Skip to main content
The Globe and Mail
Support Quality Journalism
The Globe and Mail
First Access to Latest
Investment News
Collection of curated
e-books and guides
Inform your decisions via
Globe Investor Tools
Just$1.99
per week
for first 24 weeks

Enjoy unlimited digital access
Enjoy Unlimited Digital Access
Get full access to globeandmail.com
Just $1.99 per week for the first 24 weeks
Just $1.99 per week for the first 24 weeks
var select={root:".js-sub-pencil",control:".js-sub-pencil-control",open:"o-sub-pencil--open",closed:"o-sub-pencil--closed"},dom={},allowExpand=!0;function pencilInit(o){var e=arguments.length>1&&void 0!==arguments[1]&&arguments[1];select.root=o,dom.root=document.querySelector(select.root),dom.root&&(dom.control=document.querySelector(select.control),dom.control.addEventListener("click",onToggleClicked),setPanelState(e),window.addEventListener("scroll",onWindowScroll),dom.root.removeAttribute("hidden"))}function isPanelOpen(){return dom.root.classList.contains(select.open)}function setPanelState(o){dom.root.classList[o?"add":"remove"](select.open),dom.root.classList[o?"remove":"add"](select.closed),dom.control.setAttribute("aria-expanded",o)}function onToggleClicked(){var l=!isPanelOpen();setPanelState(l)}function onWindowScroll(){window.requestAnimationFrame(function() {var l=isPanelOpen(),n=0===(document.body.scrollTop||document.documentElement.scrollTop);n||l||!allowExpand?n&&l&&(allowExpand=!0,setPanelState(!1)):(allowExpand=!1,setPanelState(!0))});}pencilInit(".js-sub-pencil",!1); // via darwin-bg var slideIndex = 0; carousel(); function carousel() { var i; var x = document.getElementsByClassName("subs_valueprop"); for (i = 0; i < x.length; i++) { x[i].style.display = "none"; } slideIndex++; if (slideIndex> x.length) { slideIndex = 1; } x[slideIndex - 1].style.display = "block"; setTimeout(carousel, 2500); }

A smartphone user.

Dado Ruvic/Reuters

A range of critics, including the office of Canada's privacy commissioner, is urging the Conservative government to change its digital privacy bill, warning it will open the door to private companies swapping personal information of clients and others without any consent or notification.

Bill S-4 is aimed at overhauling the rules for online privacy, giving new power to the Privacy Commissioner and introducing new penalties for privacy breaches. Parts of it have broad support, and it is one of a handful of new bills before Parliament with implications over how Canadians' private online information can be handled and shared.

In Senate testimony, however, experts have broadly opposed a provision in the bill allowing private companies to voluntarily share data between them – without telling those people or the commissioner whose personal information is being swapped – to investigate whether a law or "agreement," such as a contract, has been broken.

Story continues below advertisement

Experts fear that will open the floodgate to warrantless data-sharing with only a nominal threshold to justify it.

The change "could lead to excessive disclosures that would be invisible both to the individuals concerned and to our office," Patricia Kosseim, the privacy commissioner's senior general counsel and director general, said to a Senate committee Wednesday evening, urging government to reconsider the amendment. Ms. Kosseim spoke to the committee in the absence of a commissioner; Daniel Therrien was approved as Canada's next commissioner in a vote the next day.

Michael Geist, the Canada Research Chair of Internet and E-commerce Law at the University of Ottawa, echoed the call to do away with that part of the bill. "The provision opening the door to massive expansion of warrantless non-notified voluntary disclosures should be removed from the bill," he said.

In other testimony, John Lawford of the non-profit Public Interest Advocacy Centre said the bill's data-sharing provision could conceivably lead to companies issuing blanket requests for data from another company. "That's fishing and it's completely unprecedented," Mr. Lawford said.

The Marketing Research and Intelligence Association also criticized the data-sharing proposal, with Annie Pettit, the association's chair of publications, telling the committee such sharing should require legal oversight, such as a court order.

Government officials have said there's no evidence that company-to-company data sharing is occurring in other jurisdictions where laws allow it, and Industry Minister James Moore, who is leading the government's push to pass the bill, has said companies must follow rules on disclosure.

"These rules ensure that information is only released when there is a reason to believe the law has been broken, the investigation would be compromised by notifying the individual and that only information needed in the investigation is released. If a company breaks these rules, the privacy commissioner can take legal action," he said in a statement on his website. In response, the privacy commissioner's office said it simply won't know about many of the cases, while Mr. Geist said it was hard for someone to take legal action without knowing a disclosure took place.

Story continues below advertisement

Mr. Geist supported other parts of the bill. Those include clarification about what companies need to do to get consent online – such as through terms-of-use agreements – from people, particularly children. "Consent is meaningless if the person doesn't understand to what they are consenting," he said. He supports a provision allowing the commissioner to essentially "name and shame" companies who breach privacy, and the bill's proposed expanded timeline for a commissioner to take a company to court in the case of a complaint.

However, he criticized the data sharing provision, and called for government to require companies to disclose more breaches to the commissioner – currently, the bill only requires disclosure in cases where there is a "real risk of significant harm." He said that will lead to "significant underreporting of [privacy] breaches" and called for a lower threshold.

Mr. Geist also called on government to give the commissioner more powers, including applying cash penalties.

He cited a "glaring omission" in the bill – no mention of the warrantless disclosures, such as those from telecommunications companies to law enforcement. "In my view, this creates victims of us all – disclosure of our personal information often without our awareness or explicit consent," he said. He said law should require organizations to publicly disclose the number of disclosures they make, each quarter, as well as requiring companies to notify people whose information has been handed out, expect if it would affect an active investigation.

Wally Hill, a senior official with the Canadian Marketing Association, said the bill's requirement that companies keep records of all data breaches indefinitely is too broad. "We believe the legislation should be amended to clarify the scope," he said, suggesting it be kept for two years.

Mr. Moore spoke to the committee last week, saying the bill was produced with more consultation than previous versions, C-12 and C-29. He noted the interim privacy commissioner applauded parts of the bill shortly after its tabling.

Story continues below advertisement

"The way in which we've brought this forward after having consulted, I think, more effectively is something that's been well received," Mr. Moore told senators considering the bill. "…What we're trying to do is put in place an accountability system for organizations so they take care of information, so that they're careful."

In the end, Mr. Moore said users have some responsibility to know what they're consenting to online. "Be careful what you click," Mr. Moore told senators.

Bill S-4 is currently before the Senate and has yet to go through the House of Commons, and won't become law before fall.

Report an error Editorial code of conduct
Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

Comments that violate our community guidelines will be removed.

Read our community guidelines here

Discussion loading ...

To view this site properly, enable cookies in your browser. Read our privacy policy to learn more.
How to enable cookies