latest developments at the ipc - information and privacy … › wp-content › uploads › 2017 ›...
TRANSCRIPT
![Page 1: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/1.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Latest Developments at the IPC Brian Beamish
Information and Privacy Commissionerof Ontario
WINDSOR
November 30, 2017
![Page 2: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/2.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Our Office • Commissioner appointed by, and
reports to, the Legislative Assembly to ensure impartiality
• Provides independent review of government decisions and practices on access and privacy
• Oversees compliance for threeaccess and privacy laws
![Page 3: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/3.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
IPC’s Legislation• Freedom of Information and Protection of Privacy Act (FIPPA)
• over 300 provincial institutions such as ministries, provincial agencies, boards, commissions, community colleges and universities
• Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)• over 1,200 organizations such as municipalities, police, school boards, conservation
authorities, transit commissions
• Personal Health Information Protection Act (PHIPA)• individuals and organizations involved in delivery of health care services, including
hospitals, pharmacies, laboratories, doctors, dentists and nurses
![Page 4: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/4.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
ACCESS
![Page 5: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/5.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Access Requests per Year
11,148
20,78822,761
36,739
45,159
61,752
0
10,000
20,000
30,000
40,000
50,000
60,000
70,000
1 2 3 4 5 6
![Page 6: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/6.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Appeals Received per Year
2006 2011 2016
8931,124
1,548
![Page 7: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/7.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Access to Information Orders
2011 2016
96
12390
118
Municipal Orders Provincial Orders
![Page 8: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/8.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Mediation: Critical to Our Success
• Usually, 75 per cent of appeals and almost all privacy complaints are closed before adjudication/investigation
• Goal is to find a resolution which satisfies the needs of all involved• Saves significant time and resources for all parties
![Page 9: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/9.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Reasonable Search
• Institutions must conduct reasonable searches for records
• Considerations:o clarification of requestso review of files in all formatso documenting details of search
![Page 10: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/10.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Frivolous and Vexatious Requests
• What makes a request frivolous or vexatious? o abuses right of access:
excessive, broad, duplicativeo pattern of conduct interfering
with operationso ulterior motives
![Page 11: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/11.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Instant Messaging and PersonalEmail Accounts
• Personal email accounts and instant messages may be subject to access and privacy laws
• Key issues:o are they being used to conduct
government business? o search and retrievalo retention and preservationo privacy and security
• Best practice: prohibit use for government business
![Page 12: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/12.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
PRIVACY
![Page 13: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/13.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Privacy Complaints Opened per Year
2006 2011 2016
170
266 277
![Page 14: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/14.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
PHIPA Complaints Opened per Year
2006 2011 2016
269346
537
![Page 15: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/15.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
The Philadelphia Model • Annual meeting of advocates and
representatives from the Women’s Law Project
• search though police sexual assault files — alongside high-ranking officers — to look for deficiencies and biases
• Since implementation in 17 years ago, the “unfounded rape” ratehas dropped to four per cent, in contrast with the national averageof seven per cent Globe and Mail Series:
“Unfounded”
![Page 16: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/16.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Working with Police on Ontario-basedPhiladelphia Model
• Identify external partners with the experience to assist with the review of sexual assault files and appoint them agents of the service
• Ensure external reviewers have background check, sign an oath of confidentiality and receive privacy and confidentiality training
• Require external reviewers to see names of principals so they can recuse themselves if needed
• Permit external reviewers to review complete closed files, subject onlyto redactions or restrictions required by law
• Ensure reviews take place at police facilities and no identifying information is copied, retained, or removed by agents
![Page 17: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/17.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
MOU for Use by Ontario Police• IPC worked with police to develop
a model Memorandum of Understanding and Confidentiality Agreement
• Sets the terms for the review of sexual assault cases by police and external reviewers
• Kingston Police are first to put into practice
![Page 18: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/18.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Mandatory PHIPA Breach Reporting
• As of October 1, 2017, health information custodians must notify IPC of certain privacy breacheso Use or disclosure without authorization o Stolen informationo Further use or disclosureo Breaches occurring as part of a pattern o Breaches related to a disciplinary action
against a college or non-college membero Significant breaches
![Page 19: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/19.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
210
220
230
240
250
260
270
280
2016 2017(Nov. 24)
Breach Report Files Opened
Health Privacy Breach Statistics
• Out of the 271 reported breaches to date in 2017:
• 43 were snooping incidents• 8 were ransomware/cyberattack
• Remaining 220 were related to: • lost or stolen PHI• misdirected information• records not properly secured• general collection, use and disclosure
271
233
![Page 20: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/20.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Health Privacy Breach ReportFiles Opened
2016 2017
20
38
2229
October November(Nov. 24)
![Page 21: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/21.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Recent PHIPA Prosecution • Administrative support clerk in the emergency department
of a GTA hospital• Illegally accessed health records of 44 individuals, in some cases printing
their personal health information• October 2017 the clerk pled guilty and the court imposed a $10,000 fine
![Page 22: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/22.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Annual PHIPA Privacy Breach Statistics
• As of March 2019 health information custodians must provide IPC with an annual report on privacy breach statistics
• Volume of breaches from theprevious year
• Number of incidents when personal information was:
o stoleno losto used without authorityo disclosed without authority
• Reports submitted online through IPC’s statistics tracking website
![Page 23: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/23.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Online Educational Services • School boards must ensure online
educational services do not putprivacy of students and familiesat risk
• IPC partnership with OntarioAssociation of School Business Officialsto provide guidance to educators
• Workshop at Bring IT TogetherConference “Privacy Implicationsin the Networked Classroom”
![Page 24: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/24.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
2017 GPEN Privacy Sweep • Collaboration with the Office of the
Privacy Commissioner of Canada• Review of educational applications
for children and youth• Part of a larger annual privacy
sweep coordinated by the Global Privacy Enforcement Network
![Page 25: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/25.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
2017 GPEN ReportLessons Learned:
• Privacy policies and terms of service were often lengthy, challenging to understand
• Collection and disclosure of student personal information could occur via mobile apps, social login, and browser tracking cookies
• Two-thirds of online services did not have an clear policy on deleting dormant or inactive accounts
![Page 26: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/26.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
DATA ANALYTICS
![Page 27: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/27.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Data Analytics
• Data analytics have changed how we thing about and use data• New combinations of data may reveal hidden patterns and insights• Data integration (sharing, linking and analyzing data) can enhance:
o policy developmento system planningo resource allocationo performance monitoring
![Page 28: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/28.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Privacy Risks of Data Analytics
• Use of poorly selected data sets that:o lack information, are incompleteo contain incorrect or outdated informationodisproportionately represent certain populations
• Pseudo-scientific insights that assume correlation equals causation• Lack of knowledge/transparency regarding the inner “logic” of the system• If not designed properly, can result in the use of personal information in
ways that are invasive, inaccurate or discriminatory
![Page 29: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/29.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Public Education• Helps individuals understand what
big data is and how it can impact their privacy
• Discusses key issues, such as: o proportionalityo accuracy of resultso bias in data setso individual rights
![Page 30: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/30.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Big Data Guidelines• Technical focus on big data project
design• Best practices in data:
o collection o integrationo analysiso profiling
![Page 31: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/31.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
De-Identifcation Guidelines
• Best practices for removing personal information from a record or data set
• Guidelines recognized at 39th International Conference of Data Protection and Privacy Commissioners
• Received the inaugural global privacy and data award for excellence in research
![Page 32: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/32.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
LEGISLATION
![Page 33: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/33.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Child, Youth and Family Services Act
• Sector to be subject to access and privacy rules • Once proclaimed, service providers like children’s aid societies
will be required to:o get consent for the collection, use and disclosure of personal informationo report serious privacy breaches to the IPC
• Individuals will have the right to access personal information recordsheld by service providers and if required, request corrections
![Page 34: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/34.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Child, Youth and Family Services Act
• The IPC is working with the Ministry of Children and Youth Services, the Provincial Advocate for Children and Youth, the child welfare sector and other sectors to support implementation
• Consultation and collaboration to inform guidance materials and public awareness efforts o supports tailored to young people and other specific groups
(e.g., Indigenous communities)o tools, training and information for service providers and the publico dedicated phone line for CYFSA inquiries
![Page 35: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/35.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Police Services Act• IPC recommendations to the
Ministry of Community Safety and Correctional Services on its Strategy for a Safer Ontario, which includes a review of the Police Services Acto strong governance frameworkso province-wide standards o amendments to ensure transparency
and accountabilityo engagement with our office and
other key stakeholders
![Page 36: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/36.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
Next – Panel Sessions Session A: Key Developments in Access and Privacy (Katzman Room) • Brian Beamish, Commissioner• Sherry Liang, Assistant Commissioner
Session B: Protecting Personal Health Information (Oak Room) • Manuela DiRe, Director of Legal Services• Debra Grant, Director of Health Policy
![Page 37: Latest Developments at the IPC - Information and Privacy … › wp-content › uploads › 2017 › 11 › 2017-11... · 2017-11-30 · o privacy and security • Best practice:](https://reader033.vdocuments.us/reader033/viewer/2022060321/5f0d3bc37e708231d43954b3/html5/thumbnails/37.jpg)
Information and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.caInformation and Privacy Commissioner of Ontario | www.ipc.on.ca
CONTACT USOffice of the Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400 Web: www.ipc.on.ca
Toronto, Ontario, Canada M4W 1A8 E-mail: [email protected]
Phone: 416-326-3333 / 1-800-387-0073 Media: [email protected]/416-326-3965
TDD/TTY: 416-325-7539