Canadian Official Stumps for ‘Privacy by Design’ with U.S. Officials, Internet Giants
STANFORD, Calif. -- A Canadian official has been spreading to pivotal U.S. government figures, Internet companies and other thought leaders in recent days the gospel of her strategy, called Privacy by Design, for handling personal information on the Internet and elsewhere. Ann Cavoukian, the information and privacy commissioner for Ontario province, said late Wednesday at a Stanford Law School forum that she had received favorable receptions from FTC Chairman Jon Leibowitz and House Communications Subcommittee Chairman Rick Boucher, D-Va., for her view that for privacy to survive in a world of social media, cloud computing and constant electronic monitoring, defaults of confidentiality and user control must be baked into technologies and business models in addition to government rules.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
"The concept of Privacy by Design is growing very rapidly” around the world, Cavoukian said. She quoted Leibowitz as having told her, “We're on the same page on this.” Associate Director Maneesha Mithal of the FTC Division of Privacy and Identity Protection said Leibowitz and David Vladeck, the Bureau of Consumer Protection director, met recently with Cavoukian at her request. The commission deals with foreign officials a great deal concerning privacy, an international issue, and “she’s been a real leader” on the subject, Mithal said. Like Cavoukian, “we think it’s a great idea for us to be baking privacy into these products from the beginning,” and for companies to shape their business models along those lines as part of self-regulation, but the FTC hasn’t taken a position on any new legislation, she said. Peter Hustinx, the European Union’s data-protection commissioner told Cavoukian that his office is using Privacy by Design principles in a proposal for a new legal framework, Cavoukian said. She pointed to Ontario’s Personal Health Information Protection Act as “an outstanding law that doesn’t stand in the way of the delivery of health care.” The Act, and short, plain-language patient notices that her office worked with the Ontario Bar Association on, are models for improving U.S. medical-privacy disclosures, Cavoukian said, and her office is offering help in that.
Cavoukian said she had visited Google’s and Facebook’s Silicon Valley headquarters this week in addition to keynoting at a privacy conference at Stanford. She said she asked unspecified Google representatives to increase privacy protections in Street View beyond the minimum required. Google would say only that the participants “discussed a number of topics, including how we build user transparency and control into all of our products.” Cavoukian also met with Nokia representatives, her spokesman told us Thursday. He wouldn’t discuss the meetings other than to say there had been “a good exchange” at each. Cavoukian discussed at the forum an op-ed piece this month in Toronto’s Globe and Mail disputing what she said was a mischaracterization of a comment by Facebook CEO Mark Zuckerberg as having called privacy expectations dead. She said that in a talk at the company’s headquarters she had warned, “Beware: The tide may turn” toward stronger privacy demands.
"Commissioner Cavoukian’s earlier meeting with FTC Chairman Leibowitz was to reinforce the Privacy by Design message contained in our public submission to the recent FTC consultation,” her spokesman said, referring to a letter from her late last month to commission officials in connection with the FTC’s third privacy roundtable, March 17 in Washington. “Similarly, Commissioner Cavoukian met with Rep. Boucher to explain how Privacy by Design could fit with proposed new privacy legislation.” Under an “outreach mandate,” Cavoukian has met many public officials, in Ontario and beyond, “the past two years to discuss various privacy issues and to advocate for Privacy by Design,” the spokesman said. Representatives of Boucher and Facebook didn’t get back to us right away Thursday.
The campaign by Cavoukian, well known in her country, seems to have flown under the radar of U.S. media. Blog and Google News searches Thursday turned up mentions of her only in Canadian outlets in recent weeks. But any inroads she has made in the U.S. the past month aren’t her first. In December, the Center for Democracy & Technology made Cavoukian’s principles the centerpiece of an 11-page comment filed with the FTC for its roundtables. In November, Arizona State University had set up a Privacy by Design Research Lab inspired by Cavoukian’s work.
Cavoukian gave her keynote Monday at the Intelligent Privacy Management Symposium of the Association for the Advancement of Artificial Intelligence. The event, which ran through Wednesday, “attracted AI researchers, legal scholars, computer scientists and people from business” from Europe and Asia in addition to North America, said organizer Mary-Anne Williams, a lawyer and engineer who teaches at the University of Technology, Sydney, Australia. The conference was prompted by “a significant and growing need to identify privacy requirements in application development and to use intelligent technology-enabled solutions to assist users to monitor and manage their personal information, she said.
Cavoukian developed Privacy by Design in the 1990s, but only more recently has it come into full flower with a marketing logo appearing even on refrigerator magnets. Contrary to the views of people such as Google CEO Eric Schmidt who have contended that privacy isn’t important to those who have nothing to hide, she said, it’s essential to human freedom and development. Cavoukian said others, including former Stanford law Professor Lawrence Lessig, are thinking along the same lines.
The FTC is taking a “very strong position” on behavioral advertising, Cavoukian said. “I was truly surprised by the level of displeasure expressed by the public” about monitoring and collection of data about online activity, she said, especially because it doesn’t involve personally identifiable information.
Privacy protection must be treated as a “win-win” by all the players, instead of the conventional tradeoff with public security and marketing interests, Cavoukian said. Companies should recognize that respecting privacy builds needed customer trust and should market themselves as protectors of information, she said. Cavoukian said she’s very excited about George Tomko’s SmartData proposal for automated intelligent agents to protect and secure information about each person according to individual preferences.
"I'm very optimistic that we can do this in a way that is mutually enabling rather than mutually exclusive,” Cavoukian said. This isn’t just a nice-to-have, she said. The only alternative is that “privacy loses,” and “that’s unacceptable,” Cavoukian said.
The dominant “zero-sum” calculus “crystallized after 9/11,” Cavoukian said, and she conceded that she hadn’t stood up to it properly. “It was almost pictured as unpatriotic if you were for” privacy, Cavoukian said. She said she took the position that “public safety is paramount, but balanced against privacy.” If Cavoukian could go back and change the formula, she said, she would end it with “as is privacy.” She said her “mantra increasingly is to try to replace the ‘versus’ with an ‘and.'"
Turning policy around won’t be “easy to achieve,” Cavoukian acknowledged, because Privacy by Design principles “raise the bar of protection.” But “the bar needs to be raised,” she added.