Beyond Personal Information: A Path to Protect Canadians Against Digital Harms

Résumé analytique

This policy memo argues that Canada's existing privacy frameworks cannot address the individual and collective harms raised by digital platforms because they focus on protecting personally identifiable information rather than all forms of what Teresa Scassa calls human-derived data. Platforms collect data ranging from geolocation, social media activity, and wearable health information to shopping and browsing behaviour; once de-identified and aggregated, this data is mined to infer the patterns, preferences, and behaviours of groups. Because inferences can be drawn without personal identifiers, people can be profiled, sorted into groups outside legally protected categories, and discriminated against without knowing it. Re-identification also remains a risk: a 2009 study by Harvard professor Latanya Sweeney re-identified the names of over 40% of participants in an anonymous DNA study.

Canada's Privacy Act and PIPEDA both define personal information as information about an identifiable individual, leaving a significant gap around non-identifiable data. Bill C-27 (the Digital Charter Implementation Act, comprising the Consumer Privacy Protection Act, a data protection tribunal, and the Artificial Intelligence and Data Act) introduces de-identification and children's protections but leaves much to be desired.

The memo recommends amending Bill C-27 to protect all human-derived data, prohibit re-identification of de-identified data, empower the Office of the Privacy Commissioner to enforce and audit both sectors, and define legitimate commercial interest and public good. It also calls for strengthening AIDA into a robust, rights-based framework governing high-impact algorithmic systems.