Online Pandemic Activities Call for better Privacy Protection Laws: Revising Bill C-11

Padmaja Rengamannar | February 19th, 2021

At the Lex Acta, we have discussed plenty of legal changes generated by the pandemic. We’ve talked about the challenges of obtaining legal aid, conducting court hearings over zoom and accessing legal justice when marginalized groups are concerned, in our current environment. However, we have yet to consider the revisions that have been made to privacy laws around the world, and more recently in Canada. E-commerce and electronic transactions have soared since the advent of social media and social media marketing strategies. Electronic interactions require a fair amount of personal information from users - name, age, gender, location, occupation, etc. In this regard, governments and privacy law actors have questioned how such information is handled. What concerns them the most about data handling practices are the purposes of collecting personal data and the actors involved in these processes. In Canada, one of the widely implemented privacy laws in terms of commercial transactions is the Personal Information Protection and Electronic Documents Act (PIPEDA)which was passed in April 2000.

Bill C-11 applies to organizations in the private sector that accumulate, use or impart personal information when any commercial activity is concerned.(1) The law delineates commercial activity as “any particular transaction, act, or conduct, or any regular course of conduct that is commercial, including the selling, bartering or leasing of donor, membership or other fundraising lists.”(2) The pandemic has given rise to a surge of online shopping and increased consumption patterns. This has rendered user personal information vulnerable to extractive companies who mine for personal data regularly.(3) Data mining is a lucrative practice in the business industries, which enables companies to form “description(s) and prediction(s)” of the data being collected to make profits.(4) However, it becomes concerning when there is a lack of transparency from private organizations when considering how personal information is gathered and the purposes of gathering such data. Clearview AI is one such company whose data accumulation and usage practices are ambiguous among many other companies such as Facebook and TikTok.(5)

In light of these concerns, the Canadian government has sought to revise Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make related and consequential amendments to other Acts, and repeal aspects of PIPEDA.(6) Bill C-11 would enact the Consumer Privacy Protection Act (CPPA) while introducing new privacy obligations for private companies in their commercial interactions with users. The CPPA would for one create stricter obligations for private organizations, that may cost them up to 5% of global revenues ($25 million) should they violate these laws. Second, it would offer greater rights and sovereignty to individuals in regard to the data that they offer companies.(7) Individuals can make inquiries to private organizations about their personal information and request for them to be deleted. Lastly, under such a law, private organizations would be obligated to provide its users “algorithmic literacy”(8) upon request, to explain the reasoning behind their algorithmic mechanisms and why certain kinds of predictions are made based on the data made available to them.

Data mining, machine learning and privacy practices, are not neutral. They are imbibed with different human understandings of the world, therefore long-running biases are inevitably injected into these systems. A law like this will curb unfair data privacy practices, and is more important than ever, since the pandemic has called for greater digital interactions between people around the world.

Endnotes

1. Office of the Privacy Commissioner of Canada, "PIPEDA in Brief," Commissariat à La Protection De La Vie Privée Du Canada / Office of the Privacy Commissioner, last modified June 7, 2019, https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/.

2. Office of the Privacy Commissioner of Canada, "PIPEDA in Brief."

3. CBC News, "Pandemic Online Shopping Boom Has Generated Bumper Crop of Vulnerable Personal Data, E-commerce Experts Warn," CBC, last modified January 22, 2021,https://www.cbc.ca/radio/spark/pandemic-online-shopping-boom-has-generated-bumper-crop-of-vulnerable-personal-data-e-commerce-experts-warn-1.5883949?cmp=FB_Feed_CBCMain&fbclid=IwAR3cGRaf8JrYsEKgHGEeA28HqsGqSA5sjIJhK2X3cSns-kLHeoLjMy7Qrgg.

4. Alexander Furnas, "Everything You Wanted to Know About Data Mining but Were Afraid to Ask," The Atlantic, last modified April 3, 2012, https://www.theatlantic.com/technology/archive/2012/04/everything-you-wanted-to-know-about-data-mining-but-were-afraid-to-ask/255388/.

5. Elizabeth Thompson, "U.S. Technology Company Clearview AI Violated Canadian Privacy Law: Report," CBC, last modified July 10, 2020, https://www.cbc.ca/news/politics/technology-clearview-facial-recognition-1.5899008.

6. Government of Canada, "Bill C-11: An Act to Enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to Make Related and Consequential Amendments to Other Acts," Language Selection - Department of Justice / Sélection De La Langue - Ministère De La Justice, last modified December 2, 2020, https://www.justice.gc.ca/eng/csj-sjc/pl/charter-charte/c11.html.

7. Colin Hyslop, "Bill C-11: Canada Proposes New Data Privacy Legislation," Data Protection Report, last modified December 3, 2020, https://www.dataprotectionreport.com/2020/11/bill-c-11-canada-proposes-new-data-privacy-legislation/.

8. Hyslop, "New Data Privacy Legislation."