Alberta Information and Privacy Commissioner Diane McLeod says Alberta's privacy laws have not kept up with technology. (Photo: Government of Alberta)
Alberta's privacy laws are lagging behind technology, and if the province does not act quickly, personal information and technological innovations will be put at risk.
That's the message from Information and Privacy Commissioner Diane McLeod, who delivered an 85-page report as part of the bipartisan Standing Committee on Resource Management's legislative review of the Personal Information Protection Act (PIPA).
Her wish list of reforms includes new rules for political parties, artificial intelligence and social media companies, as well as creating a universal right for Albertans to access their personal information wherever it is stored.
MacLeod called it the “widest-reaching” proposal of his career as privacy commissioner.
“My fear is that all of this needs to be in place today and it's going to take years to actually get it done,” MacLeod told Alberta Today, “and who knows where we'll be by then. The target line's moving a bit.”
MacLeod said his approach is to be proactive in bringing organizations into compliance with the law, rather than reactively reacting by investigating violations.
Privacy watchdog groups said algorithms and artificial intelligence are already widely used by big tech companies, and states are looking to leverage the technology for innovation in health care.
“I know what's possible and what we can do because of the infrastructure we have in place in the state, including capital funding,” she said. “You don't have to look far to see where we're going and where we are.”
Last year, Innovation Minister Nate Grubish acknowledged that privacy legislation had not kept up with change and said the government was working “behind the scenes” to create the conditions for innovation in health care.
Regulation of political parties
When it comes to political parties storing voter data, MacLeod recommended that Albertans be given the right to access personal information held in political party databases “in their custody or control.”
Although British Columbia and Alberta's privacy laws are substantively similar and were enacted at roughly the same time, British Columbia is the only jurisdiction in Canada whose privacy regulations regulate political parties.
In Alberta, those protections are specifically excluded, and watchdog groups want to change that.
B.C.'s law was recently upheld by the B.C. Supreme Court, but McLeod expects the decision will go to the Supreme Court of Canada.
Anonymity and children's rights
MacLeod wants Alberta to make it clear that people have a right to know when automated decisions are being made, such as when reviewing resumes. Companies that do this should be required to be transparent and follow watchdog guidance, and the government should mandate guidelines.
If Albertans' data is used to train AI systems, it should be anonymized, she said.
She specifically noted the importance of special protections for minors using social networks and other technologies, an issue that has also been raised as a concern in other provinces, including the need to regulate large companies based outside Canada.
“There are real patterns of deceptive behavior in certain types of apps and software,” she said. “They try to manipulate behavior or influence decision-making. That's where we're looking. The Privacy Commissioner of Canada has issued a number of recommendations against this type of behavior.”
Her recommendations include changing PIPA to codify the “right to be forgotten” by giving people the right to request that their personal information be de-indexed or deleted.
Playing in the sandbox
Two years ago, Alberta introduced a regulatory sandbox to allow fintech companies to test new products with temporarily relaxed compliance requirements, and MacLeod said he wanted to participate in the sandbox alongside companies that are committed to privacy.
“Obviously it's much better for them to do it properly than for us to come in later and say they can't do what they're doing,” she said.
She urged the government to act quickly, despite the complex situation, or risk violating the right to privacy.
“They're not strong enough in the current environment,” she said.
