IPC - Office of the Information and Privacy Commissioner/Ontario | What's New

Commissioner’s Statement on the Demise of Bill C-30

Tue, 12 Feb 2013 00:00:00 GMT

On February 11, 2012, Justice Minister Rob Nicholson announced that the government, “will not be proceeding with Bill C-30, and any attempts that we will continue to have to modernize the Criminal Code will not contain the measures contained in C-30, including the warrantless mandatory disclosure of basic subscriber information or the requirement for telecommunications service providers to build intercept capability within their systems.”

I’m utterly delighted that the government has listened to the enormous public outcry against unauthorized, warrantless access.

I want to express my thanks to Ontarians, and indeed all Canadians, who joined us by the thousands in standing up for freedom and democracy. Together we demonstrated that the true value of privacy must be recognized – and ideally enhanced, not diminished – in any effort to modernize law enforcement powers.

The death of Bill C-30 upholds our fundamental right to privacy, and in turn, preserves our freedoms. This is a victory for every Canadian!

Ann Cavoukian, Ph.D.
Information and Privacy Commissioner, Ontario

Related Article: Harper government kills contreversial Internet surveillance bill

Letter to the Editor: Dispelling myths on health privacy; The problem with protecting health privacy

Fri, 25 Jan 2013 00:00:00 GMT

Dispelling myths on health privacy; The problem with protecting health privacy

Re: The problem with protecting health privacy, Opinion, Jan. 23

As privacy commissioner, I am responsible for overseeing the Personal Health Information Protection Act (PHIPA). I want to dispel the myth that PHIPA requires health-care providers to obtain express consent to share information with each other to provide care for their patients. Consent may be implied unless the individual explicitly states otherwise. The suggestion that consent can only be implied where “it is not reasonably possible to obtain the individual’s consent in a timely manner,” is emphatically not the case.

Health-care providers need not take a “defensive approach.” One of the stated purposes of PHIPA is to protect the privacy of individuals, “while facilitating the effective provision of health care.”

Contrary to this opinion piece, pharmacists are permitted to advise specialists about drug interactions; specialists are permitted to send reports to referring physicians; Community Care Access Centres are permitted to provide test results to referring physicians to facilitate treatment of an individual, unless the individual explicitly states otherwise. There are also several circumstances when information may be shared with family members.

Health-care providers are encouraged to read our papers, “Circle of Care: Sharing Personal Health Information for Health-Care Purposes” and “Dispelling the Myths Under the PHIPA,” available at www.ipc.on.ca, published in conjunction with key health sector stakeholders. Let’s get this right.

Ann Cavoukian, Information and Privacy Commissioner of Ontario

From the Toronto Star. January 24, 2013.

Letter to the Editor from Commissioner Cavoukian: Misleading info about privacy (II)

Fri, 07 Dec 2012 00:00:00 GMT

Misleading info about privacy (II)
National Post, December 7, 2012

Re: Misleading Info About Privacy Bill, letter to the editor, Dec. 6.

The amount of misinformation on Bill C-30 is staggering — on that we agree. But it ends there. If Chief Constable Jim Chu is saying the police would never “monitor citizens’ surfing habits without a warrant,” then I will be the first to thank him. But if subscriber data will be accessible without a warrant, then I don’t know how he can make such a claim.

Once the police have IP and email addresses, the ease with which they can connect the dots relating to online activity is indisputable. Analytic tools make it possible to link this information to identifiable individuals and combine information from multiple sources, to create detailed personal profiles.

I am not alone in this view. Professor Michael Geist has stated, “the ability to link [subscriber data] with other data will often open the door to a detailed profile about an identifiable person.”

Tragic cases of child exploitation are being used to try to scare Canadians into giving law enforcement unfettered access to subscriber data. It is indeed unfair to continue misrepresenting our concerns as hindering investigations of “criminals and predators.” On the contrary — we are trying to preserve the privacy and freedom of law-abiding citizens.

Ann Cavoukian, Information & Privacy Commissioner

Ann Cavoukian: Police need to get behind privacy

Sun, 02 Dec 2012 00:00:00 GMT

As Ontario’s Information and Privacy Commissioner, I have a deep respect for law enforcement. I frequently work closely with the police to help them succeed in fulfilling their important functions without sacrificing our vital right to privacy. The guidance I have provided over the years on the privacy implications of new technologies has given the police a roadmap on how to be effective, yet also protect our privacy.

Read the full article

Ontario Court of Appeal Overturns Conviction Due to Juror Vetting

Thu, 22 Nov 2012 00:00:00 GMT

On November 21, the Ontario Court of Appeal ruled that privacy invasive background checks on prospective jurors should result in a new trial for an accused.

In 2009, the Commissioner conducted a province-wide investigation into the background check practices of police and Crown Attorneys, culminating in our Report on Excessive Background Checks Conducted on Prospective Jurors. We found the practice to be both widespread and contrary to our FIPPA and MFIPPA. We were gratified to see that the panel quoted extensively from our report, and stated “In her well-reasoned report, the Commissioner came to the following relevant conclusions…” We are also pleased that the court has recognized the importance of privacy, and affirmed our view that unjustified invasions of jurors’ privacy can have a serious impact on the integrity of our criminal justice system.

The Supreme Court of Canada is currently deliberating on a group of appeals brought by individuals who were not successful in persuading the Ontario Court of Appeal to overturn their convictions on the basis of improper jury vetting. Our office appeared as an intervener at that hearing.

Letter to the Editor from Commissioners Cavoukian, Clayton and Denham in response to Chief Chu

Wed, 14 Nov 2012 00:00:00 GMT

RE: Privacy commissioners misunderstand Bill C-30
Vancouver Sun
Saturday, November 10, 2012

We have no objection to allowing for immediate access to subscriber data in urgent circumstances. Our objections relate to the fact that there will be no determination of whether the circumstance is urgent or not, thus allowing for far greater collection of subscriber data.

In fact, Bill C-30 was not drafted to address serious and immediate harms to persons or property. The proposed warrantless access power is not even confined to criminal investigations, let alone serious ones, and can be used for the purpose of any function or duty of law enforcement.

It has long been acknowledged that Bill C-30 does not provide law enforcement with the authority to access the content of private communications without a warrant. However, in the case of subscriber data, such as Internet Protocol Addresses and email addresses, new analytic tools and algorithms now make it possible, not only to link those pieces of information with an identifiable individual, but also to combine information from multiple sources, ultimately creating a detailed personal profile of a personally-identifiable individual.

The true value of privacy must be recognized – and ideally enhanced, not diminished – in any effort to modernize law enforcement powers.

Ann Cavoukian
Information and Privacy Commissioner, Ontario

Elizabeth Denham
Information and Privacy Commissioner, BC

Jill Clayton
Information and Privacy Commissioner, Alberta

Vancouver Sun

Letter to the Editor from Commissioners Cavoukian, Clayton and Denham regarding Bill C-30

Wed, 07 Nov 2012 00:00:00 GMT

RE: Police chiefs speak out

In his opinion piece, Chief Chu repeats the now much-discredited analogy that subscriber data is equivalent to what is found in a phone book. We disagree. This information, which includes email addresses and internet protocol addresses, is not publicly available and can be used to reveal the web-related activities of law abiding citizens. This is why Canadians across our country expressed such strong concerns about the Federal government’s introduction of Bill C-30, the Internet surveillance bill.

As Privacy Commissioners, we understand that the police may need new tools to investigate crime as technology advances. However, Commissioners have consistently asked for evidence that police need the power to compel Internet Service Providers to turn over personal information of subscribers without a warrant in order to attain these ends.

To date, law enforcement officials have failed to provide persuasive factual evidence that current law has impeded police investigation of serious crimes, like those involving individuals who exploit children. Current law recognizes exigent circumstances that justify immediate access to information to solve serious crimes. If police need additional powers, they must be demonstrably justified, and come with appropriate judicial oversight and accountability.

New surveillance powers must not come at the expense of our right to privacy.

Ann Cavoukian, Ph.D.
Information and Privacy Commissioner, Ontario

Jill Clayton
Information and Privacy Commissioner, Alberta

Elizabeth Denham
Information and Privacy Commissioner, BC

HOT DOC: One Privacy Paper to Read this Week

Fri, 02 Nov 2012 00:00:00 GMT

Washington is obsessed with the concept of "privacy by design" — it's in the FTC's privacy report, it guides the White House's online privacy blueprint and it's proven infectious on Capitol Hill. But the mind behind the idea — Dr. Ann Cavoukian, the top privacy cop in Ontario, Canada — is out with a new report today that points out the intersection of "privacy by design" with personal data vaults, and similar technologies — an industry segment that's starting to explode.

The idea behind these vaults: Companies help users centralize their data, sensitive or otherwise, with the goal of helping Web users control who accesses it, port it over to other services or — an idea still in its infancy — monetize it in some way. (Cavoukian points out the D.C.-based company Personal, whose leader writes the foreword to her white paper, as an example of this sort of system.) The broad argument: Cavoukian wants to see privacy-by-design brought to this new ecosystem as it matures. The goal is to ensure a level of trust and reliability between users and data vault companies, while setting baseline privacy expectations between the data vault companies and the third parties that receive the data. She continues: "In a PDE environment, in which personal data is collected and shared with the permission of the individual, the devil will truly be in the details. In the wrong hands, one’s PDV and activities within the PDE could be exploited as a major surveillance tool."

Source: Politico.com

Paper: Privacy by Design and the Emerging Personal Data Ecosystem

Dispelling the Myths Under the Personal Health Information Protection Act

Fri, 28 Sep 2012 00:00:00 GMT

There are many myths surrounding how information may be collected, used and disclosed under the Personal Health Information Protection Act. Working with our partners in the health care community, we have created this one-page document to dispel some of the more common myths.

Dispelling the Myths Under the Personal Health Information Protection Act

A Privacy-Friendly Way to Ban Gambling Addicts From Casinos

Wed, 29 Aug 2012 00:00:00 GMT

Read the full article