Research publications

Some of the technological advances that have emerged in the last few years have had or could have a significant impact on privacy and data protection. For instance, federal privacy laws are not necessarily equipped to respond to the challenges presented by the growth of online services, e-commerce, the Internet of Things, and technology companies’ use of increasingly powerful algorithms and artificial intelligence (AI). Thus, a number of recommendations have been made to amend privacy legislation to address these issues.

One of the pillars of the law is predictability. Yet decisions of Canada’s highest court on the expectation of privacy and police powers are so hard to predict that they resemble a house of cards on the verge of collapse. Furthermore, many unknowns are involved, such as technological changes and the makeup of the Supreme Court of Canada.

In an era of rapid technological advances in which giant social media corporations have access to the data of millions of users and data breaches occur frequently, privacy has become a topic of much discussion and interest. How can privacy be protected? What principles should organizations follow to protect personal information when developing new digital services and tools? At what point should privacy become a consideration in the lifecycle of a service or product? One framework, called Privacy by Design (PbD), is widely recognized as an effective means to protect the privacy of individuals. This HillNote examines PbD’s originand purpose and how it has been recognized at the national and international levels.

Intelligence agencies around the world, including the Communications Security Establishment (CSE), are increasingly acquiring, analyzing, using and sharing publicly available information. Given the scale of data involved, artificial intelligence (AI) – particularly machine learning (ML) – and cloud computing will be vital, as will broader definitions of “publicly available” in privacy law. This HillNote discusses how technological advancements and an explosive growth in publicly available information have made CSE and its domestic partners interested stakeholders in anticipated changes to Canada’s privacy law.

Today, artificial intelligence (AI) is everywhere and can be found in search engines, connected cars, smartphones and chatbots such as ChatGPT. An AI system poses privacy risks throughout its lifecycle. These risks occur right from the initial collection of the data that trains the AI model driving the system. Once on the market, some powerful AI systems can pose additional privacy risks. For example, they can aggregate unrelated personal information to create new insights about a person that the person has not disclosed themselves. AI systems can also distort sensitive biometric information, such as a voice or a face, to create deepfakes, which may fuel the growth of online misinformation and disinformation.