COVID-19 has forced a digital transformation, with offices sitting empty, the entire non-essential workforce (that can do so) working remotely, and students furthering their education at kitchen tables around the country. Data is also being used by governments to conduct “contact” tracing, though this means different things in different countries. Some states are looking for only aggregated, anonymized data from telecommunications companies, in order to better understand the spread of the disease—though this does raise issues with respect to the potential for de-anonymization. Others, including Israel, Singapore, Taiwan, and South Korea are taking a more aggressive approach—using personal data to track an individual’s location, contacts, and monitor quarantine orders.
This is fundamentally different from anything we have experienced before, and a different use of the digital world. It has revealed four interrelated facets of technologically driven society: how connected we are, how powerful digital tech really is, how pervasive the role of private companies has become, and how potent government surveillance can be.
This should force Canadians to do something called a Gap Analysis, comparing actual performance with potential performance. Put differently, what is the current state of the digital society in Canada, and what is the desired future state—and what is the delta between those two points?
Given how deeply personal each person’s experience with COVID-19 is, starting from a privacy perspective is a suitable entry point to a much larger conversation. In Canada there are two parallel privacy regimes, a public one relating to government action, and a private one relating to activities of private companies.
For government, there are robust limits that set the bounds related to individuals and their private information. While the Canadian Charter of Rights and Freedoms does not enumerate a separate right of privacy, it does include analogous rights to life, liberty, and the security of the person, and the right to be secure against unreasonable search or seizure.
Likewise, the Privacy Act, which expressly governs federal handling of personal information has quasi-constitutional status, according to the Supreme Court, making it a privileged category that is meant to reflect certain basic goals of our society. Collectively, these are meant to empower individuals, create meaningful rights, and circumscribe governmental authority through the application of strong remedies in the event of a breach—all of which are foundational in a democracy.
For private companies, it is different. The Personal Information Protection and Electronic Documents Act (PIPEDA) is the applicable law governing personal information disclosed or collected in the course of commercial activities—with substantially similar legislation applying in some provinces. The biggest weaknesses pointed to in this law are that it lacks any real enforcement mechanism, when compared to its constitutional and quasi-constitutional cousins, and that it is built on a consent model—where individuals are required to read often lengthy and overly legalistic terms and consent to them, which most people do not read. So, the notion of informed consent is, in most instances, a fiction. Plus, for many of the services, the alternative options are not appropriate substitutes because the main provider is so dominant in the market that not consenting really equates to missing out entirely.
The federal government has recognized some of these deficiencies. The mandate letter for the minister of innovation, science, and industry charged him with establishing a new set of online “rights,” including data portability, to know how personal data is being used, and compensation when personal data is breached.
However, in an effort to design the digital society we want more than may be required. As an example, in the United Kingdom, there is a new privacy code aimed at protecting children using social media, streaming services, and online games. This was done to address concerns of data misuse and access to content that could negatively affect the mental health of children and young adults. It has been referred to as a digital seatbelt.
As we seek to redefine digital society, the foundational constitutional principles should be a guide—empowering individuals, constraining power, and creating meaningful rights. We should not build it on a fiction. We should not just do what is convenient, or easy. The Canadian Charter elevated certain principles to constitutional status because they formed the very core of the Canadian identity. We do not need small tweaks to existing law, rather we need a robust new legal framework designed to protect the core of Canadian values in the digital realm.
This article originally appeared in The Hill Times.
