Tech change outpacing Alberta’s privacy protections

By Catherine Griwkowsky June 17, 2024
Photo of a white woman with brown hair wearing a turtleneck.

Alberta information and privacy commissioner Diane McLeod says that Alberta’s privacy legislation is lagging behind technology. (Photo: Government of Alberta)

Alberta’s privacy legislation is lagging behind technology, and if the province does not act fast, personal information and technological innovation is at risk.

That is the message from information and privacy commissioner Diane McLeod, who submitted an 85-page report as part of a legislative review of the Protection of Personal Information Act (PIPA) by the all-party Standing Committee on Resource Stewardship.

Her wishlist for reform includes new rules for political parties, artificial intelligence and social media companies and the creation of a universal right for Albertans to access their personal information anywhere it is stored.

McLeod called it the “broadest” submission she has made in her career as a privacy commissioner.

“I’m concerned that all of this stuff needs to be in place today, and I’m concerned that it’s going to take years to actually get it in place,” McLeod told Alberta Today. “And by then who knows where we’re going to be? It’s a bit of a moving target. ”

McLeod said her approach is to be proactive at bringing organizations into compliance, rather than reactive by investigating breaches of the act.

The privacy watchdog said that algorithms and artificial intelligence are already being used extensively by big tech companies and the province is trying to utilize that technology to innovate in the health sector.

“I know what’s possible, and I know what we’re capable of, because of the infrastructure that we’ve put into the province, including the capital funding,” she said. “You don’t need to look too far to figure out where we’re headed and where we are.”

Last year, Technology and Innovation Minister Nate Glubish acknowledged privacy legislation has not kept pace with change and that the government is working “behind the scenes” to create the conditions for innovation in health care.

Regulating political parties

When it comes to political parties storing data on the electorate, McLeod recommended Albertans be given the right to access their personal information that is in “the custody or control of” party databases.

While British Columbia and Alberta’s privacy legislation is substantially similar and was written around the same time, B.C. is the only jurisdiction in Canada where privacy rules regulate political parties.

In Alberta, those protections are explicitly excluded — something the watchdog wants changed.

B.C.’s laws were recently upheld by the B.C. Supreme Court, but McLeod suspects the decision will make its way to the Supreme Court of Canada.

Anonymity and children’s rights

McLeod wants Alberta to spell out that people should have a right to know when automated decision-making is being used, such as during resume screening. Companies that do so should be required to be transparent, per the watchdog, and the government should mandate guidelines.

In cases where Albertans’ data is being used to train AI systems, it should be anonymized, she said.

She singled out the importance of special protections for minors who use social networks and other tech, something other provinces have also raised as a concern. That would require regulating large firms that are based outside of Canada.

“Certain kinds of apps, software, actually have deceptive patterns,” she said. “What they do is they try to guide behaviour or influence decision making. And so that’s what we are focused on —  Canada‘s privacy commissioners are making lots of recommendations against these kinds of practices.”

Her recommendations also include changing PIPA to codify the “right to be forgotten” by giving people the right to request their personal information be de-indexed or deleted.

Playing in the sandbox

Two years ago, Alberta introduced regulatory sandboxes, allowing fintech companies to experiment with new products with temporarily reduced compliance requirements. McLeod said she wants to get into the sandbox with companies that are preserving privacy.

“It’s obviously a lot better for them to get it right than to later have us come along and tell them that they can’t do what they’re doing,” she said.

Despite the complexity, she urged the government to act swiftly or risk privacy rights being undermined.

“They’re not strong enough in this current environment,” she said.