The office of Canada’s privacy commissioner is urging Ottawa to change its digital privacy bill, amid concerns it will open the door to private companies swapping personal information without any consent or notification – a concern many drivers have about sharing their driving data through usage based insurance.
Bill S-4 is aimed at overhauling the rules for online privacy, giving new power to the Privacy Commissioner and introducing new penalties for privacy breaches. It is one of a handful of new bills before Parliament with implications over how Canadians’ private online information should be shared.
Bruce Green, the senior manager of rates and classifications with the Financial Services Commission of Ontario, says it is one of the major fears of drivers when it comes to whether they decide to choose to install a telematics device in their vehicle.
“Consumers have a fundamental lack of understanding about insurance, and the press has had quite a field day with UBI,” says Green. “Many people see telematics as another layer of oversight – ‘Big Brother’ looking over their shoulder.”
In Senate testimony, however, experts have broadly opposed a provision in Bill S-4 allowing private companies to voluntarily share data between them – without telling those people or the commissioner whose personal information is being swapped – to investigate whether a law or “agreement,” such as a contract, has been broken.
Experts fear that will open the floodgate to warrantless data-sharing with only a nominal threshold to justify it. (continued.)
#pb#
The change “could lead to excessive disclosures that would be invisible both to the individuals concerned and to our office,” Patricia Kosseim, the privacy commissioner’s senior general counsel and director general, said to a Senate committee, urging government to reconsider the amendment.
“The privacy concerns speed up very quickly. You need to state that you are only collecting this amount of data, and only sharing it with this particular company,” says Fred Carter, the senior policy and technology advisor to the commissioner, of the Office of the Information and Privacy Commissioner of Ontario.
“The Government Accountability Office in the U.S. did a study on in-vehicle telematics that they released in December, and they found in every case there were disclosures of information to third-party without the knowledge of an individual.”
When people don’t understand what’s happening, trust erodes says Carter.
“Telling what you are going to do with the data is important, but it is also important to say what you are not going to do with the data,” he says. “People don’t read these long, complicated policies. They look for other indicators of trust. It is all about saying what you do and doing what you say.”
Insurers that are actively promoting telematics - like
Desjardins through their Ajusto program - categorically state that the data gathered from drivers is firewall protected and remains anonymous. However, Alex Veilleux, chief product manager of UBI for
Desjardins, has acknowledged that the data is being sold to a third party, but stresses that the data cannot be identified with any particular individual, and privacy concerns have been met.
One suggestion made at the recent Telematics Canada conference in Toronto was to emulate a practice used by the European Union, says Carter.
“The European Union has the ‘Right to Be Forgotten,’ which stipulates that once you’ve accomplished using that data for a specific purpose, you must delete it,” he says. “There’s no reason to keep it – unless there is some other rule or law to do so – like keeping sales transactions for seven years for Revenue Canada.”
