Does PIPEDA protect social media personal data?
By AdvocateDaily.com Staff
Companies like Facebook and Google — which have come under intense criticism for their handling of personal information — need to enter into a new social contract with their users or risk having one imposed by governments, says Toronto lawyer and mediator Howard Winkler.
“It’s time for a change in the social contract that Google and Facebook have with their users. It shouldn’t necessarily have to be the subject of legislation,” says Winkler, principal and founder of Winkler Dispute Resolution.
“I think that Google, Facebook and others should recognize that there are limits users want to put on the use and sale of their data. They should contemplate what those limits are, and give people an opportunity to opt out of certain uses of their data,” he tells AdvocateDaily.com.
Winkler points to revisions to the European Union’s General Data Protection Regulations (GDPR) as an example of how governments are responding to the massive privacy breach of Facebook users’ data through its ties with consulting firm Cambridge Analytica — a company which announced in early May that it was shutting down, CBC reports.
The GDPR changes, effective as of May 25, will enhance how personal data is protected by businesses and the public sector in 28 countries, and will have a particular impact on social media companies, Wired reports.
“The focus of those changes is requiring Facebook and Google to provide users with greater clarity in terms of what’s being collected and how their data is being used,” Winkler says.
He says the EU provisions are similar to what’s contained in Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), which is enforced by the privacy commissioner and governs the collection, use and disclosure of personal information by private-sector organizations.
“I think PIPEDA, in terms of covering the use of personal data, is sufficient, if properly enforced. What’s unresolved is how the privacy commissioner is going to interpret the existing rules in the context of Facebook and Google,” Winkler says, noting that in March, the commissioner opened an investigation into a complaint against Facebook with respect to Cambridge Analytica.
On May 24, the privacy commissioner announced it had published “two important new guidance documents — on obtaining meaningful consent and on inappropriate data practices — to help organizations ensure they comply with their privacy obligations in the digital age.”
The Facebook-Cambridge Analytica situation “is perhaps a catalyst for greater public understanding of how our information is being used and sold for commercial gain. And it’s started a useful dialogue that hopefully will result in people being able to continue to receive the services they want from Facebook and Google,” he says.
“At the same time, people should be able to place some limits on the use of their data to be more consistent with their expectations. I think that that likely is coming. But one has to recognize from Facebook and Google’s perspective, any kind of limitation on use and sale of data is going to affect their economic model, and so they’re going to be reluctant to change.”