All 28 countries in the European Union will have to follow new data and privacy rules that go into effect May 25, 2018 and Canada should change its law too, to better protect individuals, says a former privacy commissioner of Ontario.
Under the EU law, firms will have to get explicit consent from customers based on specific purposes for the use of their data, and it will have to be for specific periods of time. Individuals will have the right to ask for a copy of all data that is held on them and an explanation of how the data is used and whether third parties have access to them.
As it now stands, the onus is on individuals to take concrete steps to protect their personal data. This is usually a convoluted process involving complicated legal language. The EU law will reverse that and put the onus on companies to ask for permission to use personal data.
‘You get privacy automatically’
“You will not have to seek out anything to be given privacy. You will get it automatically as the default,” says Ann Cavoukian, former privacy commissioner and head of the Privacy by Design Centre for Excellence at Ryerson University in Toronto.
“What that means is, you buy something you give them your personal information… The company can only use it for that purpose intended for that purchase, full stop. If they want to use it for some secondary use down the road, they’ll have to come back to you and seek your positive consent. If you don’t give it, they can’t use it for any other purpose…You get privacy automatically.”
‘If you value freedom, you value privacy,’ says former privacy commissioner Ann Cavoukian.
‘We don’t want to be held back’
Cavoukian is proud that she developed this so-called Privacy by Design model and says Canada should adopt it as well as the other measures included in the EU law. She says Canada has always had privacy laws compatible with the EU enabling it to engage in trade and exchanges of data without any fear of reprisal. That will no longer be the case as of Friday. Canada’s federal privacy commissioner has told the government that it must upgrade its privacy laws which were created in the early 2000s and have become outdated. The government is considering the matter.
Cavoukian says Canada must act soon to adopt what is called essential equivalence to the EU law. “We don’t want to be held back. We don’t want businesses to be held back or exchanges of data with the EU. This must be done.”
Search engines like DuckDuckGo promise to not collect and share personal data. (DuckDuckGo)
Privacy ‘forms the foundation of our freedom’
Meanwhile, Ryerson University has begun developing a tool for individuals to use to protect their privacy. It’s not clear when it will be ready, but when it is, it will be free and widely available.
Meanwhile, Cavoukian suggests people seek out and use privacy settings to protect themselves, and notes they can use search engines that do not track their activity, such as DuckDuckGo.
“You see, privacy isn’t only a fundamental human right,” she says. “But it also has enormous societal value because it forms the foundation of our freedom. If you value freedom, you value privacy.”