Some examples:

The proposed US SOPA (Stop Online Piracy Act) that is being loudly opposed. It has been characterised as net censorship, an attempt to regulate the internet, and breaking the internet as we know it. It could result in entire web sites being taken down based merely on an allegation that one post or comment infringes copyright.

The proposed Canadian Lawful Access legislation that would allow much more invasive internet information to be given to authorities without warrants. This resulted in a lengthy letter by the Privacy Commissioner to the Ministers responsible.

The increasing use of license plate cameras by police, such as in the Washington DC area. In its simplest, most privacy friendly form, car mounted or fixed cameras read car license plates and flag any that are contained in a database of stolen or suspect vehicles. No record is kept of any plates other than those of interest. But it has come to light that some of the systems store the details of every single plate that they capture, and retain that for long periods of time.

I am attending the Dig2011 conference today. Several hundred people will be at the London Convention Centre today and tomorrow to hear about topics in 2 different streams – the digital game industry, and the web industry. (Harrison Pensa is a sponsor.)

The second day includes a mini-MBA for budding game development companies, and a high school stream with panels on the path and options leading to a successful game development career.

There are good employment opportunities in this sector. Companies in the game and software development business are having difficulty finding qualified employees. But just because one likes to play video games, or can create a spreadsheet doesn’t mean you can create a game or software.

The conference also features an exhibitor area, and a place to play the latest Canadian made games. And don’t think that “Canadian made games” connotes few or inferior products. Canada actually has a significant concentration of game developers, which create some of the most popular games.