Privacy Law Commons^™

Delineating The Legal Framework For Data Protection: A Fundamental Rights Approach Or Data Propertization?, Efe Lawrence Ogbeide

Canadian Journal of Law and Technology

The Charter of Fundamental Rights of the European Union, like other key legal instruments around the globe, grants citizens the right to privacy in Article 7. The Charter, however, further provides for the right to data protection in Article 8. Simply put, the implication of Article 8 of the Charter is that the right to data protection is a fundamental right. The central question in this article is whether data protection indeed qualifies to be categorized as a fundamental right. If not, what other approach(es) to data protection may be implemented?

Platforms, Encryption, And The Cfaa: The Case Of Whatsapp V Nso Group, Jonathon Penney, Bruce Schneier

Articles, Book Chapters, & Popular Press

End-to-end encryption technology has gone mainstream. But this wider use has led hackers, cybercriminals, foreign governments, and other threat actors to employ creative and novel attacks to compromise or workaround these protections, raising important questions as to how the Computer Fraud and Abuse Act (CFAA), the primary federal anti-hacking statute, is best applied to these new encryption implementations. Now, after the Supreme Court recently narrowed the CFAA’s scope in Van Buren and suggested it favors a code-based approach to liability under the statute, understanding how best to theorize sophisticated code-based access barriers like end-to-end encryption, and their circumvention, is now …

Submission To The Province Of Nova Scotia On Its Review Of The Intimate Images And Cyber-Protection Act - Leaf, Suzie Dunn, Rosel Kim

Reports & Public Policy Documents

The Women’s Legal Education and Action Fund (LEAF) commends the Nova Scotia government for reviewing its Intimate Images and Cyber-protection Act (the Act) and seeking public input for this review. Nova Scotia has been, and continues to be, a leader in Canada for its role in advancing innovative laws and supports for people targeted by technology-facilitated violence (TFV), digital abuse, and the non-consensual distribution of intimate images (NCDII). As these forms of harmful behaviour evolve and become better understood, it is important to revisit this legislation to assess whether it is providing meaningful and accessible responses to such serious social …

Understanding Chilling Effects, Jonathon Penney

Articles, Book Chapters, & Popular Press

With digital surveillance and censorship on the rise, the amount of data available online unprecedented, and corporate and governmental actors increasingly employing emerging technologies like artificial intelligence (AI), machine learning, and facial recognition technology (FRT) for surveillance and data analytics, concerns about “chilling effects”, that is, the capacity for these activities “chill” or deter people from exercising their rights and freedoms have taken on greater urgency and importance. Yet, there remains a clear dearth in systematic theoretical and empirical work point. This has left significant gaps in understanding. This article has attempted to fill that void, synthesizing theoretical and empirical …

Submission To The Toronto Police Services Board’S Use Of New Artificial Intelligence Technologies Policy- Leaf And The Citizen Lab, Suzie Dunn, Kristen Mj Thomasen, Kate Robertson, Pam Hrick, Cynthia Khoo, Rosel Kim, Ngozi Okidegbe, Christopher Parsons

Reports & Public Policy Documents

We write as a group of experts in the legal regulation of artificial intelligence (AI), technology-facilitated violence, equality, and the use of AI systems by law enforcement in Canada. We have experience working within academia and legal practice, and are affiliated with LEAF and the Citizen Lab who support this letter.

We reviewed the Toronto Police Services Board Use of New Artificial Intelligence Technologies Policy and provide comments and recommendations focused on the following key observations:

1. Police use of AI technologies must not be seen as inevitable
2. A commitment to protecting equality and human rights must be integrated …

Can Pipeda ‘Face’ The Challenge? An Analysis Of The Adequacy Of Canada’S Private Sector Privacy Legislation Against Facial Recognition Technology, Tunca Bolca

Canadian Journal of Law and Technology

Facial recognition technology is one of the most intrusive and privacy threatening technologies available today. The literature around this technology mainly focuses on its use by the public sector as a mass surveillance tool; however, the private sector uses of facial recognition technologies also raise significant privacy concerns. This paper aims to identify and examine the privacy implications of the private sector uses of facial recognition technologies and the adequacy of Canada’s federal private sector privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA), in addressing these privacy concerns. Facial templates produced and recorded by these technologies are …

Identity Manipulation: Responding To Advances In Artificial Intelligence And Robotics, Suzie Dunn

Articles, Book Chapters, & Popular Press

Advances in artificial intelligence (AI) and robotics technologies have destabilized our ability to control our identity. Today, it is increasingly accessible for the average person to appropriate the voice, image, and body of another individual through the use of technology. Deepfake videos swap new faces into existing videos, facial re-enactment allows for the face of one person to be superimposed on the face of someone else in a real time video, artificial speech synthesis can clone another person’s voice, and 3D printing and modern robotics can reproduce life-size copies of living people. These are all examples of the ways technology …

Politics Of Adversarial Machine Learning, Kendra Albert, Jonathon Penney, Bruce Schneier, Ram Shankar Siva Kumar

Articles, Book Chapters, & Popular Press

In addition to their security properties, adversarial machine-learning attacks and defenses have political dimensions. They enable or foreclose certain options for both the subjects of the machine learning systems and for those who deploy them, creating risks for civil liberties and human rights. In this paper, we draw on insights from science and technology studies, anthropology, and human rights literature, to inform how defenses against adversarial attacks can be used to suppress dissent and limit attempts to investigate machine learning systems. To make this concrete, we use real-world examples of how attacks such as perturbation, model inversion, or membership inference …

Privacy And Legal Automation: The Dmca As A Case Study, Jonathon Penney

Articles, Book Chapters, & Popular Press

Advances in artificial intelligence, machine learning, computing capacity, and big data analytics are creating exciting new possibilities for legal automation. At the same time, these changes pose serious risks for civil liberties and other societal interests. Yet, existing scholarship is narrow, leaving uncertainty on a range of issues, including a glaring lack of systematic empirical work as to how legal automation may impact people’s privacy and freedom. This article addresses this gap with an original empirical analysis of the Digital Millennium Copyright Act (DMCA), which today sits at the forefront of algorithmic law due to its automated enforcement of copyright …

Internet Surveillance, Regulation, And Chilling Effects Online: A Comparative Case Study, Jonathon Penney

Articles, Book Chapters, & Popular Press

With internet regulation and censorship on the rise, states increasingly engaging in online surveillance, and state cyber-policing capabilities rapidly evolving globally, concerns about regulatory “chilling effects” online — the idea that laws, regulations, or state surveillance can deter people from exercising their freedoms or engaging in legal activities on the internet have taken on greater urgency and public importance. But just as notions of “chilling effects” are not new, neither is skepticism about their legal, theoretical, and empirical basis; in fact, the concept remains largely un-interrogated with significant gaps in understanding, particularly with respect to chilling effects online. This work …

Internet Surveillance, Regulation, And Chilling Effects Online: A Comparative Case Study, Jonathon Penney

Articles, Book Chapters, & Popular Press

With internet regulation and censorship on the rise, states increasingly engaging in online surveillance, and state cyber-policing capabilities rapidly evolving globally, concerns about regulatory “chilling effects” online — the idea that laws, regulations, or state surveillance can deter people from exercising their freedoms or engaging in legal activities on the internet have taken on greater urgency and public importance. But just as notions of “chilling effects” are not new, neither is skepticism about their legal, theoretical, and empirical basis; in fact, the concept remains largely un-interrogated with significant gaps in understanding, particularly with respect to chilling effects online. This work …

Review Essay: Sara M. Smyth, Cybercrime In Canadian Criminal Law, 2nd Edition (Toronton: Carswell, 2015), Christopher D. Ram

Canadian Journal of Law and Technology

Dr. Smyth’s book is ambitious in its scope, seeking to trace the criminology and evolution of information technologies and cybercrime as the basis of current Canadian legislation and jurisprudence. It is intended as a concise student reference text or resource for those who are new to the subject area, studying in criminology and other areas, as opposed to law. A list of concepts and issues for discussion appears at the conclusion of each chapter and there is a glossary of technical (but not legal) terms at the end of the book. It takes a neutral and professorial approach, seeking to …

Chilling Effects: Online Surveillance And Wikipedia Use, Jonathon Penney

Articles, Book Chapters, & Popular Press

This article discusses the results of the first empirical study providing evidence of regulatory “chilling effects” of Wikipedia users associated with online government surveillance. The study explores how traffic to Wikipedia articles on topics that raise privacy concerns for Wikipedia users decreased after the widespread publicity about NSA/PRISM surveillance revelations in June 2013. Using an interdisciplinary research design, the study tests the hypothesis, based on chilling effects theory, that traffic to privacy-sensitive Wikipedia articles reduced after the mass surveillance revelations. The Article finds not only a statistically significant immediate decline in traffic for these Wikipedia articles after June 2013, but …

Chilling Effects: Online Surveillance And Wikipedia Use, Jonathon Penney

Articles, Book Chapters, & Popular Press

This article discusses the results of the first empirical study providing evidence of regulatory “chilling effects” of Wikipedia users associated with online government surveillance. The study explores how traffic to Wikipedia articles on topics that raise privacy concerns for Wikipedia users decreased after the widespread publicity about NSA/PRISM surveillance revelations in June 2013. Using an interdisciplinary research design, the study tests the hypothesis, based on chilling effects theory, that traffic to privacy-sensitive Wikipedia articles reduced after the mass surveillance revelations. The Article finds not only a statistically significant immediate decline in traffic for these Wikipedia articles after June 2013, but …

Cross-Cutting Conflicts: Developments In The Use Of Norwich Orders In Internet Defamation Cases, Robert Currie

Articles, Book Chapters, & Popular Press

The anonymity afforded to those wishing to post commentary on the internet has given rise to a number of procedural issues in Canadian case law. This paper focuses on one such issue: the need for prospective plaintiffs in defamation actions to "unmask" anonymous commentators in order to be able to bring proceedings against them. It tracks the increasing use of the "Norwich order," A.K.A an order for pre-action discovery, as a means of accomplishing this objective, by examining the leading case of Warman v. Fournier and analyzing how this issue has played out in litigation to date. It also considers …

Electronic Devices At The Border: The Next Frontier Of Canadian Search And Seizure Law?, Robert Currie

Articles, Book Chapters, & Popular Press

Over the last several years the Supreme Court of Canada has developed its jurisprudence regarding the search and seizure of electronic devices, applying section 8 of the Canadian Charter of Rights and Freedoms in such a way as to assert and protect a significant amount of privacy in the devices and their data. Recent cases regarding the search of devices at Canada’s borders, however, do not reflect this case law. This is a situation made all the more complex by the generally attenuated expectation of privacy in the border context, and is worthy of inquiry. Using a pending border case …

Wired Identities: Retention And Destruction Of Personal Health Information In An Electronic World, Elaine Gibson

Dalhousie Law Journal

This article examines the issue of the retention and destruction of personal health information. While legislation in Canada shows some attention to the issue of retaining health records, very little consideration has been given to their destruction. As technological advances have made indefinite retention feasible, serious privacy issues are now being raised by the lack of a standard related to the destruction of health records. The author argues that this issue needs to be explicitly addressed. The author analyzes this problem by looking at issues of autonomy, public good, inequality, and privacy as a social good before offering thoughts on …

The Cycles Of Global Telecommunication Censorship And Surveillance, Jonathon Penney

Articles, Book Chapters, & Popular Press

Internet censorship and surveillance is on the rise globally and cyber-warfare increasing in scope and intensity. To help understand these new threats commentators have grasped at historical analogies often with little regard for historical complexity or international perspective. Unfortunately, helpful new works on telecommunications history have focused primarily on U.S. history with little focus on international developments. There is thus a need for further internationally oriented investigation of telecommunications technologies, and their history. This essay attempts to help fill that void, drawing on case studies wherein global telecommunications technologies have been disrupted or censored — telegram censorship and surveillance, high …

Privacy, Trusts And Cross-Border Transfers Of Personal Information: The Quebec Perspective In The Canadian Context, Eloise Gratton, Pierre-Christian Collins Hoffman

Dalhousie Law Journal

This paper argues that data protection laws apply to prevent the disclosure of certain information relating to trusts, which are increasingly being used .as business and investment vehicles. Given the broad scope of the concept of "personal information" found under both provincial and federal personal information protection statutes, arguments can be made that information relating to trust beneficiaries or trustees, where such beneficiaries or trustees are natural persons, enjoy some level of protection. Even where a trust contains an express choice of law clause providing that the laws of another province or country apply, Quebec conflict of laws rules may …

Communications Disruption And Censorship Under International Law: History Lessons, Jonathon Penney

Articles, Book Chapters, & Popular Press

With Internet censorship on the rise around the world, a variety of tools have proliferated to assist Internet users to circumvent such censorship. However, there are few studies examining the implications of censorship circumvention under international law, and its related politics. This paper aims to help fill some of that void, with an examination of case studies wherein global communications technologies have been disrupted or censored — telegram cable cutting and censorship, high frequency radio jamming, and direct broadcast satellite blocking — and how the world community responded to that disruption or censorship through international law and law making. In …

Ministerial Misfeasance: R. V. Morris And A Unique Early Privacy Breach, Barry Cahill

Dalhousie Law Journal

According to Klein &Kratchanov (Government Information: The Right to Information and Protection of Privacy in Canada, 2nd ed., 2009), "there is one reported case of a successful private prosecution for violation of an access statute through the unauthorized release of personal information. The matter arose under a former Nova Scotia Act and resulted in a modest fine being imposed against a Minister of the Crown who had disclosed information about the complainant." What follows is a close, contextual study of a case unique in the short history of privacy law in Canada, from the perspective of the thirty-year development of …

Privacy And The New Virtualism, Jonathon Penney

Articles, Book Chapters, & Popular Press

First generation cyberlaw scholars were deeply influenced by the uniqueness of cyberspace, and believed its technology and scope meant it could not be controlled by any government. Few still ascribe to this utopian vision. However, there is now a growing body of second generation cyberlaw scholarship that speaks not only to the differential character of cyberspace, but also analyzes legal norms within virtual spaces while drawing connections to our experience in real space. I call this the New Virtualism. Situated within this emerging scholarship, this article offers a new approach to privacy in virtual spaces by drawing on what Orin …

Understanding The New Virtualist Paradigm, Jonathon Penney

Articles, Book Chapters, & Popular Press

This article discusses the central ideas within an emerging body of cyberlaw scholarship I have elsewhere called the "New Virtualism". We now know that the original "virtualists"- those first generation cyberlaw scholars who believed virtual worlds and spaces were immune to corporate and state control - were wrong; these days, such state and corporate interests are ubiquitous in cyberspace and the Internet. But is this it? Is there not anything else we can learn about cyberlaw from the virtualists and their utopian dreams? I think so. In fact, the New Virtualist paradigm of cyberlaw scholarship draws on the insights of …

Access To Medical Records For Research Purposes: Varying Perceptions Across Research Ethics Boards, Donald Willison, Claudia Emerson, Karen Szala-Meneok, Elaine Gibson, Lisa Schwartz, Karen Weisbaum, François Fournier, Kevin Brazil, Michael Coughlin

Articles, Book Chapters, & Popular Press

Variation across research ethics boards (REBs) in conditions placed on access to medical records for research purposes raises concerns around negative impacts on research quality and on human subject protection, including privacy. Aim: To study variation in REB consent requirements for retrospective chart review and who may have access to the medical record for data abstraction. Methods: Thirty 90-min face-to-face interviews were conducted with REB chairs and administrators affiliated with faculties of medicine in Canadian universities, using structured questions around a case study with open-ended responses. Interviews were recorded, transcribed and coded manually. Results: Fourteen sites (47%) required individual patient …

Who's Minding The Shop? The Role Of Canadian Research Ethics Boards In The Creation And Uses Of Registries And Biobanks, Elaine Gibson, Kevin Brazil, Michael Coughlin, Claudia Emerson, François Fournier, Lisa Schwartz, Karen Szala-Meneok, Karen Weisbaum, Donald Willison

Articles, Book Chapters, & Popular Press

Background: The amount of research utilizing health information has increased dramatically over the last ten years. Many institutions have extensive biobank holdings collected over a number of years for clinical and teaching purposes, but are uncertain as to the proper circumstances in which to permit research uses of these samples. Research Ethics Boards (REBs) in Canada and elsewhere in the world are grappling with these issues, but lack clear guidance regarding their role in the creation of and access to registries and biobanks.

Methods: Chairs of 34 REBS and/or REB Administrators affiliated with Faculties of Medicine in Canadian universities were …

Privacy, Crime And Terror: Legal Rights And Security In A Time Of Peril By Stanley A. Cohen (Markham: Lexisnexis Butterworths, 2005), Teresa Scassa

Canadian Journal of Law and Technology

It is now trite to say that the events of September 11, 2001 have had a profound impact on our national security, in terms of its institutional and normative dimensions, and also in terms of a more general public anxiety. The hastily enacted Anti-terrorism Act of 2001 brought about significant changes to a wide range of statutes including, among others, the Criminal Code, the Official Secrets Act, the Canada Evidence Act, and the Proceeds of Crime (Money Laundering) Act. An early conference and resultant book on the Anti-terrorism Act raised serious concerns about the potential impact of the changes on …

Personal Medical Information: Privacy Or Personal Data Protection?, Wilhelm Peekhaus

Canadian Journal of Law and Technology

Some of the existing literature concerning the privacy of health information seems to suggest that medical information has a particularly special nature; either through its oft-cited association with dignity or the need for its ‘‘unobstructed’’ use by health care practitioners for a variety of reasons. It is against such a backdrop that this paper will review and compare a number of legislative mechanisms that have been designed to meet the challenge of safeguarding the privacy of personal information without completely hindering the continued flow of information required by economic and health care systems. An attempt will be made to situate …

The Personal Information Protection And Electronic Documents Act: A Lost Opportunity To Democratize Canada's "Technological Society", Tina Piper

Dalhousie Law Journal

Bill C-6, more recently known as the Personal Information Protection and Electronic Documents Act, is promoted by the Canadian government as privacy legislation to protect Canadians' personal information. This paper explores that characterization and concludes that it is inaccurate and misleading. The problems that motivated a response by Parliament are the proliferation and commercial importance of personal information, concerns Canadians have about its uncontrolled use by the private sector and the inadequacy of existing law to address those concerns. However, the Act has not responded to these problems. There are several reasons for this, primarily the disproportionate and antidemocratic importance …

Computer Data Banks And Personal Information: Protection Against Negligent Disclosure, Chris Dockrill

Dalhousie Law Journal

The common law has for centuries recognized the protection of certain interests which fall under the rubric of what is commonly referred to as the right of privacy.' While these safeguards have not always satisfied the concerns of the aggrieved individual, they have and continue to afford some measure of protection. The recognition of a need for a more specific means of protecting such interests is more recent in origin, dating to the later part of the last century.