Canadian companies still aren\u2019t doing enough to respect the privacy of residents, the federal privacy commissioner said in an interview marking Data Privacy Week.<\/p>\n
\u201cIn our annual report<\/a> \u2026 we saw a number of instances where there are still shortcomings in terms of how privacy is considered,\u201d Philippe Dufresne said Monday.<\/p>\n In particular, he cited four cases from the report for the 12-month period ending March 31, 2022:<\/p>\n \u2014 a joint investigation with provincial privacy officers in Quebec, Alberta, and B.C. found Tim Hortons\u2019 mobile app inappropriately tracked and recorded its customers\u2019 movements every few minutes of every day, even when the app was not open. The collection of what the report called \u201cvast\u201d amounts of location information was not proportional to the benefits the company may have hoped to gain from better-targeted promotion of its coffee and other products. Customers\u2019 consent for collecting that data was done through \u201cunclear, and in certain circumstances, misleading statements;\u201d<\/p>\n \u2014 a Rogers Communications customer was enrolled in its Voice ID voiceprint biometric authentication program without her consent. In fact, after discovering she had been enrolled, the customer called Rogers and once again opted out of the program, only to discover that she was still in it. Rogers agreed to get express consent from individuals for this program;<\/p>\n \u2014 trucking firm Trimac Transportation Services Inc. had installed dash cameras in its vehicles that continuously recorded audio and video without drivers\u2019 consent. Video and audio clips transferred to Trimac were available, with limited safeguards against unauthorized access, to more Trimac employees than necessary. The company agreed the audio recording should only be active when a driver is on-duty or driving, and to limit the availability of the recordings;<\/p>\n \u2014 a Quebec company authorized by the federal government to administer mandatory COVID-19 tests at the Montreal-Trudeau airport used its position to send marketing emails to 147,000 travelers it tested without their consent. The company wrongly thought it had established a \u201cbusiness relationship with arriving passengers and thus relied on implied consent to send email ads,\u201d the report said.<\/p>\n The four examples Dufresne cited involve improperly collecting personal data without proper consent. The website of the Office of the Privacy Commissioner says that under the federal private sector privacy law known as the Personal Information Protection and Electronic Documents Act (PIPEDA), \u201corganizations are required to obtain meaningful consent for the collection, use and disclosure of personal information. Consent is considered meaningful when individuals are provided with clear information explaining what organizations are doing with their information.\u201d<\/p>\n SIDEBAR<\/strong>: PIPEDA applies to federally-regulated commercial firms and companies in all provinces and territories except in B.C., Alberta and Ontario. Here\u2019s a brief outline of what businesses should and shouldn\u2019t do<\/a>.<\/em><\/p>\n During Privacy Week, business and IT leaders should be thinking about what they can do to create a stronger culture of privacy in the workplace and in Canadian society, Dufresne said. \u201cWhen I was appointed privacy commissioner [last summer] I put forward a vision of privacy that recognizes privacy as a fundamental right, privacy in support of the public interest and Canada\u2019s innovation and competitiveness, and privacy as an accelerator of Canadians\u2019 trust in their institutions and their participation as digital citizens.\u201d<\/p>\n \u201cThat means treating privacy as a priority,\u201d he said, \u201cnot as an afterthought, as a mere regulatory obligation, but something that is fundamental to individuals and society.<\/p>\n \u201cFor organizations, that means conducting privacy impact assessments in appropriate cases to ensure privacy risks are identified and mitigated. It means asking questions and making sure that they are only collecting, using, retaining and disposing of personal information to the extent that it\u2019s demonstrably necessary and proportional to achieving the organization\u2019s legitimate purposes.<\/p>\n \u201cIt means that individuals must be properly trained within the organization so that not only do they have good policies, but they are implemented properly and followed through. It means putting up safeguards to protect information against what we are seeing more and more in terms of data breaches and increased threats. And it means leaders recognizing and putting forward a vision of privacy that treats it as a fundamental right and not as an obstacle to the pursuit of an organization\u2019s objectives \u2014 whether it\u2019s innovation or economic \u2014 but as an asset, something that will support and strengthen those goals and ultimately increase Canadians\u2019 trust in organization and society.\u201d<\/p>\n While Dufresne calls for privacy to be a fundamental right, that\u2019s not what the Liberal government has proposed in its overhaul of PIPEDA, known as Bill C-27<\/a>. Dufresne said he will outline his detailed opinion on the proposed legislation to Parliament. He didn\u2019t call for amending the Charter of Rights and Freedoms<\/a>, however, he did say privacy should have \u201cspecial status\u201d if there is a conflict with other interests.<\/p>\n The government has said that the importance of privacy protection is mentioned in the legislation\u2019s preamble.<\/a><\/p>\n The post Data Privacy Week: Some Canadian firms have \u2018shortcomings\u2019 in treating privacy, says regulator<\/a> first appeared on IT World Canada<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" The federal privacy commissioner reminds firms of four consent-related problems listed in his most recent ann<\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[361,16],"tags":[807,391,396,512,275],"class_list":["post-34533","post","type-post","status-publish","format-standard","hentry","category-privacy","category-security","tag-data-privacy-week","tag-di","tag-postmedia","tag-privacy-commissioner-of-canada","tag-top-story"],"acf":[],"_links":{"self":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/34533","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/comments?post=34533"}],"version-history":[{"count":2,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/34533\/revisions"}],"predecessor-version":[{"id":34591,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/34533\/revisions\/34591"}],"wp:attachment":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/media?parent=34533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/categories?post=34533"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/tags?post=34533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}