I submitted them about a week ago. They perhaps didn't come through translation.
It perhaps goes without saying that computers, databases, networks, surveillance cameras, cookies, spyware, radio frequency identification, and other automated means of collecting, using, and disclosing personal information directly threaten our ability to control personal information.
You've heard about this from many of your previous witnesses. I have significant expertise on these issues, and I'm happy to provide more information about any of them for you, if you wish, during the question period.
My testimony today, however, will be to suggest that there is a much bigger threat to privacy that comes from a much more primitive and much more basic technology. It is a technology that all of you are familiar with, even those of you, like our honourable chair, who avoid computers, PDAs, and the Internet like the plague.
The threat I'm referring to is in fact a legal threat.
In French it is called the “contrat d'adhésion”.
In English, we call it the standard form contract.
While computers, surveillance cameras, and RFID chips technologically enable aggressive, voluminous, and sometimes surreptitious collection of information, it is the standard form contract that legally enables the so-called “implied consent”, “deemed consent”, and “opt-out” consent-gathering processes that are said to justify the use of surveillance technologies under our current privacy law. These means of using the law to deem consent, when there is in fact none, can be highly problematic.
Standard form contracts are mass-produced documents that prevent and preclude negotiation and agreement. They are drafted exclusively by parties in an economic position to offer them on a take it or leave it basis. In an information age, where the business handshake has been replaced by mouse clicks, where the bilateral negotiation process is supplanted by global, one to many transactions, the standard form contract is regularly invoked by organizations to circumvent various privacy protections prescribed by PIPEDA and other data protection regimes.
Whether in the sale of goods or the licensing of services, many organizations use standard form contracts, clickwraps, and end-user licence agreements as ways to justify what is sometimes an unreasonable and overarching so-called consent to excessive collection, use, and disclosure of personal information. Through these sometimes one-sided contracts, organizations are able to extend their personal information practices well beyond the bounds of what might otherwise be permitted by Canadian privacy law. They do this by compelling consumers, customers, and citizens to sometimes contract out protections that would otherwise be afforded through PIPEDA.
In my written submissions, which I guess you don't have in front of you, I offer a series of detailed recommendations on how to amend PIPEDA in light of these, to fix the enormous problems of obtaining genuine consent that are generated by the contractual model.
I am happy to answer any questions you might have on those, but let me first provide you with two crunchy examples that should hit close to home.
Example number one. As a member of Parliament, your job, like mine, requires you to stay in one of Canada's nearly 400,000 hotel rooms from time to time. Maybe you need to send some documents or check your e-mail while you are there. To use a hotel's Internet services, you'll be required to agree to its terms of use. On a recent work-related trip, I stayed at a Hilton Hotel. While there, I needed to use the Internet. Here is what I'm said to have consented to when I plugged my computer into the Hilton's Internet connection:
We automatically track, collect and compile User Information and Transaction Data (as defined below) when you utilize the Site.
...
You agree that HHC shall own all Information.
By accessing the Site, you voluntarily, expressly and knowingly acknowledge and agree with all of the foregoing and further agree to each and all of the following: (i) such Information belongs to HHC and is not personal or private proprietary information; (ii) such Information, wherever collected, may be processed, used, reproduced, modified, adapted, translated, used to create derivative works, shared, published and distributed by HHC in its sole and absolute discretion in any media and manner irrevocably in perpetuity in any location throughout the universe without royalty or payment of any kind, without, however, any obligation by HHC to do so;
....
So instead of me, let's imagine that the honourable member, Mr. Tilson, stayed at the Hilton Hotel and sent an e-mail to his colleague, Mr. Wallace, an e-mail containing some communications perhaps about these committee deliberations, perhaps about some more personal things.
Under the terms of service referred to above, Hilton will claim that the personal information and private communications generated by these two honourable members is in fact not personal or private information, by way of their consent, and it is therefore not subject to PIPEDA, and that in fact Hilton owns the information in perpetuity, anywhere in the universe. As David Bowie might have once sung, “Planet Earth is blue, and there's nothing you can do”.
According to Canadian contract law—and I've been teaching it for more than ten years—I suspect that Hilton would likely prevail. Regardless, most individuals would be forced into submission during a lengthy and protracted litigation process in the courts about what is certainly, at this point, an unclear point in the law. I recommend we clarify the law with this.
Example number two. Like me, everyone around this table is a consumer of many intellectual products every day. You read the newspaper, specialty magazines or books, or maybe you watch TV, movies, or listen to music or talk radio. If you are like me, sometimes you don't care who knows what you are reading about or listening to, and sometimes you probably do, but l'II bet that you would care a lot if you learned that someone was always able to know about every single intellectual product that you consumed: how often, where, when, etc. Everyone around this table, I suspect, cares about intellectual privacy, the ability to consume intellectual products free from public scrutiny and corporate or governmental surveillance.
Imagine that you go out and buy a CD or DVD, or maybe you borrow it from the library. You put it into a device that you own and you play it. You watch or you listen. All the while, unknown to you, a small software routine written into the code of that CD or DVD causes an automated communication via your wireless Internet connection. The CD or DVD reports back to Sony--or whoever--who you are, where you are, what machine you use, which software you run, what you are watching or listening to, when you watched or listened, how often, etc.
By now in the course of these proceedings, and having heard many witnesses, you are, I suppose, no longer surprised by the realities of the digital age, but here is something that might surprise you.
You decide to investigate whether the company's practice infringes on your privacy rights under Canadian law. You come to learn that it probably does not, or at best that the law is unclear with respect to any of this. In fact, you come to learn that you have probably legally consented to letting the CD phone home and rat you out to the mother ship. ln the standard form contract of more than 3,000 words--which, by the way, is about 700 words more than it took Edgar Allen Poe to tell the tale of the thousand injuries of Fortunato--52 words provide your so-called consent to the automatic installation of a rootkit; Sony calls it “a small proprietary software program”.
Because of this provision, the organization collecting your personal information will claim that you have contracted out of the protections otherwise afforded to you under PIPEDA. According to their agreement, you also supposedly consented to allow them and their information-sharing partners to give that information to any member of the government who makes a request, without a court order and without any form of due process--and there is nothing you can do about it.
The main point I want to impress upon this committee today is that this form of legal manoeuvring--something that each and every one of us around this table is subject to multiple times each and every day--is hugely problematic and is not sufficiently addressed in PIPEDA. Standard form contracts, as well as a number of other so-called consent-gathering processes, can sometimes--not always, but sometimes--undermine the nature and value of genuine consent, and in those instances will fly in the face of what our privacy laws are actually trying to achieve.
I would submit that PIPEDA's attempt to balance individual privacy rights with the needs of organizations to collect personal information is undermined if--irrespective of PIPEDA's many protective provisions--intrusive, unfair, or unwanted collection, use, or disclosure can be imposed on individuals with impunity through standard form contracts or other similar so-called consent-gathering processes such as those used in the past by Sony, by Hilton and other hotels, by instant messaging services, by mobile phone providers, by other online service providers, by health care providers, etc. I can assure you this same strategy is used often and with great success in other sectors as well, all of which tells us we do need much tighter sets of consent provisions than those currently provided in PIPEDA.
ln my written submission, I offer concrete recommendations to fix this. If I have another thirty seconds, I'll go on the record to lend my support for other recommendations that have been made by other witnesses. In particular, the law should be amended to provide the federal Privacy Commissioner with order-making power; the law should remove any lingering doubt about the power of the federal Privacy Commissioner to regularly name names in well-founded findings; the law should include a mandatory security breach disclosure requirement; and finally, Ottawa must seriously begin to address the growing concern in Canada over the outsourcing of personal information to non-Canadian organizations, particularly data flows to the United States.
I know there is no time to address these points now, but I am happy to respond to any questions you might have.
Thank you very much for your time.
