Balancing privacy and security

At a recent Institute of Public Administration of Canada panel discussion on privacy of information, the moderator stood up and said he was a survivor of prostate cancer. He urged every man over 50 years of age to get checked for it every year.

His willingness to share his private heath information to get the word out to a large crowd powerfully illustrated the debates on how privacy must be protected, a major theme of the May conference, Exploring the E-Frontier: Public administration in a knowledge society.

Conference presenters sought to impress upon public servants and government managers the extreme importance of respecting the privacy of citizens; personal information, and the moderator’s point was that his information was his alone to share or not as he saw fit.

Terms of reference for the privacy discussions were these:

    Privacy is my right to control my information.Confidentiality is your responsibility to guard my information.Security is the way we assess risks to information.Privacy and anonymity are separate.Security and confidentiality are separate.

It is clear that with advances in communications technology and the rush to e-government, privacy issues will define this decade. As the Internet reaches into every nook and cranny, the urgency of concern increases exponentially, especially about health-related information or personal identity information that can be used by police, the RCMP and CSIS.

“We must not allow ourselves to fall prey to the argument that losing our privacy is the price we must pay for being part of a technologically advanced society,” warned Julien Delisle, from the Office of the Privacy Commissioner of Canada. “Lack of protection for privacy demeans people. If they lose control of their own information, they lose their freedom.”

Academics and government officials spent years on the groundwork for Bill C-6, the Personal Information Protection and Electronic Documents Act, which came into force last January. It is intended to ensure that organizations in the federally regulated private sector, including banks, international transportation, broadcasting and telecommunications, use personal information only for the purpose for which it was provided. The law means to make electronic commerce secure and move Canada to the forefront of the global digital economy. It overarches existing federal statutes and regulations.

It used to be that privacy was guarded by default, but technological advances mean privacy now must be respected intentionally. We are easily traced through our credit card statements, our e-mails and Internet surfing, phone records and workplace passcards.

In recent years, society has become inured to constant surveillance. We almost take for granted that there are cameras in subway stations, shopping malls, parking garages, high schools, banks and private clubs; their use is growing in the private sector. In Calgary, for instance – with a nod to their effectiveness in Britain in deterring crime – some downtown bar owners are calling for closed-circuit television cameras on the street corners to subdue rowdy late-night patrons. Notably, Calgary police chief Jack Beaton has spoken out, saying that if installing them were a police initiative, it would reek of Big Brother, but because it’s business owners wanting them, the discussion goes in a different direction.

“The biggest risk to our privacy is ourselves because we give out so much information – through loyalty programs and Internet merchants – cookies,”

declared high-tech trend-tracker Tom Keenan in his luncheon speech. Keenan

is dean of the faculty of continuing education at the University of Calgary

and a technology broadcaster.

“Don’t give out your Social Insurance Number, has given way to: “don’t give out your e-mail address,” Keenan says. “Everything leaves a visible trail.” Keenan’s advice to governments was to think before implementing any release of information on the Internet. “Once privacy is broken it cannot be recovered.”

The Privacy Commissioner has similar concerns that privacy guards must be anticipatory. The longitudinal studies and work-related data collected on millions of Canadians by Human Resources Development Canada “may have been compiled with the best of intentions, but because privacy wasn’t built in, people objected,” Delisle told a conference session called Minding or Mining the Data.

“Walls come down between programs and levels of government. If government has a single [window], data will merge rather than being compartmentalized and protected. A person with a need to know one thing about [someone] can get information they don’t need or have the right to know. Building dossiers of individuals, profiles, is the end of anonymity, the right to be let alone.”

Delisle also cautioned that walls coming down can lead to private- and public sector partnerships where personal information can be exposed. Another threat to privacy is the emergence of smart cards that can centralize information on all of a citizen’s transactions with government.

“Issuing or withholding cards can be used to control people. Their convenience and efficiency, however, will increase their popularity,” he said. Phase 2 of Canada