Law Times

Page 10 March 19, 2018 • Law TiMes www.lawtimesnews.com Debate on seeking consent around personal information BY MARG. BRUINEMAN For Law Times H ow to seek consent from Canadian users to collect, use and dis- close their personal in- formation in the digital age is the subject of ongoing debate. It is also an area that could see the country's privacy watch- dog given more power to enforce legislation. As technology evolves, so, too, do the ways consent can be obtained to make it easier for us- ers. Federal Privacy Commis- sioner Daniel Therrien said in his 2017 report to Parliament in September that those often- lengthy policies and the lan- guage commonly used by orga- nizations make online consent waivers difficult to understand. He says they can be inadequate to meet the transparency and consent requirements under the Personal Information Protec- tion and Electronic Documents Act. He is working on developing new guidance on how compa- nies should ask Canadians for meaningful consent and he re- cently received the support of a parliamentary committee that examined the issues. But there is a primary obstacle in the entire process that may continue to elude those seeking solutions. "No matter how simple you make it, very few people read these things," observes Kirsten Thompson, a partner in McCar- thy Tétrault LLP's national tech- nology group and leader of the firm's national cybersecurity, privacy and data management group based in Toronto. "It's not until something looks weird or creepy or your information looks like it's be- ing used in a weird way that you actually go back to look at these things." The privacy commissioner wants organizations to make it easier for people to understand what personal information is being collected, with whom it is being shared, why the infor- mation is being collected, used or shared and what the risk of harm might be. In his recent discussion paper to the Standing Senate Committee on Transport and Communications, Therrien suggests approaches such as lay- ered privacy policies, using icons or graphical representation of how a user's information might be used, pop-ups or drop-down menus and just-in-time notices at the time of purchase or use to better convey what the user is consenting to and why. "Those general practices make good sense because, of course, organizations need to ensure that consumers are aware of what data about them is be- ing collected, how it's being used and ultimately be deemed to have given their implicit con- sent or, when appropriate, pro- vide their express consent," says Michael Fekete, a Toronto part- ner and co-chairman of Osler Hoskin & Harcourt LLP's tech- nology group. But Thompson sees challeng- es in adopting consent strategies as pop-ups because of the diffi- culties facing businesses having to re-engineer their websites to accommodate them. They may also not be terribly convenient for users who re- ally only seem to be concerned when they feel their trust has been misused, such as when a merchant uses the purchaser's information for marketing pur- poses, says Thompson. She sees the lived experience helps to de- termine what expectations are considered reasonable more so than privacy policy. While international inf lu- ences put pressure on Canada and its approach to privacy to ac- commodate international com- merce, the Canadian approach through PIPEDA is principle- based while those in other coun- tries, such as the United States, are much more prescriptive. Wendy Mee, a partner with Blake Cassels & Graydon LLP in Toronto, says a message or a prompt that brings the issue of consent to the user's attention at different times during their use of a website or application could be useful and practical for the user. "All of that is about being clear and making sure people understand what's going on, so they do feel comfortable engag- ing with the organization," she says. There is a recognition of the need to balance the information consumers should have while avoiding consent fatigue and disrupting the consent f low, she says. But she also hopes that the guidance is useful to companies and not an impediment to them. In the consent-based regime, she says, there is incentive for a company or organization to provide detailed information about what they will use the in- formation for and who they may need to disclose it to as a way of protecting themselves. "This also is where the bal- ance between providing more information and creating a longer consent form is weighed against providing shorter in- formation but then maybe the consumer doesn't even under- stand why you're asking for the information," she says. "I think it's possible to come up with something that's f lexible but still provides some helpful tips to our clients." Having a layered approach to consent is one that appeals to Mee. That allows users or consum- ers to consent upfront to provid- ing key information that could be followed by another layer of consent as they proceed further into the company's website or application. She also feels that real-time notices are more effective — that's when notices appear if the user seeks a functionality that FOCUS Wendy Mee says 'privacy is becoming more of an important issue.' See Indication, page 12 LEGAL PROFESSIONAL DEVELOPMENT LEARN | NETWORK | OBTAIN CREDITS In Class & Live Online Access 10 TH ANNUAL ADVERTISING AND MARKETING LAW CONFERENCE April 17 th | Toronto & Webinar 3 RD ANNUAL DUTIES AND RISK FOR DIRECTORS May 1 st | Toronto & Webinar 6 th ANNUAL Anti-Bribery and Corruption Compliance May 10 th | Toronto & Webinar COURSE LEADER: BRENDA PRITCHARD, GOWLING WLG COURSE LEADERS: STEPHANIE STIMPSON, TORYS LLP CORNELL WRIGHT, TORYS LLP COURSE LEADER: JOHN W. BOSCARIOL, MCCARTHY TÉTRAULT LLP • Changes | Trending now: Keeping you in the know • Québec - The Last Frontier • Privacy compliance: New technologies, changing law, and increased exposure • Transformation of Trademark Law in Canada and Beyond • Entertainment issues: CGC – Third party rights in disguise • Food, drugs and NHPS: The blurring lines • Influencer led disaster: More than meets the eye • The Necessity of Strategic Planning: In the Normal and Hostile Times • Subsidiary Governance and Managing Risks Abroad • Leveraging Technology to Protect What Matters • Cyber Risk • The Role of D&O Insurance • Introduction and overview of the anti-corruption landscape for Canadian companies • Anti-corruption enforcement: the view from the rcmp • The US foreign corrupt practices act (fcpa): what canadian companies need to know • An industry perspective on anti-corruption enforcement and compliance: The vie w from snc-lavalin • Perspective from in house counsel: key compliance challenges and solutions • Investigating potential breaches within the company and dealing with enforcement EARLY BIRD &95&/%&%50 MARCH TH EARLY BIRD ENDS APRIL 2 ND EARLY BIRD ENDS APRIL 9 th For questions and group rates, please contact: Toll-Free: 1-877-298-5868 Direct: 416-609-5868 Fax: 416-609-5841 Email: lexpert.questions@thomsonreuters.com *Discount applies to in-class only REGISTER NOW & SAVE OVER $300* www.lexpert.ca/legal-programs TAKE ADVANTAGE OF THE EARLY BIRD Untitled-4 1 2018-03-14 2:29 PM

• Cover