You're entitled to privacy… even online

We all know that companies are collecting our personal information online. What we sometimes forget to ask is: should they be? On September 24, the Ted Rogers Leadership Centre partnered with Ryerson’s Privacy by Design Centre of Excellence for an event that explored the ethics of online data collection, and the importance of reclaiming our digital privacy.

The event, titled “A.I., Privacy & Ethics,” featured a keynote by Ann Cavoukian, senior fellow at the Ted Rogers School of Management and distinguished expert-in-residence at the Privacy by Design Centre of Excellence. In addition to serving as Information and Privacy Commissioner of Ontario from 1997 to 2014, Cavoukian created the idea of “ (PDF file) Privacy by Design (external link) ,” now recognized internationally as the gold standard for privacy and data protection. In her talk, she emphasized that privacy is a right, not a privilege.

“Privacy is not about secrecy,” said Cavoukian. “It’s not about having something to hide. That could have been the model of the Gestapo police in the Third Reich—because, presumably, if you’re a law-abiding citizen, what’s the problem with the state knowing everything about you? What do you have to hide?

“Excuse me—that’s not what freedom is about. Freedom is about personal control on the part of the individual—that you get to decide how you want your information used.”

She also warned against the tendency towards “zero-sum, either/or thinking” that frequently dominates debates about online privacy.

“The traditional mindset of law enforcement is security and public safety at all costs—versus privacy. No—it’s not versus privacy. You want open, democratic societies? You need both. I want you to give me privacy and law enforcement. You have probable cause? You think a crime may have been committed? You get a warrant, and be my guest.”

Online citizens may be increasingly resigned to the loss of privacy as a fact of life, but research and public opinion polls show that they’re still not happy about it. With public trust of governments and corporations at an all-time low, Cavoukian believes that prioritizing privacy is not only good ethics—it’s also good business.

“What it says is: ‘We cannot use your information for any purpose, other than the primary purpose you intended.’ … The beauty of that model is, it builds trusted business relationships with your customers—and then, if you do ask them for permission for secondary use down the road, invariably your customers say yes, because you’ve built trust with them.”

“Positive-sum is win-win; zero-sum is win-lose; but zero-sum is the model that is prevalent in society. They think you can only do one versus the other.”

Cavoukian outlined the seven key principles of Privacy by Design: protective not reactive; privacy as the default setting; privacy embedded into design; full functionality; end-to-end security; visibility and transparency; and respect for user privacy (“keep it user-centric”).

She also pointed to encouraging developments: that Privacy by Design was unanimously adopted as an international framework in 2010 by the International Assembly of Data Protection Commissioners; that Privacy by Design was incorporated into the European Union’s General Data Protection Regulation; and that Canadian Parliament’s Standing Committee on Access to Information, Privacy and Ethics titled its 2017 report “Towards privacy by design.” Ryerson’s Privacy by Design Centre of Excellence is also thriving, with an online course through the Chang School and a Privacy by Design Certification program.

While some companies and governments will be reluctant to cede control, Cavoukian stressed that privacy is a competitive advantage. She concluded by quoting a colleague who told her, “‘If people are smart, they’ll lead with Privacy by Design … but if they mess up, they’re going to have a regulator at the door, and that’s the last thing that you want.’ So, avoid that at all cost, embed privacy proactively, and make it a win-win.”

*

In a typical week, Ryerson receives 1 million password guessing attempts. Want to protect yourself? October is Cybersecurity Awareness Month at Ryerson, and Computing and Communications Services has you covered. Learn phishing tips, encryption setup, safe computing ideas, two-factor authentication, and malware prevention at https://www.torontomu.ca/ccs/services/ITSecurity/.