Shaping the future of privacy: Research on emerging technologies

In 2024, the IPC launched a research and innovation hub, where we make publicly available for the benefit of others the results of independent research reports we commissioned on highly specialized privacy and access topics. In 2024, the IPC commissioned or otherwise supported four reports by Canadian academics and researchers, as part of our efforts to contribute to broader discussions on emerging technologies and regulatory approaches that shape the future of privacy and access to information. 

This work aligns with our commitment to fostering informed dialogue and evidence-based policymaking. The views expressed in these reports are those of the authors and do not necessarily reflect the views of the IPC.

Regulatory Sandboxes

Professor Teresa Scassa and Professor Elif Nur Kumru of the University of Ottawa explored the concept of a privacy regulatory sandbox. The report, Exploring the Potential for a Privacy Regulatory Sandbox for Ontario, funded by the Social Sciences and Humanities Research Council of Canada, examines how such an initiative could fit within the IPC’s mandate. 

Regulatory sandboxes provide a controlled environment where innovative products or services can be developed, tested, and validated under a regulator’s supervision. The report outlines the potential for sandboxes to support innovation in areas such as artificial intelligence, while ensuring compliance with privacy laws. By consulting with experts and studying regulatory sandbox initiatives in jurisdictions like the UK, Norway, and France, the authors identified key elements and considerations for the potential creation of a privacy sandbox in Ontario. These findings highlight the role sandboxes could play in supporting innovation, enhancing regulatory expertise, and informing potential law reform.

Exploring neurotechnology: Balancing innovation with privacy

Verónica Arroyo of The Citizen Lab (Munk School of Global Affairs) conducted research on the rapid advancements in neurotechnology and its use in health care, law enforcement, and employment. Neurotechnology refers to techniques and devices that can monitor or manipulate brain activity, often with the aim of gaining insights into an individual’s thoughts, emotions, or cognitive states. While these innovations hold great promise, they can also raise serious privacy and human rights risks when they are used to access or alter deeply personal mental information. The research paper, Emerging Uses of Neurotechnology, assesses the possible uses of these technologies by public and private sector organizations, explores their current and future applications — including the ability to tap into sub-conscious thoughts — and outlines the legal and ethical considerations surrounding their use. 

The age of surveillance: Exploring the risks of Unmanned Aerial Vehicles (UAVs) 

In response to the growing adoption of Remotely Piloted Aircraft Systems (RPAS), or drones, by law enforcement, the IPC engaged Dr. Scott Thompson of the University of Saskatchewan to research The Existing and Emergent State of UAV/RPAS/Drones Surveillance Capacities and Law Enforcement. As RPAS technology has advanced and become more affordable, it has seen increased use in law enforcement, emergency response, and public safety, offering significant benefits such as enhanced aerial surveillance, quicker response times, and cost efficiencies. However, as UAV capabilities evolve with more sophisticated capabilities, concerns about potentially new forms of surveillance or intrusion into personal privacy have intensified. This paper explored the emerging privacy challenges posed by UAVs, helping the IPC better assess how the technology is being used and could potentially be used in Ontario.

Employee privacy in the digital workplace

In recent years, the Ontario government made changes to the Employment Standards Act (ESA) that targets employer use of electronic surveillance and artificial intelligence (AI) in hiring. However, these aspects are only the tip of a much bigger iceberg of employee monitoring software and employment practices enabled by AI. Dr. Adam Molnar of the University of Waterloo prepared a research report, Surveillance and Algorithmic Management at Work: Capabilities, Trends, and Legal Implications, that outlined contemporary employee surveillance technologies, along with a jurisdictional scan of how various national and international employment laws govern the unique features and unprecedented challenges of employee privacy in the modern workplace. This paper provides insight into the current and emerging regulatory trends, models, and concepts across the world.

Submissions on proposed laws and regulations

As part of its mandate, the IPC is called upon to provide comments and recommendations on the privacy and access implications of proposed laws and regulations. Throughout 2024, the IPC made the following submissions to government and various committees of the legislative assembly:

February 12

Submission for Bill 149, the Working for Workers Four Act, recommending safeguards for the use of AI in the workplace and a private sector privacy law in Ontario.

February 20

Comments on Schedule 4 of Bill 157, Enhancing Access to Justice Act, which would repeal the robust accountability and transparency measures that support ongoing public engagement and promotion of public confidence in policing and community safety regulations under the Community Safety and Policing Act.

April 12

IPC feedback on the Second Additional Protocol to the Convention on Cybercrime: Enhanced Cooperation and Disclosure of Electronic Evidence, that would allow foreign authorities to request electronic evidence from Ontario organizations, raising concerns about privacy rights and the need for stronger safeguards and oversight.

May 17

Submission on Bill 188, the Supporting Children's Futures Act, recommending that any changes related to the collection, use and disclosure of personal information must be transparent and matched by a proportionate level of robust privacy protection.

June 25

Transparency recommendations for a regulatory proposal regarding publication of Inspector General of Policing reports under the Community Safety and Policing Act.

Submission concerning Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, which would enact the Enhancing Digital Security and Trust Act, 2024, setting out a framework for public sector rules on cybersecurity, artificial intelligence and digital information of minors (Schedule 1) and introduce amendments to the privacy-related provisions of the Freedom of Information and Protection of Privacy Act (Schedule 2).

July 22

Comments responding to the proposal to enhance personal health information contributed to the provincial electronic health record (EHR).

September 9

Commissioner’s letter to the Ministry of Health recommending greater transparency and improved patient access related to proposed regulatory amendments under the Personal Health Information Protection Act to establish a digital identity system at Ontario Health. 

September 20 

IPC submission on new job posting rules under the Employment Standards Act, recommending a clear, consistent definition of AI, full transparency about its use in hiring, and stronger privacy protections for workers in Ontario.

November 14

Commissioner Kosseim addressed the Standing Committee on Justice Policy in its review of Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act (see above).

November 18

The IPC’s submission on Schedule 2 of Bill 212, the Reducing Gridlock, Saving You Time Act, that called for excluding certain information about controversial highway projects from FOI disclosure.

December 13

IPC submission on Schedule 6 of Bill 231, More Convenient Care Act, raising concerns about proposed changes to PHIPA that would potentially limit Ontarians’ access to their own health records and introduce a broad digital health identity tool that could put their privacy at risk.