On November 27, our Section Chair, Molly Reynolds, sat down by the virtual fireside with Ontario’s new Information and Privacy Commissioner (IPC), Patricia Kosseim, for a chat on the future of privacy and access laws in Ontario. While the circumstances that met Commissioner Kosseim on arrival in office were unusual, to say the least, that hasn’t stopped her from hitting the proverbial ground running. From tackling COVID-related issues to staying active on the IPC blog, Commissioner Kosseim has been keeping busy. Fortunately, Molly was able to get the dirt on these activities and more in an edifying hour of insights, including Commissioner Kosseim’s views on our most burning question: are we likely to see made-in-Ontario private sector privacy legislation in the near future, despite the federal government’s recent tabling of Bill C-11?
- Commissioner Kosseim’s first impressions of the new role
Having begun her five-year term in July of this year, Commissioner Kosseim spoke candidly about the challenges associated with taking on a new leadership role in the midst of a pandemic. She has encountered the typical learning curve, but with a global health crisis twist. Each morning, Commissioner Kosseim meets with a task force to address the COVID-related issues of the day: equipping and training staff on new technology, handling health and safety matters and, importantly, paying close attention to the mental wellbeing of staff – all while finding her stride on the substantive issues. Over the past several months, the IPC has been regularly updating FAQs on the website and issuing guidance to the public sector on remote work arrangements. As part of her 100-day plan, Commissioner Kosseim has also been familiarizing herself with enabling laws, reaching out to her federal, provincial and territorial counterparts and other Officers of the Ontario Legislature, and meeting with leaders across the health, provincial, municipal and child and youth sectors to get to know her stakeholders.
- Significant policy matters addressed in recent months
In her initial days in office, Commissioner Kosseim’s first order of business was to collaborate with counterparts across the country, including the federal Office of the Privacy Commissioner (OPC), to assist with the development of Canada’s exposure notification app: COVID Alert. The IPC worked directly with the provincial government, while the OPC stayed in close communication with Federal Health Canada, to provide guidance at both levels on the security and privacy requirements, and the accountability and governance structure, required to ensure a smooth rollout of the app. Notably, Ontario accepted all of the IPC’s recommendations for the app, including that it be voluntary, that the IPC be notified of any changes to the design, that measures be taken to review its ongoing effectiveness, and that the app be decommissioned once it is no longer achieving its purpose. A good case study on iterative and dynamic collaboration between government officials and regulators across the country, Commissioner Kosseim is confident that the groundwork Ontario and the federal government have set with COVID Alert will serve as a helpful template for other provinces moving forward.
Another recent policy file of note concerns the use of body-worn cameras. With a spotlight on the Black Lives Matter movement, and given some of the tragic deaths and injuries resulting from police-civilian encounters, notably in the Indigenous community, Commissioner Kosseim feels that transparency and accountability in this area have increased in relative importance. While Commissioner Kosseim’s previous positions required her to use a privacy-centric lens, in her new role she must be equally sensitized to issues of accountability and access. Consequently, she has found herself re-examining this policy issue through new eyes. Working with Toronto Police Services (TPS) and their oversight board, the IPC provided recommendations on a governance framework that balances access, transparency and privacy considerations when employing body-worn cameras. TPS has since adopted a policy that includes clear guidelines around notice, secondary use, retention, training, security features, third party agreements, the use of cameras at protests, and a moratorium on the use of facial recognition technology. Further, checks and balances have been established in the form of audit, recordkeeping, public reporting, timely disclosure to police oversight bodies, and notification requirements to the IPC in the event of a breach or any changes to the privacy impact assessment. While TPS is furthest along in piloting the body-worn camera program, Commissioner Kosseim is confident that the work they have done with TPS and the TPS Board will serve as a model for other police services when considering the adoption of such a program.
Please log in to read the full article.