The Right to Erasure

The right to erasure

This is the third in our series on the privacy promises we can expect from a Liberal minority government.

Information about the Right to Erasure is from Innovation, Science and Economic Development Canada’s ‘Digital Charter: Trust in a digital world’, and the Liberal Party of Canada’s election 2019 platform document, ‘Forward: A real plan for the middle class’ (40).

The Promise

In the Liberal Party’s election platform, they committed to a new online right to “withdraw, remove, and erase basic personal data from a platform” (40). This seems to build and expand upon the third principle contained within Canada’s Digital Charter:

Control and Consent: Canadians will have control over what data they are sharing, who is using their personal data and for what purposes, and know that their privacy is protected.”

– Canada’s Digital Charter

Unclear within this promise are two major things: what is defined as a platform; and how this new right will be different from what is currently contained within Canada’s private sector privacy legislation, the Personal Information and Protection of Electronic Documents Act.

And, on the surface, it would appear that this new right does not go as far as the European Union’s ‘Right to be Forgotten’, which is found within the General Data Protection Regulations, and allows citizens to request that personal data be erased for a host of reasons and from entities not limited to “platforms”. Notably, this includes making requests to delist website pages in search results.

The Office of the Privacy Commissioner of Canada is currently seeking a determination from the Federal Court in order to clarify whether Google’s search engine is subject to PIPEDA. Thus, it may turn out that Canadians already have the ability to request that search engine’s de-index web pages that are responsive to a person’s name should they present unwarranted reputational harm.

The Reality

So far it’s unclear how this new right to erasure goes further than the access and correction rights that currently exist within Canada’s federal privacy legislation, the Privacy Act and PIPEDA, and B.C.’s provincial privacy legislation, FIPPA and PIPA.

Currently, PIPEDA does provide Canadians with some measure of control over their personal information. It does this by allowing individuals to correct the accuracy of their personal information in the control of a private organization, to withdraw their consent for the use of personal information, and to file a complaint with the Office of the Privacy Commissioner of Canada in order to create a record of dispute.

While these are not equivalent measures to the European Union’s ‘Right to be Forgotten’, they do allow Canadians some measure of control over their personal information and at the very least present a mechanism for addressing issues related to online reputational harm. In addition, PIPEDA also contains provisions that limit the amount of time that personal information can be retained, which in turn helps to ensure that personal information is disposed of when it is no longer required.

The Future

Important questions remain though about how effective these measures are in a digital environment. PIPEDA was created in 2000, as the internet and digital technologies were only emerging. Today, the internet is being used in ways, and on devices, that could not have been predicted 20 years ago.

With private organizations becoming increasingly reliant on personal information as a fundamental component of their business model, and the storage of personal information no longer experiencing the same physical and financial constraints, more needs to be done to protect consumers and to rebuild trust.

If Canada’s federal privacy legislation is amended to contain this new right to erasure, it may create the need to amend provincial privacy legislation to also include this new right in order to retain its equivalency. As well, new powers will need to be ascribed to provincial and federal information and privacy commissioners in order for them to be able to enforce new digital rights, like the Right to Erasure.

The Right to Data Portability

This is the second in our series on the privacy promises we can expect from a Liberal minority government.

From Innovation, Science and Economic Development Canada’s ‘Digital Charter: Trust in a digital world’, and the Liberal Party of Canada’s election 2019 platform document, ‘Forward: A real plan for the middle class’ (40).

In Canada’s Digital Charter, data portability fits within the fourth principle:

‘Transparency, Portability and Interoperability: Canadians will have clear and manageable access to their personal data and should be free to share or transfer it without undue burden.’

Clear and manageable access

Theoretically, Canadians already have “clear and manageable access” to their personal data.

For federal government institutions, Canadians have a right of access contained within section 12 of the Privacy Act. For private sector businesses, Canadians can submit requests to access personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA).

In British Columbia, access to personal information held by provincial public bodies is realized through section 5 of the Freedom of Information and Protection of Privacy Act (FIPPA). For private businesses within the province, section 23 of the Personal Information Protection Act (PIPA) gives residents this ability.

In theory, the information rights enshrined within these four Acts already gives Canadians “clear and manageable access to personal data”. What’s new then is the ability to “share or transfer it without undue burden.”

What this means, exactly, is not quite as clear.

Sharing and transferring data without undue burden

In their 2019 election platform, the Liberal Party describes data portability as the ability for people to “take their data from platform to platform” (40).

From this, we might assume that someone would have the right to extract all of their data from a platform like Facebook, Twitter, or Snapchat, and transfer it to a new platform that offers a similar service.

Why would someone want to do this? One reason might be that an alternative service provider offers greater privacy protections, which in turn would create greater competition among monopolistic platforms.

This also gives Canadians the opportunity to make meaningful choices about how they share their personal information with platforms.

International models

In the European Union, Article 20 of the General Data Protection Regulations (GDPR) gives residents a right to data portability. This right allows data subjects to receive personal data about themselves from data controllers and transmit that data to other controllers.

The GDPR also ensures that the data is provided “in a structured, commonly used and machine-readable format” and provides the right to have the personal data transmitted directly from one data controller to another.

A major difference between the European Union’s GDPR and Canada’s PIPEDA is that Canada’s private sector privacy legislation frames privacy as data protection and not as a fundamental human right.

What does a humans rights based approach to privacy look like in legislation? Article 4 of the GDPR lists the fundamental rights the Regulation respects, which include:

“[T]he respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and a fair trial, and cultural, religious and linguistic diversity.’

The proposed right to data portability is a significant step towards creating a human rights based approach to privacy in Canada. While it is not as comprehensive as the GDPR, it will give individuals greater autonomy in their ability to control their own personal data.

Criminal Investigation into the Conduct of a Former Minister

Vancouver, October 7, 2019 –  The Premier of British Columbia, John Horgan, announced late Friday that he has accepted the resignation of the Minister of Citizens’ Services, Jinny Sims, due to an ongoing RCMP investigation into her conduct. At this time, precise details into the nature criminal investigation of Minister Sims are unknown.

The former Minister of Citizens’ Services oversaw the administration of the freedom of information laws that are contained within the Freedom of Information and Protection of Privacy Act (FIPPA) and the records management practices contained in the Information Management Act (IMA).

During their 2017 campaign, the NDP promised to make reforms to the FIPPA. These included the creation of a duty to document government decisions and the inclusion of this provision within the FIPPA. Instead, the government added this provision to the IMA, which places authority within the former Minister to ensure government accountability. If the provision were to be included in the FIPPA, independent oversight would be given to the Information and Privacy Commissioner of BC.  

“This is a time for the government to move forward with a comprehensive reform of the Freedom of Information and Protection of Privacy Act,” says Sara Neuert, the Executive Director of the BC Freedom of Information and Privacy Association. “This is a necessary step in rebuilding trust with the public, it’s what was promised, and it’s the recommendation of the all-party special legislative committee that reviewed the FIPPA in 2016, former Information and Privacy Commissioner Elizabeth Denham, and current Commissioner Michael McEvoy.”

The former Minister of Citizens’ Services, Jinny Sims, issued a public apology in the spring of 2018 for conduct that contravened BC’s freedom of information laws. In the spring of 2019, a former staff member made several new allegations, which included an accusation that the former Minister continues to break these laws. We will be following the RCMP investigation very closely.

Contact:

Sara Neuert, Executive Director

BC Freedom of Information and Privacy Association

Email: fipa (at) fipa.bc.ca

Phone: 604-739-9788

-30-

Support Information and Privacy Rights in BC

We’re calling on the provincial government to keep their promise

Earlier this month, we teamed up with the BC Civil Liberties Association and created a petition to encourage the British Columbia government to keep their campaign promise of reforming the Freedom of Information and Protection of Privacy Act (FIPPA).

This Act is as important today as it was when it was created in the early 1990s. It creates a legal framework that regulates how public bodies treat personal information and assigns information and privacy rights to British Columbians.

But in the nearly thirty years since the Act was passed, a lot has changed while the Act has stayed largely the same. Just think, the new technology at the time was the fax machine. The internet and our connected world has changed the way information is created, stored, used, and accessed. And our laws need to change as well.

The status quo isn’t good enough

Two years ago, during the campaign period for our last provincial election, we asked each political party about their plans to update BC’s FIPPA. We asked the New Democratic Party (NDP) if they would include a duty to document within the FIPPA and if they would create penalties for those who interfere with information rights.

In response to both questions, the NDP unequivocally committed to including a duty to document within the FIPPA, and to creating penalties for those who interfere with information rights.

Today, over two years later, we’ve seen no action towards realizing these commitments. In fact, while the government celebrated legislative changes to the Information Management Act as improvements to “transparency and accountability to British Columbians,” they were being accused of breaking the very laws they are mandated to uphold.

The Information and Privacy Commissioner for BC, Michael McEvoy, released this statement about the legislative changes to the Information Management Act and the serious accusations facing government:

‘As it now stands, the Information Management Act designates the Minister herself as primarily responsible for ensuring her Ministry’s compliance with the duty to document its decisions. Citizens would find it very surprising that, on its face, the current law makes a Minister responsible for investigating their own conduct. This is unacceptable and falls short of the independent oversight required to ensure public trust and accountability.’

The tragic irony of the situation seems to be lost on government. Serious accusations of wrongdoing, the kinds that have been recently levelled against a government Minister, cannot be appropriately investigated by that very same Minister.

If British Columbians are to truly have improvements to government “transparency and accountability” then what is needed is independent oversight. The FIPPA creates a regulatory framework within the Office of the Information and Privacy Commissioner, one that operates separately from government.

To keep its promise, and to truly increase “transparency and accountability to British Columbians,” the government must assign independent oversight to the Office of the Information and Privacy Commissioner by creating a duty to document within the FIPPA.

What is a ‘Duty to Document’?

A duty to document is quite simple and something that the original writers of the FIPPA did not think would be necessary to include in the legislation. It’s the idea that government must record their decision making process, which is fundamental principle to functional freedom of information laws.

For example, if someone were to request documents related to a new tax that government was requiring of citizens, that request would not be successful if no records were to exist. The duty to document would compel government to document their decision making process so that citizens can exercise their information rights, like the right to know.

The original lawmakers who drafted the FIPPA did not anticipate that government would hold meetings in person and over the phone without writing anything down (a phenomenon known as ‘oral government’), use personal email addresses to conduct government business, and maliciously delete records in order to circumnavigate freedom of information laws (a practice known as ‘triple-delete’).

But unfortunately that is now the reality in which we are living.

We are not alone in calling for a duty to document. The all party special legislative committee that reviewed the FIPPA in 2016 made the specific recommendation to include a duty to document within the FIPPA. That committee included BC’s current Attorney General, David Eby.

In addition, Information and Privacy Commissioners in BC have called for the inclusion of a duty to document within the FIPPA. Elizabeth Denham, in her report, Access Denied wrote:

‘Government should create a legislative duty to document within FIPPA as a clear indication that it does not endorse “oral government” and that it is committed to be accountable to citizens by creating an accurate record of its key decisions and actions.’

And BC’s current Information and Privacy Commissioner, Michael McEvoy, has written this:

‘It is time for government to amend FIPPA to ensure that the vitally important duty to document has the oversight of my office, which is independent of government. The public interest requires this’

Yet despite these calls, the government has failed to act on their promise to protect the information rights of British Columbians.

We need your help

So after two years of government inaction, distraction, and obfuscation, we are inviting the public to join our call for the government to keep its promise of reforming FIPPA. We have included four main points; the inclusion of a duty to document within FIPPA is just the beginning. Over the coming months, we’ll expand on the other points.

If you are interested to learn more about the FIPPA, and our role in getting the legislation passed, check out our podcast. We have an episode on the history of the Act and an episode on the duty to document.

But the most important thing that you can do, is to add your name to our petition and voice your support for the privacy and information rights of British Columbians.

Support information and privacy rights for British Columbians today