Canadian Privacy Law Research Articles

The Canadian VirusSeq Data Portal and Duotang: open resources for SARS-CoV-2 viral sequences and genomic epidemiology.

The COVID-19 pandemic led to a large global effort to sequence SARS-CoV-2 genomes from patient samples to track viral evolution and inform the public health response. Millions of SARS-CoV-2 genome sequences have been deposited in global public repositories. The Canadian COVID-19 Genomics Network (CanCOGeN - VirusSeq), a consortium tasked with coordinating expanded sequencing of SARS-CoV-2 genomes across Canada early in the pandemic, created the Canadian VirusSeq Data Portal, with associated data pipelines and procedures, to support these efforts. The goal of VirusSeq was to allow open access to Canadian SARS-CoV-2 genomic sequences and enhanced, standardized contextual data that were unavailable in other repositories and that meet FAIR standards (Findable, Accessible, Interoperable and Reusable). In addition, the portal data submission pipeline contains data quality checking procedures and appropriate acknowledgement of data generators that encourages collaboration. From inception to execution, the portal was developed with a conscientious focus on strong data governance principles and practices. Extensive efforts ensured a commitment to Canadian privacy laws, data security standards, and organizational processes. This portal has been coupled with other resources, such as Viral AI, and was further leveraged by the Coronavirus Variants Rapid Response Network (CoVaRR-Net) to produce a suite of continually updated analytical tools and notebooks. Here we highlight this portal (https://virusseq-dataportal.ca/), including its contextual data not available elsewhere, and the Duotang (https://covarr-net.github.io/duotang/duotang.html), a web platform that presents key genomic epidemiology and modelling analyses on circulating and emerging SARS-CoV-2 variants in Canada. Duotang presents dynamic changes in variant composition of SARS-CoV-2 in Canada and by province, estimates variant growth, and displays complementary interactive visualizations, with a text overview of the current situation. The VirusSeq Data Portal and Duotang resources, alongside additional analyses and resources computed from the portal (COVID-MVP, CoVizu), are all open source and freely available. Together, they provide an updated picture of SARS-CoV-2 evolution to spur scientific discussions, inform public discourse, and support communication with and within public health authorities. They also serve as a framework for other jurisdictions interested in open, collaborative sequence data sharing and analyses.

Creating standards for Canadian health data protection during health emergency – An analysis of privacy regulations and laws

Health emergencies require unprecedented measures to protect the public from the health disaster. Such measures may require limiting the exercise of personal freedom and other rights like the right to data privacy. The limitation, however, should be temporary and proportionate so that privacy rights are not compromised superfluously. In this aspect, the European Union (EU) implemented better data protection measures and guided the government and various entities on the acceptable ways of handling data during a pandemic, though the measures taken were not very comprehensive. Canadian privacy laws in general are sector driven and not harmonised at the national level and there is no new guidance on the usage of data during emergencies. Hence, this research will analyse laws and regulation in EU and Canada with a view to understanding the necessity of amending privacy laws in Canada to make it relevant, up-to-date and in compliance with EU data protection requirements so data sharing from EU countries could be made easy. It further encapsulates appropriate standards for Canada health data protection for better management of health data privacy.

Home Ice Advantage: Securing Data Sovereignty for Canadians on Social Media

More than three in four Canadians use social media platforms to connect with others here at and around the world, often sharing life’s most intimate moments through public posts and private messages. In doing so, Canadians entrust these companies to secure and protect their personal data, which can include a wide range of sensitive information, such as their political opinions, or details on their sex life, personal finances and health. These companies are also entrusted to secure the sensitive data that they track and store, such as users’ location, search histories and biometric information such as facial features. But that trust is waning. Our surveys of Canadians indicate that social media platforms are the least trusted organizations in Canada to keep personal data secure and to act in the best interests of the public. As legal battles swirl between Europe, the U.S. and China over how to protect Facebook and TikTok data travelling across borders, there remain inadequate protections over how Canadians’ personal data are transferred and stored. This threatens Canadian sovereignty, and the digital security and privacy of millions of Canadians. Personal data can be accessed by national security and law enforcement agencies without sufficient legal protection under Canadian law in countries around the world. Technology companies can experience buy-outs, mergers and bankruptcy that can change where personal data are stored and the privacy protection they receive. Malicious hackers can also take advantage of data stored in locations where the data are subject to weak data protection safeguards. Social media platforms store the personal data of their Canadian users around the world, and provide little to no transparency as to where their data are stored or transferred to third parties. Canadian privacy law does not require users to consent to personal data transfer outside of Canada. Our research shows that many popular platforms transfer data to a variety of jurisdictions, and none specifically cite Canada as a country of storage. Nor are there meaningfully enforced limits on the transfer of personal data to jurisdictions with insufficient protection against surveillance or unauthorized access. In the two decades since the enactment of Canada’s current privacy law, there has not been a single fine or enforced remedy against companies transferring personal data outside of Canada with insufficient protection. Jurisdictions around the world are introducing a range of new approaches to address these challenges and ensure data protection laws extend to data moved outside its borders, including outright bans on cross-border transfer, new requirements for informed consent, and rigorous evaluations of other jurisdictions’ data protection regimes. While these notions can challenge the idea of a free and open Internet, Canadians are looking for answers — our recent survey finds that 86% of Canadians support requirements to keep Canadians’ data within Canada. This discussion paper lays out public policy options for how Canadian privacy law should protect the security and privacy of personal data stored outside of Canada. Advancing these protections for Canadians should complement ongoing efforts to advance international cooperation and governance of digital privacy and security, for example through bi- and multilateral agreements. The global fight over data is likely only to intensify in the coming years, and a key test for Canada’s sovereignty will be how it is positioned among its international peers. Canada must define its position internationally, with the U.S., China, and the European Union all showing very different models of governance. This paper is meant to advance public engagement and policy development in Canada going forward to maintain our home ice advantage.

Searching for Data Privacy Self-Management: Individual Data Control and Canada’s Digital Strategy

The problematic presumption that users can control the vast consent and data-management responsibilities associated with big data is referred to as the fallacy of data privacy self-management. Though untenable, this presumption remains fundamental to Canadian privacy law, exemplified in the individual access principle of the Personal Information Protection and Electronic Documents Act governing commercial data management. This article describes the fallacy, critiques the individual access principle, and introduces potential solutions relevant to Canada’s digital strategy.

Keeping Internet Users in the Know or in the Dark? The Data Privacy Transparency of Canadian Internet Carriers: A Third Report

This is the third report assessing the extent to which carriers providing internet communications in Canada are forthcoming about their handling of personal information. Demand for data privacy transparency calls our trusted internet carriers to account, for details about the collection, management, retention, routing, disclosure and use of our data. To what extent do carriers collect and keep personal information? Is data routed and stored in the U.S.? When a company, security agency or political party requests access to data, do carriers oblige? When it comes to these and many other privacy concerns, do our internet carriers keep us in the know? Or in the dark? Consistent with the previous reports, 44 major, minor and transit carriers that route Canadian internet traffic are assigned full, half or zero ‘stars’ based on ten criteria: 1) A public commitment to PIPEDA compliance. 2) A public commitment to inform users of all third party data requests. 3) Transparency about frequency of third party data requests and disclosures. 4) Transparency about conditions for third party data disclosures. 5) An explicitly inclusive definition of ‘personal information’. 6) The normal retention periods for personal information. 7) Transparency about where personal information is stored and/or processed. 8) Transparency about where personal information is routed. 9) Domestic Canadian routing where possible. 10) Open advocacy for user privacy rights. Stars were assigned after careful review of the privacy materials present in the privacy section of each carrier’s corporate website as of January 2018. Materials not linked to a privacy section were not evaluated, as it is assumed that privacy pages are the first, and perhaps only location users interested in privacy will access. Key Findings - While major concerns persist, there are clear signs that some carriers are moving toward greater transparency, providing more information about how they treat personal data. The 2014 leader, TekSavvy, added an aggregate of 2 stars to achieve a score of 8/10, keeping it well ahead of all other major Canadian carriers. Shaw was the major carrier that showed the most improvement, more than doubling its score to 4.5. Cogeco and Videotron are others in this category whose scores rose considerably. Among the minor carriers, Acanac and its corporate owner Distributel stand out in both their scores and improvement from 2014. - Bell remains the only major carrier to score below the 2.6/10 average with a score of 2.5 stars. While most major carriers in Canada are producing transparency reports, Bell Canada continues its refusal to release any details about law enforcement or third party requests or disclosures. - Minimum detail for minimum score: While many carriers earned half-stars in a variety of categories, this should not be interpreted as a widespread overhaul of data privacy transparency practice. Many carriers scored half stars for the addition of a sentence or two or a brief example. - Carriers continue to refuse to provide retention details. Despite growing calls for users to understand better how long carriers are keeping data, none of the major carriers, and few of the others, provide retention details, often noting that data will be kept as long as possible. - Many carriers continue to lack explicit definitions of personal information. Despite some improvements in terms of the scores for this criterion, growing public concern about metadata, mobile data, surveillance data from in-store visits and set-top box data, is not reflected in the definitions provided by most carriers. - No transit provider indicates explicit compliance with Canadian privacy law. Since the first of these reports completed in 2013, not a single transit provider has made reference to Canadian privacy law in its privacy materials. This is concerning because these behind the scenes internet carriers handle large quantities of intra-Canadian traffic. - Overall, carriers continue to fail in their role as public trustees and as advocates for user privacy. As government officials and privacy advocates call for new ideas and new mechanisms for protecting privacy, reputation and security, last-mile carriers, who deal with users face-to-face and/or online every month, must do far more. Transit providers too, must help ensure users understand the processes and implications of going online. The consent challenges that persist epitomize current lackluster efforts. We cannot expect that content and platform providers will be the only entities helping to educate and engage users. Internet carriers must do far more to fulfill public interest mandates associated with longstanding expectations associated with the benefits of spectrum allocation, and certainly, the legal responsibilities determined by current privacy law.

Information Management at a Health Services Research Organization in Toronto, Ontario, Canada: Moving from Identifiable Data to Coded Data

ABSTRACTObjectivesA health services research organization in Toronto, Ontario, Canada conducts population-based research to improve the health of Canadians in seven main areas: (1) cancer, (2) cardiovascular disease, (3) chronic disease and pharmacology, (4) health system planning and evaluation, (5) kidney, dialysis and transplantation, (6) mental health and addictions, and (7) primary care and population health. The Information Management (IM) team within the Data Quality and Information Management (DQIM) department at our non-profit organization is an integral component for upholding privacy and confidentiality policies and procedures while facilitating quality research using different types of data such as health administrative, third-party, primary data collection, and electronic medical records (EMR).
 MethodsThe IM team is responsible for receiving data, encoding direct personal identifiers, screening for unnecessary identifiers, performing probabilistic data linkage when necessary, importing the data to the Research Analytics Environment (a client/server Linux-based system), and destroying the data according to the terms stipulated in the executed data sharing agreement. The purpose of the presentation is to detail the above steps of processing data to protect individuals’ identities yet preserve the usefulness of carrying out research. The presentation will include aspects from importing data into SAS to storage and encoding of personal identifiers to probabilistic data linkage, which involves maximizing linkage with other datasets at the organization. Linking data at the organization involves the encryption or encoding of health card numbers to “Key Numbers.”
 ResultsThe processing practices used at the organization comply with Canadian privacy laws such as the Personal Health Information Protection Act (PHIPA) as well as organizational policies and Research Ethics Board approvals. The approaches used to conceal individual identities yet allow linkage to various data sources can be modelled by other health agencies, ministries, and non-health related organizations that work with sensitive data but face challenges in maintaining both privacy and research quality. Our organization strives to make processing as efficient as possible and create maximum linkability to the various data sources in house while upholding privacy and confidentiality.

Keeping Internet Users in the Know or in the Dark: An Analysis of the Data Privacy Transparency of Canadian Internet Service Providers

In the wake of the Snowden revelations about NSA surveillance, recent calls for greater data privacy recommend that internet service providers (ISPs) be more forthcoming about their handling of our personal information. Responding to this concern as well as in keeping with the transparency, openness and accountability principles fundamental to Canadian privacy law, this report evaluates the data privacy transparency of twenty of the most prominent ISPs (aka carriers) currently serving the Canadian public. We award ISPs up to ten ‘stars’ based on the public availability of the following information: 1. A public commitment to PIPEDA compliance. 2. A public commitment to inform users about all third party data requests. 3. Transparency about frequency of third party data requests and disclosures. 4. Transparency about conditions for third party data disclosures. 5. An explicitly inclusive definition of ‘personal information’. 6. The normal retention period for personal information. 7. Transparency about where personal information is stored. 8. Transparency about where personal information is routed. 9. Publicly visible steps to avoid U.S. routing of Canadian data. 10. Open advocacy for user privacy rights (such as in court and/or legislatively).Stars are awarded based on careful examination of each ISP’s corporate website. We selected the 20 ISPs in our sample based on their prevalence among the approximately 6000 internet traceroutes in the IXmaps.ca database (out of 25,000 in total) that correspond to intra-Canadian routes – i.e. with origin and destination in Canada.ISPs earn very few stars – 1.5/10 on average. The highest scoring carrier overall is TekSavvy, earning 3.5 stars in aggregate based on full or half stars across five criteria. The large foreign carriers Cogent and AboveNet (Zayo) receive no stars. Slightly more than half of the ISPs (11 of 20), all operating primarily in Canada, state a commitment to adhere to the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs the handling of personal information in commercial transactions. None of the foreign-based ISPs that carry significant amounts of intra-Canadian traffic indicate any explicit compliance with Canadian privacy law. At the time of writing, no Canadian ISP had yet published a transparency report along the lines of AT&T, Verizon, Google, Facebook or Twitter, each of which have begun to report standardized statistics concerning law enforcement access requests.Without proactive public reporting on the part of ISPs in the key areas identified above, it is very difficult for Canadians to protect their personal privacy online nor hold these important organizations to account. To remedy this situation, we provide a number of policy recommendations specific to the various groups involved.

Privacy Protection and Genetic Research: Where Does the Public Interest Lie?

There is significant public interest in the outcomes of genetic research. However, there is also a great deal of concern that genetic research and associated realms will foster the use and disclosure of personal health and genetic information in ways that undermine protected privacy interests. This article proposes that a balance must be struck between legitimate public interests implicated in the collection, use, and disclosure of genetic information for research purposes. The article also explores the tension between the public interest in genetic research and the protection of individual privacy in relation to different policy regimes and reviews existing statutory rules, case law, and administrative decisions on the public interest exception in Canadian privacy law.

Internet Surveillance and Boomerang Routing: A Call for Canadian Network Sovereignty

Preliminary analysis of more than 25,000 traceroutes reveals a phenomenon we call ‘boomerang routing’ whereby internet transmissions originating and terminating in Canada are routinely routed through the United States. Canadian originated transmissions that travel to a destination in Canada via a U.S. switching centre or carrier are subject to U.S. law - including the USA Patriot Act and FISAA. As a result, these transmissions expose Canadians to potential U.S. surveillance activities – a violation of Canadian network sovereignty.In the face of this unregulated surveillance of Canadians, the Federal government and internet service providers should re-assert our national network sovereignty and better protect Canadian civil liberties. In what follows, we present boomerang route findings and discuss U.S. National Security Agency (NSA) tracking concerns. We then offer a plan for strengthening Canadian network sovereignty, including: 1) strengthening and enforcement of Canadian privacy law (e.g. PIPEDA), and 2) repatriation of Canadian internet traffic by building more internet exchange points.

Real and Substantial Connections: Enforcing Canadian Privacy Laws Against American Social Networking Companies

Any organization that captures personal data in Canada for processing is deemed to have a “real and substantial connection” to Canada and fall within the jurisdiction of the Personal Information Protection and Electronic Documents Act (PIPEDA) and of the Office of the Privacy Commissioner of Canada. What has been the experience of enforcing Canadian privacy protection law on US-based social networking services? We analyze some of the high-profile enforcement actions by the Privacy Commissioner. We also test compliance through an analysis of the privacy policies of the top 23 SNSs operating in Canada with the use of access to personal information requests. Most of these companies have failed to implement some of the most elementary requirements of data protection law. We conclude that an institutionalization of non-compliance is widespread, explained by the countervailing conceptions of jurisdiction inherent in corporate policy and technical system design.

Forgetting, Non-Forgetting and Quasi-Forgetting in Social Networking: Canadian Policy and Corporate Practice

In this paper we analyze some of the practical realities around deleting personal data on social networks with respect to the Canadian regime of privacy protection. We first discuss the extent to which Canadian privacy law imposes access, deletion, and retention requirements on data brokers. After this discussion we turn to corporate organizational practices. Our analyses of social networking sites’ privacy policies reveal how poorly companies recognize the right to be have one’s personal information deleted in their existing privacy commitments and practices. Next, we turn to Law Enforcement Authorities (LEAs) and how their practices challenge the deletion requirements because of LEAs’ own capture, processing, and retention of social networking information. We conclude by identifying lessons from the Canadian experience and raising them against the intense transatlantic struggle over the scope of deletion of data stored in cloud-based computing infrastructures.

Can hyperlinks and digital rights management secure affordable access to information?

Digital Rights Management Systems (DRMs) related control mechanism, which are analogous to and augment the exclusive rights, have been the subject of debate since the early 1980s. DRMs, which function like an electronic security guard that ‘never leaves its post, never takes a break and never sleeps,11Cameron, Alex, Digital Rights Management: Where Copyright and Privacy Collide (2004) 2 Canadian Privacy Law Review 14, p. 17. can invade the privacy of individuals, prevent competition and/or control access to a work that is not or is no longer copyright protected. Hyperlinks are citations of an electronic address, but when clicked they navigate the user to the source of further information, including codes circumventing DRMs. This article accepts that the excesses of DRMs can outreach copyright and/or contract law, but argues that DRMs provide an opportunity for innovative business models, which can both protect digital works and promote free use of hyperlinks. Part 1 outlines the background and legislative provisions related to DRMs. It contrasts the WIPO Copyright Treaty (WCT) 1996,22The WCT, (and the WIPO Performances and Phonograms Treaty – WPPT, containing similar provisions), are available at http://www.wipo.int/treaties/en/ [22/04/2012]. Articles 11 and 12, with corresponding provisions found in the implementing legislation of the US Digital Millennium Copyright Act (DMCA) 1998,33Digital Millennium Copyright Act, 1998 at http://copyright.gov/legislation/hr2281.pdf [18/04/2012]. and the EU Copyright Directive (EUCD) 2001.44[Copyright] Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society, Official Journal L 167, 22/06/2001 P. 0010–0019. It also examines the intellectual property aspects of the Trans-Pacific Partnership (TPP) and Europe's Anti-counterfeiting Trade Agreement (ACTA).55The TPP, also known as the Trans-Pacific Strategic Economic Partnership Agreement, which came into effect on 28 May 2006 and was initially between Singapore, New Zealand, Chile and Brunei is currently negotiated by other countries in the region including Australia, Canada, Japan and United States; negotiations are conducted in secret and the text is not publicly available.ACTA is between the EU and Australia, Canada, Japan, Korea, Mexico, Morocco, New Zealand, Singapore, Switzerland and the US and is available at http://register.consilium.europa.eu/pdf/en/11/st12/st12196.en11.pdf [26/6/2012]. Part 2 debates opposing academic opinion and comments on case law relating to DRMs, including the use of hyperlinks as a way of trafficking circumvention technology and/or facilitating unauthorised access to a copyright work. It assesses the extent to which DRMs might inhibits the development of new products, prevents competition, or invades the privacy of individuals, and points to the opportunities a consumer group-rightholder negotiated model end user licence can offer. Part 3 concludes that DRMs bolsters the clutches of the rightholder, but reduce unauthorised access to information thus minimising revenue loss, which can make hyperlinked ‘consumer’ access to information ‘affordable,’ or even free.

The New Social Media Paradox: A Symbol of Self-Determination or a Boon for Big Brother?

In the past ten years or so, mobile phone and Internet technologies have been instrumental in nearly every instance where people have gathered to demand political reform. With the help of ‘new social media’ applications, like Facebook and Twitter, Internet and mobile phone users can conduct real-time exchanges with millions of people across the globe. Following the Introduction, this Article begins, in Part II, with a discussion of how these tools were used by protesters around the world in 2011. Part III discusses how the same tools were used by governments, both democratic and authoritarian, to respond to the violence and mayhem during that year. In Part IV, I turn to a discussion of the relevant policy concerns, first in the American, then the Canadian, legal contexts. It is significant that Canada is the first country to complete an extensive investigation into Facebook’s privacy practices. As a result, Facebook users across the world now enjoy stronger privacy protections for their personal information, in terms of how it is collected, used and disclosed. In conclusion, in Part V, I note that this case has important implications for other online social networking sites, even those based in other countries, which are collecting and using the personal information of Canadians in a way that does not comport with Canadian privacy laws.

Personal Privacy and Public Health

Despite variation in Canadian privacy laws between provinces and territories, increasing legislative protection of personal privacy has imposed restrictions on health research across the country. The effects of these restrictions on patient recruitment include increased study costs, durations, and decreased participation rates. Low participation rates can jeopardize the validity of research findings and the accuracy of measures of association by introducing non-response, or participation bias. We constructed simulations to assess potential effects of non-response bias on the accuracy of measures of association in a hypothetical case-control study. Small biases that alter the probability of selecting an exposed case can lead to dramatic inflation or attrition of the odds ratio (OR) in case-control studies. ORs are more unstable and subject to error when the true probability of selecting an exposed case is greater, such that strong positive associations are subject to error even at low levels of bias. Well-powered, population-based epidemiological research is a cornerstone of public health. Therefore, when weighing the benefits of protecting personal privacy, the benefits of valid and robust health research must also be considered. Options might include special legislative treatment of health research, or the use of an opt-out (vs. the current opt-in) construct for consent in confidential research.

The State of Information Security Law: A Focus on the Key Legal Trends

Information security is rapidly emerging as one of the most critical legal issues facing companies today. Concerns regarding corporate governance, individual privacy, accountability for financial i...

Canadian privacy law worries US

Canadian privacy law worries US