Beyond Consent-based Privacy Protection: My submission in response to the OPC’s consultation on privacy and consent

The Office of the Privacy Commissioner (OPC) has recently published a great discussion paper entitled “Consent and privacy” exploring potential enhancements to consent under PIPEDA. The OPC also launched a Consultation and Call for Submissions requesting input on its consent paper, asking whether legislative changes are required, and requesting comments  on solutions which would be helpful in addressing consent challenges.

I have submitted to the OPC my position paper entitled “Beyond Consent-based Privacy Protection” which is meant to address some of these issues raised by the OPC and address the viability of the consent model. In my paper, I discuss how, at the time that the FIPPs (Fair Information Privacy Practices) were initially drafted in the early 1970s, their main purpose was to address specific concerns pertaining to computerized databases. The best way to deal with these data protection issues was deemed to be having individuals keep control of their personal information. Forty years later, that self-concept is still one of the most predominant theories of privacy and the basis for data protection laws around the world, including PIPEDA. I explain how the “notice and choice” approach is no longer realistic: Individuals are overloaded with information in quantities that they cannot realistically be expected to process or comprehend. Moreover, providing notice and choice in the context of new technologies can be challenging due to the ubiquity of devices, persistence of collection, and practical obstacles for providing information, if devices lack displays or explicit user interfaces.

I argue that before amending PIPEDA on consent, one should be careful to make sure that the amendment will not be detrimental or problematic as soon as new technologies emerge. I believe that the wording pertaining to obtaining consent under PIPEDA is flexible enough to accommodate new types of technologies and business models. Another argument against amending PIPEDA pertains to the fact that social norms in connection with any new technology or business practice may not yet be established.

The downside of the flexibility surrounding the notion of consent is that it creates uncertainty. Policy guidance on enhancing transparency and obtaining valid consent will therefore be increasingly necessary to address some of this uncertainty and allow organizations to innovate without taking major legal risks. Businesses may well benefit from more OPC guidance when new types of technologies or business models make their way.

I discuss in my paper that it is always less disturbing to provide a solution which will be incorporated within the current legal framework, such as a proposed interpretation, than to propose a new amendment to the law. The notion of “consent” under PIPEDA is already quite flexible and is technology-neutral, allowing for this notion to be interpreted with the proper balance between the protection of privacy and the need or organizations to collect, use or disclose personal information for the purposes that the reasonable person would consider appropriate in the circumstances. I am of the view that any interpretation of the notion of consent should consider any impact on innovation, as well as certain new ethical issues that may, to a certain extent, go beyond the current application of PIPEDA.

I also raise that an interpretation which includes a risk-based approach may also allow organizations to streamline their communications with individuals, reducing the burden and confusion on individual consumers. Although this new approach would imply rethinking, to some extent, PIPEDA’s current consent model, I maintain that this approach should be further explored in the near future.

To read my submission on the viability of the consent model, please click here.

An earlier version of this paper was submitted to Innovation, Science and Economic Development Canada in March 2016. The views expressed in the paper are not necessarily those of Innovation, Science and Economic Development Canada or of the Government of Canada.

For others that wish to submit their views on this topic, please note that the deadline to submit comments in response to the OPC’s Consultation and Call for Submissions has been extended until July 31, 2016. 

This content has been updated on February 6, 2017 at 21 h 57 min.