by Valerie Steeves
Congress '99:The 27th Canadian Congress on
Criminal Justice, Sept. 6-20, 1999
Republished with permission

Until recently, surveillance technology was only used by the state. But new communications technologies have made it cheap and easy for just about everyone to collect our personal information, and the private sector has taken up the task like gangbusters. Credit cards, Interac records, Air Mile cards and discount club cards track our purchases. Customer surveys and expanded warranty applications ask about our lifestyle choices and personal goals. Massive databases store the details of the consumer choices of over 90 per cent of North American households. And all this information can be networked together and mined for detailed profiles of particular individuals.

The Holy Grail at the end of the data trail is said to be more efficient customer service. And, since we all have nothing to hide, what harm can come of it? Here are some real-life examples to ponder:

• Earlier this year, a company got a hold of a list of people who had signed up for a weight loss program, and sent them chocolate bar samples by direct mail at Easter, reasoning that Easter was when they were most vulnerable to food pressures.
• During hearings to confirm his appointment to the United States Supreme Court, Judge Bork was personally embarrassed when a reporter published the names of all the videos he had rented from his local video store.
• Donnelly & Sons, the largest American data firm, consistently argued that its databases did not pose a threat to children – until Los Angeles journalist Kyra Phillips reported that, for $277, she was able to buy a list of the names and addresses of over 5,000 children in the Los Angeles area, even though she used the name of a notorious child killer.
• Insurance companies now routinely demand the complete medical file, including office notes, from psychiatrists in order to process a claim. Especially because employers may have access to medical insurance claim information, many executives are choosing to pay cash for psychiatric services
• The Federal Deposit Insurance Corporation developed a Customer Profile Initiative which would require all American banks to collect detailed profiles of every customer, and report any unusual banking activity to the Federal Bureau of Investigation and the Central Intelligence Agency. Under the program, a customer who sells his car for $15,000 and deposits the proceeds into his bank account would suddenly have to explain where the money came from to the authorities. The Initiative was abandoned after the FDIC received thousands of e-mails from enraged Americans.

The act of surveillance has social consequences. The most obvious are the ones which affect the individual, who suddenly faces embarrassment or loss of a service because a corporation or government invaded his privacy and usurped his personal information. We already deny health insurance to people with diseases like diabetes and cancer. Imagine how difficult it would be to get insurance if the company had access to a genetic sample to identify not only your current state of health, but also any health problems you may face in the future. The potential for discrimination is staggering.

But there is also a larger issue at stake. The first casualty of a surveillance society is trust. During the 1997 public consultation on privacy rights, a New Brunswick teacher spoke of her experiences with an early experiment in distance education. During one class, she made some comments which were critical of government policy. The next day, she received a phone call from the high tech company which was supporting the platform being used for the class. The company had been monitoring the class and didn't like her comments. They strongly suggested she refrain from such an analysis in the future. After all, they had donated the technology which enabled her to hold the class.

Human relationships are built upon trust. Putting surveillance in the classroom, the workplace or the marketplace changes the nature of our social interaction, detracts from our sense of autonomy, and, ultimately, erodes the social cohesion which is necessary to any human community. But government privacy policy has consistently failed to address these issues, choosing instead to focus on the narrow needs of the information economy.

Bill C-54, the Personal Information Protection and Electronic Documents Act(1) is a prime example. The Bill was introduced in October 1998, ostensibly to protect the privacy of personal information in the private sector. However, the Bill is clearly an electronic-commerce initiative. The Bill provides that all commercial collection and use of personal information must abide by the provisions of the Canadian Standards Council of Canada's Model Code for the Protection of Personal Information(2). The Model Code(3) was negotiated by government, private sector and consumer association representatives with the aim of creating a level playing field for corporations competing in the information marketplace.

The discussion paper which preceded the Bill assumes that the goal of the legislation is to develop global competitiveness in the information economy. The discussion paper states:

Legislation that strikes the right balance between the business need to gather, store, and use personal information and the consumer need to be informed about how that information will be used ... is an important element of building the consumer trust and the market certainty needed to make Canada a world leader in electronic commerce.(4)

[and]

The ability to provide effective protection for personal information may be crucial to Canada's ability to remain competitive internationally in the global information economy. ... This [European Union] Directive has the potential to make the protection of personal information a major non-tariff trade barrier with Canada ... Canadian businesses may be forced to undertake individual comprehensive negotiations to show compliance with the European Union rules. This process will be fraught with uncertainty and could become lengthy and expensive.(5)

It is also worth noting that the discussion paper uses the words "consumer," "business" and "industry" seventy-eight times, as opposed to a total of ten occurrences of "citizen."

The focus on economic efficiency in Bill C-54 does not exist in isolation. I would argue that it is part of a larger shift in governance. Traditionally, we viewed government as a vehicle to advance the public good. From this point of view, privacy is an essential part of what Ursula Franklin calls the indivisible benefits of governance: justice, dignity, freedom, clean air, equality.

However, policy makers increasingly see government less as a vehicle to advance the public good than as a vehicle to divvy up divisible benefits: things that benefit one set of private interests at the expense of another. Electronic commerce is a good example of this dynamic. Industry Canada has been actively laying the infrastructure for a form of commerce which will promote profits for some, and cut jobs for others. Indeed, there is a strong argument that moving commerce to the information highway runs the risk of disenfranchising technological have-nots not only from the economy, but from the political process itself.

This risk has been accepted because policy makers have begun to accept private-sector goals as ends in themselves. In other words, government has moved away from being a vehicle for democratic expression to become a supplier of services. Good government is therefore efficient, cost-effective, and competitive. From this perspective, privacy is a barrier to efficiency and competitiveness.

In many ways, Bill C-54 begs the privacy question. The drafters intended to create a regulatory scheme which will ensure that companies will continue to be able to collect and use personal information to generate profits and remove inefficiencies. But the history of technology tells us that the unintended consequences of new technologies are what cause us real problems. Let me use another insurance example to illustrate. In 1997, a pregnant American woman underwent tests to determine whether or not there was a risk her baby might be born with Down's Syndrome. When the tests came back positive, her health insurance provider advised her to    have an abortion. When she refused, they told her they would not pay any medical costs associated with a Down's child because she had the opportunity to limit their exposure to that risk. The power that comes with information can easily be abused, especially if efficiency and cost reduction is valued more than the human beings the information describes. At the time of writing, Bill C-54 died on the Order Table when Parliament prorogued in June 1999, after strong opposition from insurance companies and the Ontario Ministry of Health.(6) Not surprisingly, the opposition revolved around the need to remove barriers to efficiency and to combat medical fraud. The Ministry of Health argued that medical information should be exempted from protection because the government relies upon personal data collected by the private sector to run its anti-fraud programmes.

In order to protect privacy in the information age, it is crucial that we place the debate where it properly belongs – in the field of human rights. As Ursula Franklin argues:

When human rights informs the language in which the discussion among you and the general public and Parliament takes place, you speak then, rightfully, about citizens and all that comes with that. On the other hand, if the emphasis is primarily on the protection of data, one does look at a market model, one does look at an economic model, and all the things you've heard about the new economy. Then it is the language of the market that informs your discourse.(7)

Let us seek to articulate a definition of privacy that protects our most fundamental social and political values. To do this, we must move beyond the limiting language of the marketplace and embrace a human rights perspective. To date, this has been done most comprehensively by the Standing Committee on Human Rights and the Status of Persons with Disabilities. In its1997 report Privacy: Where Do we Draw the Line?(8), the Committee defined privacy this way:

1.1 Everyone is entitled to expect and enjoy:

• physical, bodily and psychological integrity and privacy;
• privacy of personal information
• freedom from surveillance
• privacy of personal communications, and
• privacy of personal space.

1.2 Everyone is guaranteed that:

• these privacy rights will be respected by others, adopting whatever protective measures are most appropriate;
• violations of these privacy rights will only be allowed if the interference with these rights and guarantees is reasonable and can be demonstrably justified in a free and democratic society.

The basic duties owed to others to ensure that their privacy rights are adequately respected include:

• the duty to secure meaningful consent;
• the duty to take all the steps necessary to adequately respect others' privacy rights or, if their rights must be infringed, to interfere with privacy as little as possible;
• the duty to be accountable;
• the duty to be transparent;
• the duty to use and provide access to privacy enhancing technologies;
• the duty to build privacy protection features into technological designs.

I would suggest that the Committee's definition provides us with a roadmap that will best enable us to move forward into the networked society without leaving our privacy, and our democratic rights, behind.

Questions for Discussion

• Can personal privacy continue to exist in an information economy?
• Bill C-54 requires organizations collecting information to obtain the individual's consent to the
  collection. Can consent alone protect individuals from a loss of privacy in an information economy?
• Bill C-54 deals with the narrow question of the protection of personal information, or data
  protection. The Standing Committee on Human Rights presented a much broader definition of
  privacy. In the event Bill C-54 is made into law, will it weaken our political ability to entrench privacy rights beyond the data protection model of information privacy?

Endnotes

1. First Session, Thirty-Sixth Parliament, 6-47-48 Elizabeth II, 1997-98-99, as amended.
2. CAN/CSA-Q830-96.
3. The Model Code provides, among other things, that a corporation collecting personal information must first obtain the consent of the individual to the collection.
4. Industry Canada/Department of Justice, Task Force on Electronic Commerce, Building Canada's Information Economy
and Society: The Protection of Personal Information (Ottawa, Jan. 1998) Industry Canada/Justice Canada, op. cit., pp. 2-3.
5. Ibid, p. 7
6. Minister Manley has publicly committed his government to reinstating the Bill when Parliament resumes sitting on September 20, 1999, though passage of the Bill is considered to be unlikely at this point.
7. Stormy Weather: Conflicting Forces in the Information Society, Closing Address at the 18th International Privacy and Data Protection Conference, Ottawa, Sept. 19, 1996.
8. Canada, Privacy: Where Do We Draw the Line?, Report of the House of Commons Standing Committee on Human Rights and the Status of Persons with Disabilities (Ottawa, April 1997).

Conference sponsored by the Canadian Criminal Justice Association and the Legal Studies Program, University of Alberta Funded by the Alberta Law Foundation© July 1999