In the 15 years that Ann Cavoukian has been the Ontario Information and Privacy Commissioner, the very definition of privacy itself has evolved with the digital age.
Cavoukian is the first commissioner to hold her position for three terms and during that time, the digital era has disrupted notions of privacy in ways that few could anticipate. Trends such as the rise of social networking, the need for government to protect digital personal information of citizens, and aggressive digital marketing practices were unheard of in the ’90s. In her role, Cavoukian has had to fight to protect the privacy of Ontarians even as they flock to share their personal information in more open ways than ever before.
As a result her time as the province’s privacy watch dog has been spent guarding the gates of technology. She’s worked with social networks, technology vendors, and tech startups to build privacy into their products from the beginning, designed on her “Privacy by Design” framework that she says is a positive-sum model – meaning that it’s possible to have both security and privacy for the individual and no need to trade one for the other.
We spoke with the commissioner, reflecting on the past 15 years and looking forward to her new role at Ryerson University at the helm of the new Institute for Privacy and Big Data.
You will have the opportunity to ask Cavoukian questions yourself at our Twitter chat on Thursday at 1 PM ET. Join us using the hashtag #ITBprivacy.
Brian Jackson: You’ve been the Information and Privacy Commissioner of Ontario since 1997. Has the privacy of Ontarians improved since then or gotten worse?
Ann Cavoukian: I think in Ontario it has improved. It seems that people in government are scared of me, that’s what I hear all the time. I think what they mean is that on privacy we don’t cave, we don’t back down, we stand firm. The government has started adopting my Privacy by Design principle and has opened a a centre of excellence for it, so they take it very seriously and I’m proud of that.
If you’re hearing a reticence, it’s about access more so than about privacy, which is a different story. Because of the record deletion last year [at the Premier’s office and Minister of Energy]. I’m not surprised the government want to withhold information that might cause them embarrassment. But provincially, we excel at meeting freedom of information requests compared to federally, there’s no question.
BJ: What is a highlight from your time as commissioner that you’ll remember?
AC: The fight over the adoption records. We have a big fight many years ago where we lost the initial round. Individuals who gave up their children for adoption 50 or 60 years ago were suddenly seeing this movement happen to open up those records and identify them. But those older women had been promised their records would not be revealed, and we said you can’t just change your approach and make it retroactive. But I lost and they said they were going to do it retroactively, so we took it to court and we won in the end. After that Premier [Dalton] McGuinty called and said they were wrong, and asked for our help to rewrite the law.
There was another more recent case with protecting mental health and attempted suicide information. Ellen Richardson, a disabled woman in a wheelchair, was planning to fly to New York to get on a cruise. A border guard looked at her and asked her about an attempted suicide attempt she’d made years before. She wad denied her entry and asked her to get a specific clearance from a physician. She protested but that was refused, and she was horrified that information was found out. We investigated the leak and it turned out that 911 calls received by police were uploaded to the Canadian Police Information Centre (CPIC) and automatically shared with the Department of Homeland Security and border patrol investigations. So we asked police to not disclose information about mental health to the RCMP, but Toronto Police won’t go along with it. So we are taking them to court. I have a lot of respect for [Toronto Police Chief] Bill Blair but I just don’t understand the intransigence on this issue. We’ve had som many people email us with heart-breaking stories, so that’s why we’ve done that.
BJ: What do you think was your biggest accomplishment?
AC: It has to be Privacy by Design. It has been unanimously voted in as an international standard in 2010. We simply no longer have the capacity as regulators to protect prviacy after the fact. You can’t rely exclusively on regulatory compliance, it’s like an iceberg where most of the harm done is below the waterline. With online activity and massive data sharing, it’s impossible to contain all the privacy breaches happening and most of them go unknown and unreported.
So it’s important to try and prevent them from happening in the first place, almost like a medical approach. We want to minimize the risk and eliminate the harm right form the outset. The cost is staggering, not only in terms of class action lawsuits but the damage to your brand. Think of Target – the president of Target in the U.S. resigned, the Target CEO in Canada was fired and their sales are down 50 per cent.
Privacy by Design has been translated into 37 languages around the world. Recently Barcelona contacted me and said they’d translated it into Catalan, and Japan let us know that it now insists on private sector companies delivering a positive sum privacy model. It’s truly a global phenomenon that beneifts Ontario because people associate it with us.
BJ: You’re moving on to a new role with Ryerson University as the executive director of the Institute for Privacy and Big Data. What do you hope to achieve in your new position?
AC: Once I gave word I wanted to depart my post, Ryerson University called with a good offer and asked me to head up the Big Data Institution. I wanted to put the privacy is the title. Everything we do will emanate with privacy and big data analytics. It will be all about the Privacy by Design model. Big data sets will be huge and valuable, but must be used in a way that doesn’t infringe on privacy.
The branding of the institute was done intentionally to show that privacy doesn’t stifle big data. First comes the honeymoon where everyone is enamoured with big data and there’s no room for privacy. Then comes the reality phase and that’s what we’re seeing right now. Everyone is questioning the expectations around big data. The ask was too much without giving thought to the privacy implications. We are going to survey all the existing protections that we can do right now. We’re also going to develop new technologies that will give you better assurance and better quality of your data. I think you’re going to see great results.