Necessary but not enough: Canada’s proposed new private-sector privacy law

Bill C-27, currently before Parliament, promises to modernize Canada’s private sector data protection law with a new Consumer Privacy Protection Act (CPPA). Yet even this title relies on an outdated privacy paradigm. Individuals will be protected as ‘consumers,’ when, through the ceaseless and inevitable collection of their data, they are the consumed. Canada’s current law—the Personal Information Protection and Electronic Documents Act (PIPEDA)—dates back to the early 2000s when individual control over personal data dovetailed nicely with a concept of privacy as a right to autonomy and dignity. At the time, companies collected personal data primarily to provide goods or services, and data protection obligations sought to ensure that individuals understood why their data was being collected, and how it would be used. The law required organizations to limit collection to what was necessary, obliged them to ensure the information they used was accurate, and required them to protect the personal data they collected. However, advances in technology and changes in business models have dramatically altered the importance of data and how value is extracted from it. Data analytics derive insights from personal data that drive targeted advertising and profiling. Data now also fuel the burgeoning artificial intelligence (AI) industry; personal data are used in the development of technologies that include facial recognition, predictive systems, and so much more. Personal data has become a valuable commodity: it is mined, extracted, traded, sold, and repurposed in ways that we—the data sources—struggle to comprehend. PIPEDA was not designed for this context. Limiting collection makes no sense to businesses when more data means more innovation. Consent is a grim fiction when data collection is ubiquitous and continuous. We often have no choice but to use data-hungry digital technologies to work, to be educated, to transact, to drive our cars, to listen to music, read, or watch television. Worse, some companies consider that what people post on the internet is fair game. Clearview AI scraped photographs from social media sites to build its powerful facial recognition service. Generative AI, which has both dazzled and disturbed the world, is fed on data of all kinds, much of which is also harvested from the public internet. Our data is now routinely used—often without our knowledge or meaningful consent—to develop technologies that drive private wealth and raise the spectre of mass surveillance. The CPPA is ill-equipped to address this context. It is still built on a foundation of individual consent and control, sees innovation as an overwhelming good—one that should not be stifled by regulation—and shies away from recognizing the broader human rights implications of personal data exploitation. Take the example of anonymized data. Anonymization, if done properly, protects individual privacy while freeing up data for innovative uses. Under the CPPA, properly anonymized data will fall outside the scope of the legislation. Organizations will be able to use anonymized data for research and innovation without knowledge or consent, and may trade in such data. Anonymized data is also exempted from data retention limits. Yet anonymized data raises its own human rights concerns. It can be used to profile groups or communities, and to attribute characteristics to them which are then further attributed to anyone linked to these groups. It may no longer matter what you are really like, so long as you can be associated with those sharing similar characteristics. Anonymized data requires a more holistic policy response than a backdoor out of a consent-based privacy law. We see fragments of this need in discussions about ethical AI. There are hints of this in the federal government’s embryonic Artificial Intelligence and Data Act that is part of Bill C-27, but that leaves most of its substance to be defined by regulations. We have human rights commissions that could play a role with new powers and better resources. We are seeing new signs of cooperation and collaboration between regulators. But as the CPPA limps through Parliament, our attention is focused on a bill that is expected to solve a problem that it is unable to properly address. Privacy protection is necessary, but not sufficient. Dr. Teresa Scassa is the Canada Research Chair in Information Law and Policy at the University of Ottawa's Faculty of Law. Her research is in the area of privacy law, data governance, and artificial intelligence. The Hill Times