The rules could put your personal data at risk, even when you’re not using the internet, Canada’s privacy commissioner said Friday.
In a speech at the Canada 150 conference in Toronto, Peter Kent said the country needs to move away from an “all or nothing” approach that allows people to opt out of all sorts of online data collection and use, even if they’re not being tracked by the government.
If the rules become law, Kent said Canadians who opt out could be “unaware” of their privacy rights.
“If you’re on a website or you’re using an online application that has a social media widget that includes an embedded social media cookie, or if you’re an online user who’s connected to a social network, you may be unaware that you’re being tracked, even though you’re completely out of the loop,” he said.
The rules could mean that if you have a website that’s built in a way that it’s not possible for the government to track you, or you have an application that’s developed using open standards, such as Java, the government could track your activity without your knowledge.
The commissioner’s warning came after a new federal Privacy Commissioner of Canada warned the changes could “make it easier for the federal government to access information from your internet activity without having to provide the appropriate consent or opt-out.”
Under the new rules, companies could provide “reasonable access” to data about how users use their websites or apps, and they could provide information about how that data is used to understand users’ preferences.
But the commissioner also warned that the changes do not include a “meaningful opt-in” for users to opt-back into the government’s collection and sharing of their personal data.
Under the rules, Canadians would also be required to opt in to any data sharing by the federal and provincial governments with respect to their data, and to receive any “sensitive personal information” from the federal department of public safety and emergency preparedness.
“It is not clear if these safeguards will actually be sufficient to protect Canadians’ privacy in the face of a significant shift in the nature of the internet,” said Kent.
The Privacy Commissioner’s Office released a statement Friday saying that the rules are being crafted to make it “more transparent” and “in line with Canadian values” but that it will take time for the new privacy protections to be fully implemented.
As of July 2017, Canada was the only country in the world that required users to have their consent before companies could access their information, said Kent, who added that Canadians must “be very cautious about the privacy implications of any changes to the Privacy Act.”
He said the changes “will likely require significant changes to existing privacy legislation.”
