In a committee meeting that studies the implications of NAFTA 2.0, government officials were asked about the privacy implications. The response? I dunno.
Last year, the need for privacy reform became abundantly clear. When Facebook was under fire over the way it handled people’s personal information, including Canadian’s, it quickly became apparent just how much power the privacy commissioner had. That, of course, is effectively zilch. As the Facebook privacy scandals dragged on, the federal and BC privacy commissioner re-examined how Facebook handles people’s personal information. It turns out, little to no progress was made. All Facebook did in response to the followup report was to simply say that they disagree and moved on.
With no tools left in the chest, the commissioners had to work around the system to sue Facebook. It was at that moment that it became abundantly clear: the commissioners can write some well-written reports, but the second corporations tell them to buzz off, the commissioners generally find themselves powerless. It ultimately was the moment that should have been the signal that privacy reforms were badly needed and that commissioners need the power to levy fines against corporations who misuse personal information.
Near the end of the Canadian election, all the federal party leaders said that privacy reforms would happen should they become Prime Minister. That happened back in October, what about now?
It seems that any little political will to finally fix the system has evaporated. No one is talking about any grand reform of privacy in Canada. No new related bills have been tabled that we are aware of. In fact, there is simply no discussion at all about how to fix a broken privacy enforcement system in Canada.
One of the topics of political discussion is, however, NAFTA 2.0. When the legislation was tabled earlier this month to ratify the trade deal, the Canadian government caved to foreign pressure to ratchet up copyright terms to life plus 70 years. It was a stunning giant middle finger to Canadians because no case was made that such a change was even needed. It was just something the American’s wanted and Canada caved without much of a fight.
Now, it seems that another angle is emerging: what about the privacy implications? As it turns out, the Canadian government simply never looked into it. In fact, you almost get the impression that the governments attitude towards it could be summarized as: don’t know, don’t care. What a difference a mere four months makes. From Michael Geist:
The questioning opened with a stunning exchange between Conservative MP Michelle Rempel Garner and chief negotiator Steve Verheul on the privacy analysis (or lack thereof) conducted by Canadian officials:
Hon. Michelle Rempel Garner: Thank you, Madam chair. I will start my questions as it pertains to Chapter 19. Reading Chapter 19, I notice that it agrees to prohibitions against restrictions on the transfer of personal information, and prohibitions requiring where computing facilities are located, and this has less policy flexibility on data localization under the CPTPP. Can you table the analysis that shows that Chapter 19 of CUSMA will not prevent Canada from adopting laws that would create similar provisions such as those contained in Article 20 of the GDPR or California’s Consumer Privacy Act.
[…]
Hon. Michelle Rempel Garner: Just to be clear, I’m just asking if the analysis on that particular provision could be tabled with the committee.
Global Affairs Representative: Sorry, we don’t have any specific analysis.
Hon. Michelle Rempel Garner: No analysis was completed on that.
Global Affairs Representative: No.
Hon. Michelle Rempel Garner: Thank you. That’s good enough. I’m wondering if you can point me to anything in Bill C-4 that would preserve the rights for Canada to proceed with similar types of legislation.
Mr. Robert Brookfield: The bill generally does not indicate where there is policy flexibility. It does the reverse. It will indicate where there is a policy limitation. There is nothing in the bill that specifically says where the policy flexibility is.
Hon. Michelle Rempel Garner: Can you table the analysis that shows that British Columbia’s data localization would survive a challenge for the provisions in Chapter 19?
Mr. Robert Brookfield: That analysis doesn’t exist in a report form.
To be clear, it’s not as though the government didn’t have time to study the implications. After all, negotiations have been going back at least July of 2017 (and it obviously have been going back even further then that to reach such a point in the story). While the public didn’t have access to the text at the time, Canadian officials did have access. So, the inevitable question becomes: what was the Canadian government doing for the last 3 plus years on this file anyway? It also suggests that while now prime minister Trudeau was standing at his podium during the French leaders debate, he was vowing tougher reforms all the while they weren’t caring about the privacy implications of NAFTA 2.0.
All this “don’t know, don’t care” attitude towards personal privacy is shocking given how many times Canadians have been impacted by data breaches and leaks. There’s the LifeLabs data breach, the DesJardins data breach, the Capital One data breach, the Equifax data breach, and the Marriott Hotels data breach to name a few. With a personal information crisis on our hands, how is it possible that the Canadian government simply doesn’t seem to care? Is this really the message the government wants to send to Canadians who have suffered already? What about future data security issues? Does that not concern the Canadian government?
If anything, this is fantastic news for negligent corporations and data thieves operating in Canada. They know they are already getting away with so much already. With Canada seemingly saying that they don’t care about the situation, it will leave everyday Canadians paying the price.
Drew Wilson on Twitter: @icecube85 and Facebook.
