Official Blog of the Office of the Privacy Commissioner of Canada

19 Jun 2014

Mind the gap: Poll finds many Canadian businesses believe privacy is important but not taking basic steps to protect customer information


Ten years after Canada’s private sector privacy law came into full effect, our latest survey has found that many Canadian businesses are still not taking the basic steps necessary to protect the personal information of their customers and clients – despite believing that protecting privacy is “extremely important”.

An overwhelming majority of businesses (82%) said protecting privacy is important—in fact 59% rated it as “extremely important.”  As well, more than two-thirds (69%) indicated they were “very confident” in the ability of their business to protect the personal information they collect about customers.

However, the telephone survey of 1,006 companies across Canada identified serious gaps in basic privacy protection by businesses both large and small, for example:

  • More than half (55%) do not have a privacy policy;
  • Half (50%) do not have procedures for responding to customer requests to access their personal information;
  • Nearly half (49%) do not have procedures for dealing with privacy complaints; and
  • More than two in five (42%) have not designated an employee responsible for ensuring privacy protection.
  • Two-thirds (67%) have no policies or procedures for assessing the privacy risks of new products, services or technologies.

The survey, carried out in November 2013 by Phoenix Strategic Perspectives of Ottawa, also found that 59% of the surveyed businesses have little or no concern about the prospect of a data breach. Despite numerous high-profile media reports of data breaches in the private sector over the past few years, the number of businesses indicating a lack of concern about data breaches has increased over time to 59% from 49% in 2011 and 42% in 2010.

In addition, 58% of the businesses surveyed had no guidelines for dealing with a breach where the personal information of their customers was compromised.

We commissioned the survey, which is considered to be accurate to within +/- 3.1%, 19 times out of 20, in order to better understand the extent to which businesses are familiar with privacy issues and requirements, and the types of privacy policies and practices they have in place. Similar surveys were conducted in 2011, 2010 and 2007.

What do you think – are businesses doing an adequate job of safeguarding customer information? What challenges do they face in protecting privacy? Let us know in the comments.


20 Sep 2013

An update on our Internet privacy sweep


Last month, we released the initial results of our Internet privacy sweep. You can read the original blog post to see what we observed. (We should note here that the screenshots and references in that blog post reflect what we saw online during the sweep and were still in place when we originally blogged about the sweep results on August 13.)

As part of our efforts on the sweep, our Office advised the companies that were mentioned in the blog, inviting them to contact the OPC if they wished to discuss the Sweep and our observations.

Since that original post, we are very pleased to see that some of the organizations we highlighted have made changes to enhance their online privacy policies.

A&W changed its privacy policy shortly after we issued the results of our Privacy Sweep. Their original 110-word privacy policy has now been expanded to just under 1600 words and covers the collection, use, disclosure and retention of customers’ personal information collected through customer feedback, events, gift card purchases and contests.

Bell Media also updated their privacy policy shortly thereafter, fixing the broken link to their Privacy Officer’s email address:

 New Bell Media privacy policy

We think customers will be pleased as well to see that the companies they choose to do business with are more open and straightforward about how they use customer information.

Hopefully other companies we looked at, as well as those that didn’t, will take note.


21 Aug 2013

Privacy Pop – Privacy in art


Surveillance, identity, social networks and big data are all compelling subjects for an artist to explore  – in fact, IAPP has already combined art and privacy through its Navigate event mashing up art interventions with provocative talks on the future of privacy, and a presentation by their president Trevor Hughes on top privacy issues in which he marries each trend with a compelling piece of modern art.

Inspired, we decided to put together our own list of artistic discoveries we’ve culled from around the Internet.

Steganosaur by Charis Poon

New York-based artist Charis Poon created the playful Steganosaur, an interactive work that allows users to create encrypted messages and share them with friends. She writes, “Because the encryption is a colorful geometric pattern, someone could potentially display it physically or digitally anywhere and have others perceive it as simply a design. The author knows, privately, to themselves, the true meaning.”

Lorrie Faith Cranor's D-'identification quilt

Privacy geeks know Lorrie Faith Cranor (that’s her, above) as a computer science professor and privacy and security researcher at Carnegie Mellon. She’s also an accomplished quilter who has explored combining art with ways to visualize privacy and de-identification. Her De-identification quilt was sliced, spliced, re-assembled, overlaid, embroidered, hand-quilted and machine-quilted but, as Cranor writes, “It is a lot like personal data de-identification, in which data is removed and digital noise is introduced, but in the end the de-identified data might be re-identified given sufficient contextual information.”

And while we’re on the subject of fabric art, when Facebook built a new data centre in Prineville, Oregon they invited the local quilters at the Prineville Senior Center to create quilts depicting how Facebook connects the world.

Laurent Grasso's Uraniborg

French artist Laurent Grasso’s innovative exhibition Uraniborg, is named after the observatory built and operated by Danish astronomer Tycho Brahe. The exhibition itself is housed in a labyrinth built by the artist featuring artifacts examining themes of control and surveillance, such as the short film shown above, featuring a camera-equipped falcon – a parallel to modern-day drone technology.

Adam Harvey's Stealth Wear

Who says privacy isn’t fashionable? Artist Adam Harvey has designed a line of Stealth Wear that employs design and specialized materials to shield the wearer from being detected and recognized by surveillance technologies. He was compelled to develop the line as a response to the increasing use of domestic surveillance drones in the U.S.: “Data and privacy are increasingly valuable personal assets and it doesn’t make sense to not protect them.”

Arne Svenson's The Neighbours

Taken from his own home in New York City, Arne Svenson’s photographs in The Neighbors are the result of the artist pointing his lens at the floor-to-ceiling windows of the building across the street. As a recent review of the controversial exhibit points out:

“That is the power of Svenson’s art: it challenges the artificial lines we draw around the public and the private, especially in a place where true privacy is a luxury. It also shines a light on the fact that for the many in this city who live in luxury, part of the appeal is in its display.”

In a similar vein, Anthony Reinhart and Darin White of Kitchener, Ontario have examined the prevalence of inconspicuous and ubiquitous surveillance in the photography exhibit, DISCONNECT.

Trevor Paglen's The Other Night Sky

Artist and geographer Trevor Paglen has used observational data to track and photograph satellites in a vivid and high-tech method of “watching the watchers”. The photographs that make up The Other Night Sky are other-worldly –enough to tell you something is out there, but not sharp enough to know exactly what it is.

Paolo Cirio's Street Ghosts

And finally, with a nod to street art and graffiti, the Street Ghosts project brings life-sized pictures of people found on Google Street View to the same spot where they were taken. The result is a jarring juxtaposition of the virtual and the real, or as artist Paolo Cirio puts it: “The real world of things and people, from which these images were originally captured, and the virtual afterlife of data and copyrights, from which the images were retaken.”

So what are some of your favourite artistic expressions about privacy? Let us know in the comments!


13 Aug 2013

Initial results from our Internet Privacy Sweep: The Good, The Bad, and The Ugly


You might recall, a few weeks back our Office led and participated in the first annual Global Privacy Enforcement Network (GPEN) Internet Privacy Sweep.

We sought to replicate the consumer experience by spending a few minutes on each site, assessing how organizations communicated their privacy practices with the public.  The sweep was meant to assess transparency online and was not an assessment of organizations’ privacy practices in general. It was not an investigation, nor was it intended to conclusively identify compliance issues or legislative breaches.

After searching over 300 sites that day, our Office is still poring over the reports we’ve created, but we wanted to share some of our preliminary results with you.

The good:

We found several positive examples of transparency when it came to sharing privacy practices. The best policies were oriented towards the consumer, providing information that real people would actually want to know and would find helpful. Here are a few of our favourites:

Tim Horton’s outlines the different types of personal information they collect and use in relation to a number of activities – for example, when people shop online, enter contests, or register for a payment card. Overall, we found their policy uncluttered and straightforward – click on the screenshot to read this excerpt:

Collection and Use of Personal Information  Tim Hortons collects and uses personal information from customers and others (an "Individual") as follows:     Tim Hortons may collect and maintain personal information such as an Individual's name, contact information, payment card information and purchase history when an Individual subscribes for services or purchases products on our website, in one of our stores or at a kiosk.      Tim Hortons may collect personal information from an Individual where the Individual submits an application for programs operated from time-to-time by Tim Hortons, such as the Tim Hortons Scholarship Program (the "Programs") or for an employment opportunity (such as that contained in a resume, cover letter, or similar employment-related materials). We use submitted personal information as is reasonably required to assess the Individual's eligibility in the Programs and to advertise and promote the Programs or to assess the Individual's suitability for employment at Tim Hortons as well as to process the application and respond to the Individual.     When participating in a contest or promotion, we may collect personal information, such as a contest winner's name, city of residence, and prize winnings in order to award prizes and promote such contests. This information may be published in connection with contests.      From time to time, we may obtain an Individual's consent to use the Individual's contact information to provide periodic newsletters or updates, announcements and special promotions regarding Tim Hortons products and services.

Tripadvisor’s Privacy Policy takes the extra step of offering a detailed explanation of its Instant Personalization feature, which uses information provided by Facebook to give the user a more customized experience. Their explanation not only details what information is collected and how it’s used, but also provides instruction on how to enable or disable the feature – take a look at this screenshot:

We have partnered with Facebook to provide Instant Personalization on TripAdvisor for members of Facebook. If you have Instant Personalization set to “enabled” in your Facebook privacy settings and you are logged into Facebook, then TripAdvisor will be personalized for you when you visit the Web site, even if you are a first-time user of TripAdvisor’s Web site. For example, we will show you reviews that your Facebook friends have posted on TripAdvisor and places they have visited. In order to provide you with this personalized experience, Facebook provides us with information that you have chosen to make available pursuant to your Facebook privacy settings. That information may include your name, profile picture, gender, friend lists and any other information you have chosen to make available.  When you first visit TripAdvisor, you will see an option to turn off Instant Personalization in just one click. If you decide to turn it off at a later date, you can do so by first logging into Facebook and clicking on the disable link on this page, or by scrolling over the “Learn More” link on the top of the page on TripAdvisor and clicking on “How to turn off personalization”. You can also turn off Instant Personalization by editing your privacy settings on Facebook. Please note that, if you have Facebook friends who are using TripAdvisor, they may also have shared information about you with us through Facebook. If you wish to prevent that sharing, you can do so by editing your Facebook privacy settings.   Learn more about Instant Personalization on Facebook or read TripAdvisor’s Instant Personalization FAQ’s.

Also going that extra step is Allstate, which has established an anonymous and confidential reporting system through a third party for its customers to report privacy breaches with discretion.  Promoting and facilitating two-way communication about privacy with consumers is a key element of transparency, so it’s heartening to see that a company like Allstate is thinking about how their consumers might want to communicate with them about privacy concerns.

As part of our ongoing commitment to privacy, we have established an anonymous (optional) and confidential reporting system, so that customers can report any breaches of privacy.  All comments made through this reporting mechanism are considered important to Allstate.  Accordingly, they will be reviewed in a timely manner and, rest assured, with the utmost discretion.    To report any issue relating to privacy concerns, please go online or mail:  ClearView Connects™  P.O. Box 11017 Toronto, Ontario M1E 1N0  1-866-505-9915

Privacy policies that cover both online and in-store practices made our list of bouquets as well. IKEA Canada’s privacy notice points out IKEA’s use of closed circuit television (CCTV) cameras in its stores and parking lots and references their separate CCTV Surveillance Policy, which can be obtained by contacting their privacy officer. Given that many stores and parking lots use CCTV monitoring technology, this example shouldn’t be as rare as it is!

For security, safety and liability purposes, we use CCTV cameras in our stores and adjoining areas such as parking lots. Information recorded by such cameras is retained for a short period (approximately 90 days), unless needed in connection with an investigation. Notices advising of the use of such cameras are posted in our stores. By visiting a store, you consent to our use of such cameras and the recording of your information. For further information regarding CCTV use in our stores, please see IKEA’s CCTV Surveillance Policy, a copy of which may be obtained by contacting our Privacy Office, as provided at the end of this Notice.

The bad:

Approximately 20 percent of sites we reviewed either listed no privacy contact, or made it difficult to find contact information for a privacy officer.

For example several sites, including theloop.ca and tsn.ca, linked to Bell Media’s Privacy Policy which reads in part:

QUESTIONS, COMMENTS OR SUGGESTIONS? If you have questions, comments or suggestions about this Privacy Policy or Bell Media's privacy practices that were not answered here, send us an email.

And that e-mail address is….?

Well, we couldn’t find it.

Many of the websites we looked at spent thousands of words regurgitating PIPEDA but providing very limited information of actual interest to readers. Just as the good examples made an effort to provide clear and useful information to the consumer, the not-so-good stuck to a more legalistic approach and merely claimed compliance to legislation.

For instance, take a look at GlaxoSmithKline’s explanation of how they seek consent for the collection, use and disclosure of individuals’ personal information, below. While their privacy policy hews closely to the language found in Canadian privacy legislation, it’s not all that helpful to a consumer who wants to know when their consent might be sought.  We’ve highlighted the text that appears almost verbatim from Schedule 1 of PIPEDA :

3.PRINCIPLE 3 - CONSENT The knowledge and consent of the individual are required for the collection, use and disclosure of personal information, except where inappropriate. 3.1 The way in which we seek consent, including whether it is express or implied consent, may vary depending on the sensitivity of the information and the reasonable expectations of the individual. An individual may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. 3.2 GSK will typically seek consent for the use or disclosure of personal information at the time of collection, but in certain circumstances consent may be sought after collection but before use. 3.3 GSK will only ask individuals to consent to the collection, use or disclosure of personal information as a condition of the supply or purchase of a product, if such use, collection or disclosure is required to fulfil an identified purpose. 3.4 In certain circumstances, as permitted or required by law, we may collect, use or disclose personal information without the knowledge and consent of the individual. These circumstances include: Personal Information which is subject to solicitor-client privilege or is publicly available as defined by regulation; where collection or use is clearly in the interests of the individual and consent cannot be obtained in a time way; to investigate a breach of agreement of a contravention of the law; to act in respect to an emergency that threatens the life, health or security of an individual; for debt collection; or to comply with a subpoena, warrant or court order.

Huh?

GlaxoSmithKline also offer readers an Internet privacy policy which, in some ways does a better job than their privacy code at explaining how a consumer’s information might be collected and used. However we found this policy, like others we saw during our sweep, focused on the use of cookies and other technical information collected via their site, while not providing enough information relevant to how the organization was collecting and using other types of information about the consumer.

The ugly:

About one out of every ten sites we looked at did not appear to have a privacy policy.

Another 10 percent had a privacy policy that was hard to find – sometimes exceedingly difficult to find, since it was buried in a lengthy Legal Notice or in the Terms and Conditions.

While almost 90 percent of the sites we swept had some sort of privacy policy or privacy notice, some policies offered so little transparency to customers and site visitors that the sites may as well have said nothing on the subject.

For example, A&W Canada, which collects personal information such as photos, addresses and dates of birth for various initiatives, has a 110-word privacy policy tacked on to the very end of the Terms and Conditions that offers nothing but a blanket promise of compliance with the law. While they do provide some other detail with respect to their privacy practices elsewhere on the site, and it is possible for visitors to their site to learn more by contacting their privacy officer through the e-mail address provided, we think organizations can do better. Individuals shouldn’t have to jump through hoops and provide their own personal contact information just to learn what an organization is going to do with their information.

Privacy Policy A&W Food Services of Canada Inc. is committed to protecting the privacy of personal information. Personal information obtained in the course of conducting our business will not be collected, used or disclosed except in compliance with governing legislation, including Canada’s Personal Information Protection and Electronic Documents Act and British Columbia’s Personal Information Protection Act. For further information on our Privacy Policy, contact our Privacy Officer at privacyofficer@aw. We may revise this Privacy Policy from time to time. You are responsible for checking this Policy when you visit our site to review the current policy. If you do not agree with the Policy, you should cease use of the site immediately.

Paternity Testing Centers of Canada, which collects and processes highly sensitive DNA samples of its clients, has a privacy statement so short it would fit in a tweet: “Paternity Testing Centers of Canada care about our clients and ensure that every test performed is strictly confidential.”

Confidentiality Uncertainty about parentage can have life-long psychological consequences. DNA paternity testing is the most advanced and accurate method available for resolving these parentage questions. Paternity Testing Centers of Canada can perform both Legal (court approved) and Non-legal tests. With advanced DNA technology, paternity testing is accurate, rapid and an affordable means for obtaining conclusive answers with respect to parentage. Paternity Testing Centers of Canada care about our clients and ensure that every test performed is strictly confidential.

We wanted to provide you with some preliminary results that stood out to us from our sweep.  Once we’ve completed a review of the results from our Office and the other jurisdictions that participated in the sweep, we will determine any appropriate follow-up action, in conjunction with our international sweep partners.


9 Jul 2013

Safe journey, Bon voyage !


Learn more about privacy at airports and border crossings by referring to the new featured topic, and have a safe journey! 

Canadian border crossing

photo by 12th St David

There’s a common expression that says, “It’s not the destination that counts, it’s the journey.” Well, if you’re like me, when I have to travel—especially with moody teenagers—I get anxious just thinking about all of the hoops I have to jump through before I arrive at my destination. At airports, border crossings and sea ports, there are security screenings everywhere.

Security measures are presented as a trade-off for safer skies for travellers. But that doesn’t mean you have to check your privacy rights with your luggage.

It is important to know that as a Canadian traveller, your privacy rights kick in from the moment you book a flight—online or through a travel agency—and continue on through the airport terminal and into the pre-boarding area.

However, the measures used to ensure your safety make you wonder: where do your privacy rights begin and end? To help you answer that question, the Office of the Privacy Commissioner of Canada (OPC) just posted a new topic page entitled Privacy Rights at Airports and Border Crossings. It contains explanations of the law, describes the impact of security measures on your personal information and privacy rights, and lets you know where you can turn to if you feel your rights have been violated.

The topic page presents all of the OPC’s materials related to airports and border crossings in one place: fact sheets, reports, publications, Parliamentary appearances and audits to give you an overview from a privacy perspective of key security initiatives that have been implemented over the last 10 years.

Want to learn more? Click here to consult the new page.


10 Jun 2013

Fixing leaky faucets: Raising the bar of privacy protection


“Web leakage” research and follow-up work by the Office of the Privacy Commissioner of Canada has resulted in improvements to the privacy practices of some popular Canadian websites.

You may recall that our Office’s technologists tested 25 sites last year and found a significant number were “leaking” registered users’ personal information – including names and email addresses– to third-party sites such as advertising companies.

The research project prompted extensive discussions with the operators of 11 sites where concerns or questions were identified.

Positive changes

In the end, we’re happy to say that the initiative has resulted in a number of positive changes for Canadians:

  • Several organizations have taken measures to stop unintentional or unnecessary disclosures of personal information.
  • Many also agreed to take steps to ensure they provide consumers with clear, accessible information about their privacy practices.

All of the organizations cooperated with our Office and we were able to resolve our concerns in each and every case.  Here is a summary of the results of our work with the 11 sites:

  • In three cases, the site operators had been previously unaware that personal information was being disclosed to third parties, but took steps to ensure the disclosures stopped.
  •  In a further three cases, websites that had been intentionally sharing information such as email addresses to third parties, but agreed to stop after we questioned the practice.  Another organization was looking at whether its site could be re-designed to prevent sharing with two of its online service providers.
  • One organization acknowledged that personal information was being shared with  third-party service providers in order to manage its website – even though its privacy policy states personal information is not made available to third parties.  The organization is in the midst of making changes to its privacy policy to provide greater clarity.
  •  In other cases, our discussions with organizations confirmed that no information was being disclosed to third parties beyond that found in our research – for instance, postal codes.  As a result, we determined the disclosed information was not personal information.

Of course, our initiative involved a very small sample of sites and “web leakage” concerns are not confined to the organizations identified in our research.  All web site operators and third parties should review the personal information they share and test own sites to check whether data is unintentionally leaking.

Issues beyond “web leakage”

During our work, it became apparent that organizations’ privacy practices, such as the legitimate sharing of information with third parties, were not always disclosed in a meaningful way to consumers.

Commissioner Stoddart has expressed concern about privacy policies that are too long, too convoluted, and, as a result, tend to be largely ignored by users.

Organizations should have clear, descriptive privacy policies.  Our Office has also started looking at other practices that could also be adopted to help inform people about how their personal information will be handled.  For example, we like just-in-time notifications – providing explanations of privacy practices when data is collected.

To that end, we were pleased that several organizations committed to improve the way in which they tell consumers about their personal information handling practices.  For example, some are reviewing their privacy policies and exploring more innovative ways – such as just-in-time notices – to provide privacy information.

All of these steps will go a long ways to help ensure these organizations have obtained informed consent for the collection, use and disclosure of personal information online – as required under Canadian privacy law.

And since the issues we identified have been addressed, the Privacy Commissioner has decided not to exercise her power to name these organizations.

Given our study has revealed systemic issues in this area, our Office is developing a guidance document on best practices with respect to how organizations obtain informed consent from Canadians for the collection, use and disclosure of personal information in the online world. We expect to publish the guidance document later this year.


30 May 2013

Hat trick at IAPP Canada


Commissioners Stoddart, Denham and Clayton at IAPP Canada 2013

Who says hockey season is over in Canada? Check out these three stars from last week’s IAPP Canada Privacy Symposium - from left to right, Privacy Commissioner of Canada Jennifer Stoddart; Elizabeth Denham, B.C.’s Information and Privacy Commissioner; and Jill Clayton, Alberta’s Information and Privacy Commissioner. This year’s Commissioners’ Panel, in honour of the playoffs, was modelled after TSN’s The Quiz. The panel also included Ann Cavoukian, Information and Privacy Commissioner of Ontario. Commissioners were great sports – they poked fun at each other and themselves, and answered questions about a wide range of privacy issues, including big data, accountability and breach notification.  Moderator Kris Klein, IAPP Canada’s managing director, wore a striped referee’s sweater, but didn’t have to blow his whistle or put anyone in the penalty box even once.


8 May 2013

Be prepared for a crisis with our Privacy Emergency Kit


It’s Emergency Preparedness Week in Canada – time to encourage Canadians to become better prepared to face an emergency with basic steps such as keeping bottled water and canned goods in the basement.

The Office of the Privacy Commissioner of Canada is also encouraging organizations to ensure they are prepared to address privacy issues that may arise during a time of crisis.

Personal information can play an important role in an emergency situation.  Uncertainty around the sharing of personal information could result in unnecessary confusion and delays – and have significant consequences for people.

Our Office, in consultation with several provincial and territorial counterparts, has created a Privacy Emergency Kit to help both private and public sector organizations ensure they are prepared.

Privacy laws do allow for appropriate sharing during a time of crisis, but it is crucial that organizations understand the legislation that applies to them and consider privacy issues in advance of an emergency situation.

The Government of Canada’s Get Prepared site advises individual Canadians: “Whatever you do, don’t wait for a disaster to happen.”

That’s also good advice for organizations subject to privacy legislation.


7 May 2013

A First-Person-Sweeper Perspective


OPC internet privacy sweep

Yesterday, our Office participated in the first ever international internet privacy sweep. An initiative of the Global Privacy Enforcement Network (GPEN), the sweep is a coordinated effort among a number of data protection agencies to address a particular privacy issue. This year’s sweep assessed transparency online.

I was one of about 20 OPC employees who spent part of the day “sweeping” – visiting sites from a list we had compiled of over 1000 websites popular among Canadians. Our task: to review the privacy policies of popular websites from the point of view of the average consumer, and determine whether we could find out about an organization’s information handling practices, raise questions or concerns with an organization about their information handling practices, and understand their privacy policies.

Many of us sat at networked laptops in a small boardroom we dubbed “The Broom Closet”. Armed with coffee and spreadsheets, we clicked our way through privacy policies, checking for readability, counting words, and taking note of “Bouquets” (elements of privacy policies we felt were done well) and “Turnips” (elements of privacy policies that could be improved).

Through GPEN, the results from all of the sweeps conducted this week will be analyzed and results will be made public sometime in the coming months.

I spent the morning looking at popular kids’ websites. Some observations:

Privacy policies on children’s websites are written for parents, not kids.

In order to operate in the U.S., sites targeted to kids need to be compliant with the U.S. Children’s Online Privacy Protection Act (COPPA).

Operators of kids’ sites might aim to create privacy policies that are robust and comprehensive but in doing so, their privacy policies can risk being long, complex and legalistic.

Even so, some of the sites I visited clearly took some extra effort to break down their policies in order to meet the requirement under COPPA that privacy policies be “clear and understandable” – either by organizing information into hyperlinked chunks or tables, or providing summaries with links to the full policy below.

I can appreciate the challenge these sites face – on the one hand, they must demonstrate compliance; on the other hand, parents of kids who use these sites want to make informed decisions about their information. And parents often need to make those decisions quickly, or with other immediate priorities competing for their attention.  How many of you have tried to make heads or tails of a new game your child wants to play, while breaking up a fight over who gets to use the iPad, while sweeping up goldfish crackers and Cheerios? (Not that this happens in my house, ever.)

When you consider that researchers have estimated it can take people up to 250 hours to read all of the privacy policies they encounter in a year, wouldn’t it be nice to see a privacy policy that tells you what you need to know, but also helps shave a couple of minutes off?


29 Apr 2013

Grappling with the impact technology is having on privacy


This week is Privacy Awareness Week (PAW) – a global effort, coordinated by members of the Asia Pacific Privacy Authorities (APPA), to raise awareness about the value of privacy and the importance of protecting it.

For PAW 2013, APPA created an infographic that illustrates how technology has changed the way we communicate, do business and store information, and how this has introduced new privacy risks as a result.

It is an issue that many are thinking about. According to OPC’s recent survey, Canadians are increasingly anxious about their privacy in the face of new technology, and 70 per cent of them feel they have less protection of their personal information than they did 10 years ago. The research also indicates that Canadians avoid downloading apps or using certain websites and services due to privacy concerns.

What can we do?

It is true that consumers expect protections when they use products and services, but it is important to also realize that consumers have an important role to play and need to take an active approach when it comes to protecting their personal information. The best thing anyone can do, when using technology to collect or store personal information, is to understand the privacy risks that come with that technology. And here are some resources to help with that task:

Mobile App: We use our mobile devices to store a goldmine of personal information. To learn more about how to protect the personal information on your mobile device, download the OPC’s free myPRIVACYapp.

Video: Privacy and Social Networks: Do you know what happens to your personal information once you post it on to social networking sites? Watch this video that OPC created to understand how social networking sites make money off of your personal information. It may cause you to ask yourself some tough questions the next time you update your information online.

Infographic: 10 tips for preventing identity theft: Anyone who has personal information is at risk of identity theft, and the risks are higher now that we use technology for so many purposes. And while it’s impossible to entirely eliminate the risk of becoming a victim, it is possible to reduce it. The OPC’s infographic details 10 things you can do to prevent yourself from becoming a target.

Introduction to Cloud Computing: When you store your photos online instead of on your home computer, or use webmail or a social networking site, you are using a “cloud computing” service. The OPC’s fact sheet explains the privacy implications of this.

For more information on the privacy risks that come with technology, and on how to protect yourself, visit the OPC’s page of fact sheets covering a range of issues and topics.