Privacy Protection Still Fundamentally
Human Rights Issue 1

Le Gouvernement du Canada a l'intention d'établir une législation d'ici l'an 2000 visant la protection de la vie privée dans le secteur privé. De cette manière, la politique canadienne sera conforme à celle de la plupart des pays développés. Le Canada devrait en même temps adopter une politique destinée à promouvoir la dignité humaine, l'individualité et la liberté, et devrait éviter le modèle économique/de marché favorisé aux États-Unis où la protection de la vie privée est habituellement laissée au respect volontaire du secteur privé.

"By the year 2000, we aim to have federal legislation on the books that will provide effective, enforceable protection of privacy rights in the private sector." So said Justice Minister Allan Rock, at the 18th Annual Conference of the Privacy and Data Commissioners hosted by Federal Privacy Commissioner Bruce Phillips last week in Ottawa.

The announcement didn’t receive much media attention, though it is highly significant. Such legislation could have profound consequences for any organization that processes personal data in Canada. The legislation will, no doubt, require all businesses to alter the ways in which they collect, store, process and disclose personal information. It will require firms to be far more open about the purposes for which they collect personal data, far more careful in applying security safeguards, far more ready to respond to individual complaints and requests for personal data, and far less prone to disclose information for purposes other than those for which it was collected. According to Rock, this will require a "revolution in thinking similar to that which has taken place in regard to environmental protection."

In fact, such legislation will only serve to bring Canadian policy into line with most developed countries. Twenty-three countries were represented at the Ottawa conference. The vast majority have comprehensive privacy legislation, overseen by privacy or data protection agencies that perform a variety of regulatory, educational, advisory, and quasi-judicial roles. What began as a small movement in the 1970s is now an increasingly institutionalized international gathering attended by large numbers of observers from many countries and walks of life.

The consensus of this and other meetings of privacy experts is that law is just one, albeit essential, component of the solution to the privacy problem. We also need codes of practice and certifiable standards (such as that just negotiated through the Canadian Standards Association); we need education of consumers, governments and business; we need the intelligent development and application of privacy-enhancing technologies to build anonymity into the heart of data collection processes; and we need a more open public and media debate that goes beyond slogans and horror stories about "Big Brother."

But beneath the international goodwill and consensual rhetoric about the importance of privacy, there exist some profound disagreements and contradictions. The most notable concerns the increasingly isolated position of the United States. Now that Canada and Australia have declared their intention to develop comprehensive legislation, the incoherent and incomplete U.S. response is exposed to international criticism.

U.S. officials still insist that the U.S. is "different" and that Americans would never tolerate the prospect of a government agency looking after their privacy interests. Besides, the hodgepodge of statutory provisions at the federal and state levels amount to the same level of protection as that afforded by European laws. These rationalizations begin to sound increasingly hollow and self-serving the more countries jump on the privacy protection bandwagon.

Much of the explanation for the U.S. reluctance to take this issue seriously is explained by a pervasive belief that privacy protection is in the interests of business and therefore will emerge as a result of consumer demands and market responses. Indeed, many from other countries would insist that business has everything to gain and nothing to lose by enthusiastically embracing privacy as an essential component of corporate responsibility. This was the central message of John Gustavson, president of the Canadian Direct Marketing Association, the only business group so far publicly to call for national legislation.

A more skeptical attitude would lead to the position that privacy is only sometimes in business interest and that the economic pressures and technological potential of the digital economy will produce irresistible incentives to continue viewing personal information as a resource, and privacy protection as only useful insofar as it helps to ensure some consistent "rules of the road" or a "level playing field."

The consensus about the profound importance of privacy law and the privacy commissioners in western societies overlooks a deeper philosophical contradiction between a human rights model of privacy protection and an economic/market model. Is the aim to protect a fundamental and non-negotiable human right, or to correct for a market failure in which business can make money from the collection, processing and trading of personal data without compensating the "owner" of that information? Is privacy policy designed to promote human dignity, individuality, liberty, or is it to produce a more level playing field for business?

The distinction is more than philosophical. It is reflected in the fact that responsibility for privacy protection policy in Canada is shared by the departments of Justice and Industry. The former tends to be attuned to the human rights aspects of the issue, the latter to the economic aspects. The paradox of Canadian policy is that the issue has been pushed to the level of a "high priority" (to use Rock’s words) for government by economic considerations and by the need to build a secure "information highway" upon which Canadian enterprises and consumers can travel with confidence. But this agenda should not now be allowed to overshadow the essence of privacy as a human right, central to European conceptions of the problem.

Most importantly, we need to resist the position that the privacy problem is caused by technological intrusions at this year’s conference--genetic data banks, biometric identifiers, smart ID cards, data warehousing and data mining, video-surveillance, etc. It is very easy to become deeply pessimistic about privacy in the light of this onslaught, and profoundly cynical about the capacity of government to tackle the issue.

Privacy intrusions can occur when technology works perfectly and when it is at fault. They can occur through human ingenuity and through human error. We must always remember that technology is not just a tool, it is a practice. It is profoundly embedded within and shaped by our social, political and economic institutions with all their dependency on human and organizational fallibility.

The debate in Canada will now move to questions of method. How to ensure compliance to privacy principles without establishing an overly rigid and bureaucratic enforcement structure? How to integrate these new responsibilities into existing oversight mechanisms? How to get the provinces to agree?

Privacy now also becomes a regulatory, administrative and indeed constitutional problem--in addition to an economic and technological one. But the issue is about protecting the rights of people, and promoting social justice. Most especially, the government should view the subject in those terms.

Notes

Colin J. Bennett, "Privacy Protection Still Fundamentally Human Rights Issue" Government Information in Canada/Information gouvernementale au Canada 3, no. 1 (1996).
<http://www.usask.ca/library/gic/v3n1/bennett/bennett.html>
Back to text.

[2]