18th International Privacy and Data Protection Conference

Statement Speech - Information Highway Advisory Council

September 18, 1996

Professor David Johnston
Chair, Information Highway Advisory Council

Thank you for your kind introduction. It is indeed a pleasure to address you today. This conference will showcase the world's efforts to promote and protect personal and professional privacy and I am humbled to be asked to present a portion of Canada's efforts.

Everyone in this room realizes that privacy and security issues will play larger and larger roles in our businesses and professions as the information highway evolves. Everyone in this room also realizes that those issues will touch us in our homes as well as our offices.

Used wisely, the collection, storage and dissemination of information can lead to wonderful new opportunities for creativity, learning and innovation.

The information highway offers new options for rural and remote communities, new opportunities for the disabled, new jobs, and new types of jobs, for Canadians. A world of educational, health care, recreational and communications opportunities will be available to more and more Canadians. New communities of knowledge and shared interests are forming and will grow and spread.

Used unwisely, the information highway can lead to major societal headaches and cruel personal heartache. The information highway opens up new potential for surveillance of all Canadians as customers, students, employees, patients, taxpayers and recipients of public and private services.

Commercial, medical, scientific, academic and government information can be used to build a better economy and a better society. That information can also destroy an individual's personal economic prospects and quality of life.

The right to privacy is a fundamental aspect of Canadian society and democracy. We value our right to live in peace. We value the right to solitude, to anonymity, to share our time with those we choose and to define our own space and boundaries. The great problem is that the use of information is blurring the notions of public and private spaces.

Survey after survey has shown that Canadians regard privacy protection as an essential concern in the information age. People the world over worry that we are increasingly losing the ability to choose when and where we want to be alone. We worry that we are losing control over our personal and private information. And we fear that such a loss diminishes our ability to function as unique individuals.

Like everyone here, the members of the Information Highway Advisory Council regard personal privacy and network security as vitally significant in harnessing information technology for our individual and collective benefit.

The Advisory Council, composed entirely of people from outside government, was established in April of 1994 to provide guidance to the Government of Canada in developing a Canadian strategy for the information highway.

The Council's deliberations were guided by three objectives: creating jobs through innovation and investment in Canada, reinforcing Canadian sovereignty and cultural identity; and ensuring universal access to the highway at reasonable cost.

Throughout its work the Council's operating principles were to support an interconnected and interoperable network of networks facilitate collaborative public and private sector development foster competition in facilities, products and services encourage lifelong learning, and ensure privacy protection and network security.

The final report of Phase I of the Council, issued in September of 1995, contains over three hundred recommendations. It would take several hours to list them all but I would like to give you a flavour of the basic themes.

The Council concluded that sustainable competition should be the driving force behind the information highway. Consumers will have more choice and lower costs if the move from monopoly towards competition is accelerated. Regulation should ensure an open market, a strong Canadian presence and a fair game for all competitors, new and old alike.

In Phase I of its work, the Council was also of the view that the federal government must move quickly to articulate and implement a national strategy for the information highway. And industry must move quickly to build Canadian connections to the highway.

Another major theme is the necessity of promoting Canadian culture and identity in an ever more global environment. That is a long-standing Canadian challenge, of course, but it is accentuated by the appearance, on the one hand, of new powerful transmission technology and on the other hand, the consequential disappearance of borders in our digital environment.

The Council also put stress on recommendations that emphasize the enabling effect of the information highway. New technologies will reshape the information industry but their real power in a business environment lies in their ability to allow all businesses to improve competitiveness, create new markets, promote quality, cut costs and serve customers faster and better.

Innovation is the key to growth in the knowledge-based economy. Research and development is critical to that innovation. We have a history of communications industry leadership in Canada but, in this new environment, a history is not enough. What counts is what we do today and tomorrow.

Another central theme running throughout the recommendations is that the information highway should be as accessible, affordable and relevant to Canadians as telephone and television services are today. Inequities in access created by geographic isolation, language, physical abilities, gender or lack of opportunity must be addressed.

And, of course, access to the highway must be matched by the know-how to use the services on the highway and to benefit from all the opportunities. This is why the Council put forth a host of recommendations to promote a culture of continuous learning. Opportunities to learn will be a critical measure of human progress in the information era.

The Council has singled out the health and education sectors as two area where strategic investments can help in reforming Canada's social infrastructure and simultaneously build on traditional Canadian strengths. New information applications can help make our health and education systems models to the world.

The final major theme of the Council's report goes to the heart of this conference. Individuals must remain at the forefront of the information revolution. Their interests and rights, especially in matters of access, security and privacy, must be protected. Privacy is part of the foundation of a civilized society.

In summarizing the themes of the Council's report in such a capsule fashion, I do not pretend to capture even a real sense of the detailed nature of the actual recommendations. I do hope, though, that this snapshot gives you an appreciation of the Council's belief in the importance of a coherent, coordinated and comprehensive strategy for the development of the information highway. Such a strategy will require sustained public consultation to ensure that specific means and ends are acceptable to Canadians. Indeed, this need for ongoing consultation and the forging of results through partnership is central to the Council's specific recommendations with respect to privacy and security.

What is clear to the Council is that finding privacy and security answers that meet Canadians' particular needs and aspirations requires the active involvement of a variety of stakeholders including, most importantly, the public.

The recommendations on privacy and security came principally from the analysis of the Council's Working Group on Access and Social Impacts. The Working Group was one of five such groups established to examine the variety of issues before the Council. From the outset, the Council understood that privacy and security are not mutually interchangeable terms. Security implies confidentiality but privacy implies the right to be left alone in the first place.

The Council also appreciated that privacy protection is a common sense application of the idea that the individual is not the instrument of the state or the marketplace.

In their submissions to the Council, Canada's Privacy Commissioners pointed-out that the distinctions between information held by the public and private sectors are more and more blurred. Canadians have certain legislative guarantees that government will protect their personal information-- but except in Quebec, no such guarantee exists for information held in the marketplace. As our host Bruce Phillips detailed in his 1995-96 Annual Report to Parliament, many Canadians feel that personal privacy and the security of personal information are being threatened not only by the new information technologies but also by moves towards downsizing, improving efficiency and privatization of government services.

The Advisory Council considered carefully the key privacy concepts of information control, informed consent, disclosure and accountability.

In proposing solutions, the Council considered ways to: limit the collection, use and retention of information, protect transactional data; develop cryptography, integrate systems; provide recourse; develop uniform standards, create criteria for access rights; and encourage public education.

There were a range of matters that raised and continue to raise real privacy challenges. If people give up their privacy rights in exchange for market benefits, will that lead to privacy only for the rich? Do women use the information highway less than men because of their greater privacy concerns? How can we encourage advances in health care research while safeguarding personal information? How do we ensure the proper functioning of law enforcement in the new information era?

The Council Working Group on Access and Social Impacts invited and received numerous submissions on the right balance of privacy protection responsibilities among governments, business and individuals. It received thoughtful advice on the potential for privacy protection offered by legislation, voluntary codes, privacy protective technologies and consumer education.

In many of its other recommendations, the Council called for the elimination of unnecessary legislation, regulations and barriers. With respect to privacy, however, the Council believes strongly that there should be national legislation to establish fair information practices on the information highway.

To ensure the protection of privacy rights in the information age, the Council recommends national framework legislation that would apply to both governments and the private sector. Canadians should have at least the same level of security and privacy from information highway services as they receive from telephone and mail services today.

The Council believes that a flexible legal framework for privacy legislation should require sectors or organizations to satisfy the principles enunciated in the Canadian Standards Association draft "Model Code for the Protection of Personal Information".

We need national standards supported by law, to provide Canadians with the assurance of a sound framework of fair information practices across the country.

Voluntary standards are useful for engaging business in the protection of personal information. The federal government should certainly continue to participate in the development of effective voluntary codes of practice, specific to the types of information involved.

There remains, however, the need for effective, independent oversight and the same rules for all parties. The federal government should work with the CSA as well as business, consumer organizations and other levels of government to develop independent oversight and enforcement mechanisms. The Council has recommended that the federal government co-operate with other levels of government in Canada to implement privacy standards or principles in all Canadian jurisdictions.

The federal government should also act to coordinate the development, demonstration and application of privacy enhancing technologies for the provision of government services and information. Legislation and policies applicable to its own operations should be updated.

As a further step, Industry Canada should establish a working group with members from the private sector, labour, consumer groups and other governments to increase public awareness and understanding of privacy issues. This working group could also examine the elaboration of possible safeguards to protect Canadians against misuse of information technology in the workplace. Industry Canada could encourage the CSA to advance its privacy standard internationally. The department should also require all providers of new Personal Communications Services to offer a basic level of privacy and/or security to all subscribers.

The Council has recommended amending the Criminal Code and the Radio-communication Act to make it illegal to intercept any radio-based telephone communication. The sale of digital scanners could also be banned except as authorized by the responsible Cabinet Minister.

The Council urges the provinces and territories to take steps to protect personal, student educational and training data.

The Council believes that in all of these matters, agreement among business, consumer groups and governments can and should lead to the use of fair information practices that can be understood and used by all parties equally. There needs to be federal leadership to achieve this quickly.

The Council believes that cooperation and innovation can help Canadians resolve privacy issues and pave the way for ensuring information and communications security on the information highway.

The Council addressed the key security issues of confidentiality, access control, integrity, authentication and non-repudiation. In addition, it was expressed that there should be a basic level of security on the information highway that provides message integrity and authenticity, as well as a reasonable expectation that communications intended to be private will remain so, and that other personal information will be protected.

We all recognize that security measures cannot offer absolute protection of information. In determining the level of basic security required, Canadians can look to the Security Guidelines adopted by the Organization for Economic Cooperation and Development. They state that security "should be appropriate to the value and degree of reliance...and to the severity, probability and extent of potential harm...."

The market should be relied upon to provide levels of security over and above the basic level and companies should be free to develop their own security encryption systems on the information highway.

It is clear, however, that consumers will expect certain equivalent standards of service and protection. It is also clear that it is in the interest of all Canadians to find the right balance among privacy, civil and human rights, law enforcement and national security and corporate efficiency on the information highway.

The process used to arrive at encryption algorithms and standards in Canada should be open to public scrutiny. There must be freedom of choice in the use of these algorithms and standards.

It is likely that broad-based security on the information highway in Canada will be achieved through several public key infrastructures to be built by different public and private entities. The federal government will certainly need to develop it own public key infrastructure in order to me its privacy, confidentiality and commercial needs and obligations.

The Advisory Council recommends that the government, private sector service providers and users, privacy advocates and other information highway stakeholders work together to implement the policies and framework for security infrastructure to support Canada's information highway.

An oversight body of information highway stakeholders should be created to address issues such as the selection, function, interoperability, cross-certification, privacy protection standards and other policy implications of public key infrastructure.

In the information age, firms must be able to verify the identity of customers and other enterprises with whom they are doing business over the information highway. Today, this is done with a very minimal level of security/authentication, etc with the Interac debit card system. In the future, a more comprehensive system facilitating these financial transactions will have to be developed. This system will be operated by a third party certification authority.

The federal government should play a leadership role to establish a common independent Canadian certification authority. This will act as a catalyst for the introduction of electronic commerce in both the public and private sector.

The federal government and the private sector should work in partnership to ensure that there is an effective network of cross-certification both nationally and internationally.

This Canadian public-private partnership should also work to develop and ensure the widest acceptance of national and international security standards.

Widespread use of electronic commerce will offer many new opportunities for growth ad job creation in Canada. For Canada to move to the head of the pack, a timely review of the pertinent legislation is essential to resolve legal issues currently surrounding electronic commerce.

This review should include the potential upgrading of federal legislation such as the Canada Evidence Act and the Interpretation Act to reflect the important role that electronic transactions and digital signatures will play on the information highway.

An ancillary action would be to amend the Copyright Act to make it a criminal offence to tamper with or bypass encryption technologies for the purposes of infringing copyright.

Equally important is a continued effort to achieve legislative uniformity across all Canadian jurisdictions and with our major trading partners.

The various privacy and security recommendations made by The Advisory Council comprise a very tall order. They are measures meant to enhance our competitiveness as a nation and to safeguard our rights and well-being as individuals. Meeting the challenges of privacy and security depends crucially on cooperation and good will across all sectors of our nation.

Perhaps nowhere does the information highway offer both more privacy concerns and more potential benefits for humanity than in the area of health care. We rightly consider our personal health records as next to sacrosanct. On the other hard, Canadians can and do benefit tremendously from health research using personal health information.

The Advisory Council believes that with sufficient thought and care in developing policies for the collection, preservation and use of health data, both individual rights and the public good can be balanced fairly.

Canada should adopt guidelines ensuring that the identity of health research subjects is protected with dignity and respect. Guidelines should continue to focus on standardised measures and technology to preserve confidentiality of records.

Researchers should continue with their processes for notifying, involving, educating and assuring the public about the objectives of research projects. There must be real transparency about the manner in which health databases are collected, managed, accessed, retained, disposed, linked and analyzed.

A coordinated consultation strategy should be developed with a wide range of stakeholders to work with the Canadian Standards Association and other interested bodies to create appropriate national standards.

In making these proposals for health care and other areas of privacy and security concerns on the information highway, the Advisory Council has attempted to offer a realistic plan for action.

I have given you a brief snapshot of the recommendations that the Council presented to the government in the fall of 1995. I am pleased to say that the government has not been idle since then and that in May of this year, it released a response to our report entitled Building the Information Society: Moving Canada into the 21st Century.

In this report, it was announced that as a means of encouraging business and consumer confidence in the Information Highway, the ministers of Industry and Justice, after consultation with the provinces and other stakeholders will bring forward proposals for a legislative framework governing the protection of personal data in the private sector.

In addition, the federal government intends to establish a key public infrastructure for government. This will be operational internally by 1997 and available for external partners by 1998.

It will also work in partnership with other levels of government, industry and other interested stakeholders to ensure to adoption of similar interoperable infrastructures across Canada.

Canadians are in the midst of a technological revolution that will transform our individual lives and our society. If we are to seize opportunity, we must anticipate change and fully exploit the vast potential of new information technologies. Canada has tremendous strengths, in our expertise, resources, talent, technology and democratic freedoms.

To build on those strengths, we must continue to preserve our principles as a society, including the cherished value of privacy, a value that helps us to define ourselves as unique human beings.

Thank you.