When it comes to emerging online and digital media technologies, Ontario’s Information and Privacy Commissioner, Dr. Ann Cavoukian, wants the provincial government and industry leaders to protect privacy and ensure greater data accountability.
She calls for both legislative changes and technological innovation to help out.
From physical video surveillance procedures to the latest online social media networking app, the Commissioner says government legislators, device manufacturers, service providers and end users should all contribute to the protection of online privacy and personal data.
Cavoukian’s comments came with the official release of her office’s 2008 Annual Report.
In particular, Cavoukian says that “transformative technologies" - what she calls ‘TransTech’ - can be used to embed or build in privacy protection measures into a technology, transforming it from what was previously an invasive technology into a privacy enhancing technology.
She cites a terrific locally-developed example, known as “secure visual object coding.”
It is applied to video surveillance cameras, such as those found on city streets, in public transit facilities, and so on.
Once implemented, the coding process only lets a camera ‘see’ an outline of a person in a given situation. No personally identifying characteristics are available, thanks to the encryption capabilities of the application.
But, should law enforcement or some other authorized entity require more visual detail, such as when investigating a potential crime, the visual information can be decrypted.
Cavoukian recommends that a two-signature sign-off, one being that of the police chief or designate, be required before such decryption is allowed.
She notes with enthusiasm that it was at the University of Toronto where engineering Professor Kostas Plataniotis and student Karl Martin developed this transformative privacy-enhancing approach to video surveillance.
Any identifying information captured by a surveillance camera equipped with their solution will be stored completely separately from the background visual information, and the two elements can only be combined with an approved decryption key.
Cavoukian said that in certain pilot projects, such as one conducted in the downtown Toronto entertainment district, her office worked with the Toronto Police Services, to address other issues connect with video surveillance, such as data retention.
“It’s an on-going saga,” she described. “Not just with the Toronto police, but all police forces resist attempts to either release information, or to destroy records” over time. She said 72 hours, not two or three weeks, was her recommendation for retaining video surveillance imagery in the pilot project.
It is self-revelation of data, as well as data retention, which concerns Cavoukian in so far as social media and online activity.
“This day and age, where information is increasingly out there, and accessible to multiple parties, it can come back to haunt you,” she says. “I don’t disapprove of online social networking – we have worked closely with Facebook on privacy controls – but the problem that I have is that people do not understand the consequences of revealing information they willingly put out there.”
She notes that 77% of all employers check out people’s profiles Facebook, and a full third will reject people based on apparently inappropriate Facebook postings.
Cavoukian has said that “posting your personal information on a social networking website without considering your privacy options is like crossing the street without looking both ways.
“Neither is advisable.”
However, as much if not more of an issue than data self-revelation is data ownership.
Social networking sites such as Facebook will claim ownership of data and information posted to their platforms, under current user agreement policies.
This is disconcerting enough for individuals posting information, pictures or other digital data online, but is can be a business breaker for organizations using social networking tools.
Philip King, President and CEO of Artez Interactive, is both a user and provider of such services.
Toronto-based Artez supports the work of not for profit and charitable organizations, and their initiatives with online fundraising.
It’s a big and growing field, perhaps most recently and best exampled by the use of social media in the recent U.S. elections, during which the Obama campaign in particular made great use and had great results from its use of the Web and social networking capabilities.
But, said King, “We deal with this (data protection and privacy issues) on every day. It’s a huge topic, and it’s only going to become bigger as we continue to drive to online systems.”
(King spoke during an online panel discussion about the many organizations now using Web 2.0-type social networking tools. The Future of Web 2.0 Fundraising panel was an initiative of IGLOO Software, the Waterloo, ON-based solutions provider for social communities online. RIM’s Jim Balsillie is Chair of the IGLOO board.)
He spoke not only of the concerns of credit card companies, and the need for payment card industry standards and best practices for the gathering and retention of such information, but also of the crucial issue of data ownership.
“There’s an app called Facebook Connect that links people to the system, but the issue is that Facebook owns the data, not the charity or user organization. The convenience provided to a registrant to be able to use the system means Facebook owns the data. It’s an on-going challenge," he said.
It’s the type of challenge that Commission Cavoukian wants to take on. Her ‘Privacy by Design’ initiative is one way to do so.
Privacy by Design embodies the notion of embedding privacy into technology itself – making it the default, not the exception. Privacy by Design helps create the transformative technologies such as those described in the Annual Report.
“Embedding privacy into technology in a proactive way, before the fact, moves you beyond compliance,” Cavoukian says of the incentive for business to engage in the concept. “Complying is after the fact; this is preventing privacy abuses before hand.”
The Information and Privacy Commissioner is appointed by and reports to the Ontario Legislative Assembly, and is independent of the government of the day. The Commissioner's mandate includes overseeing the access and privacy provisions of the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act, as well as the Personal Health Information Protection Act, which applies to both public and private sector health information custodians, in addition to educating the public about access and privacy issues.
Top of page