Canadian IT Law Association annual conference

I just signed up to attend the fall IT-Can conference, and thought the conference was worth mentioning.  It is a consistent high quality conference for lawyers practicing in the IT/IP fields, and for others such as CIO’s.

Topics this year include fintech, quantum computing, blockchain and smart contracts, connected vehicles, big data, health care tech, cybersecurity, and control over online content.

Perhaps I’ll see you there in Toronto on Oct 23.

Cross-posted to Slaw

PIPEDA privacy breach notification regulations published for comment

The draft privacy breach regulations under PIPEDA have just been published.  They are open for comment for 30 days.

These regulations detail the mechanics of notifying the Privacy Commissioner and individuals when there is a privacy breach.   PIPEDA was amended some time ago to require mandatory notification when there is a breach that results in “real risk of significant harm”.  Those provisions will come into force after the regulations are passed.

The draft regulations are about what were expected.  They are similar to those under Alberta privacy legislation.

I agree with David Fraser’s view that section 4(a) that says notification to individuals can be sent “by email or any other secure form of communication if the affected individual has consented to receiving information from the organization in that manner” is uncalled for.  A notice of this nature is not spam, and it does not make sense to require that an individual has given consent for communication in that manner to notify of a privacy breach.  These notifications are for the benefit of the individual, so why make it harder for organizations to send it?

The amendments and regulations have provisions requiring organizations to keep records of all privacy breaches, including information that allows the Privacy Commissioner to determine if the organization properly considered the notice threshold tests.  In other words, organizations must be able to prove that any decision not to notify was justified.

Cross-posted to Slaw

Artificial Intelligence and the Legal Profession

Artificial Intelligence is going to have a disruptive effect on the legal profession.  The question is how soon, how much, and what areas of law come first.  This kind of disruptive change builds up slowly, but once it hits a tipping point, it happens quickly.

Futurist Richard Worzel wrote an article titled Three Things You Need to Know About Artificial Intelligence  that is worth a read.  Here are some excerpts:

Every once in while, something happens that tosses a huge rock into the pond of human affairs. Such rocks include things like the discovery of fire, the invention of the wheel, written language, movable type, the telegraph, computers, and the Internet. These kinds of massive disturbances produce pronounced, remarkable, unexpected changes, and radically alter human life.

Artificial Intelligence is just such a rock, and will produce exactly those kinds of disturbances. We’re not prepared for the tsunami that AI is going to throw at us.

But now AI is becoming a reality, and it is going to hit us far faster than we now expect. This will lead to an avalanche of effects that will reach into all aspects of our lives, society, the economy, business, and the job market. It will lead to perhaps the most dramatic technological revolution we have yet experienced – even greater than the advent of computers, smartphones, or the Internet.

The legal profession seems to be particularly susceptible to early occupation by AIs:

“At JPMorgan Chase & Co., a learning machine is parsing financial deals that once kept legal teams busy for thousands of hours. The program, called COIN, for Contract Intelligence, does the mind-numbing job of interpreting commercial-loan agreements that, until the project went online in June, consumed 360,000 hours of work each year by lawyers and loan officers.”

So, before June of 2017, lawyers and loan officers spent 360,000 hours a year interpreting commercial loan agreements for JPMorgan Chase. Since June, that specific kind of work has vanished.

Cross-posted to Slaw

I’ve got nothing to hide…

“I’ve got nothing to hide” is a common retort from people who are blasé about privacy.  Their point is that they have done nothing wrong, so they don’t care how much of their information and habits are public.

The flaw in that retort is that information about us can be used in many ways and for many things that we might not expect.  And things that we may think are normal and innocuous may be offensive to others who can make life difficult because of it.  For example, the US Justice department is trying to get the names of over a million people who visited an anti-Trump website from Dreamhost.  Using a VPN gets more attractive every day.

For more on this, I’ve written about it here and here.  For a deeper dive see this academic paper.

Cross-posted to Slaw

Transport Canada publishes draft drone rules – still not hobbyist friendly

In March I wrote about Transport Canada’s overly restrictive drone rules.  A few weeks ago they lightened those rules a bit.

Transport Canada just released draft permanent rules for comment.  They propose a complex set of rules that vary among 5 different categories of drone.  While the proposed rules will make commercial use a bit easier, they are not friendly to personal use.

MobileSyrup details the proposed rules and comments that: “The new rules, if approved, would dramatically reduce the paperwork burden on both Transport Canada and commercial drone operators, but they would also increase the costs for all pilots while their impact on air safety remains uncertain.”

Unless the drone is 250 grams or less, even hobbyists must have insurance, and must pass a written test.  Drones must also be compliant with a yet to be named standard.

This is being done in the name of safety, but strikes me as being overly complex and burdensome.  The rules are open for comment until mid October.

Cross-posted to Slaw

Feds crack down on use of word “banking” by non-banks

OSFI just issued an advisory threatening to bring criminal sanctions against non-banks that use the words “bank”, “banker”, or “banking”.  Their cover note gives specific dates by which use must stop.  This derives from section 983 of the Bank Act, which says in part that a non-bank can’t use: “… the word “bank”, “banker” or “banking” to indicate or describe a business in Canada or any part of a business in Canada…”.  Examples given of improper use include: “Come do your banking with us”, “Automated Banking Machine”, “Bank Accounts”, “Better Banking”, and “Mobile Banking”.  It also says they can’t advertise under a “banks” heading of a directory.

The Canadian Credit Union Association was quick to respond with a press release saying:  “Ottawa is telling credit unions to stop using the words Canadians use to describe the work we do … This rule will prevent credit unions from advertising their ‘business banking’ services or even having an ‘on-line banking’ button on a website.”  And that: “OSFI has taken a position that is inconsistent with its past practices and with common sense.”

What do readers think?

Is this crackdown needed to stop confusion in the marketplace and to preserve the rights of banks?

Have terms like “banking” become a generic and acceptable way for credit unions and other non banks to describe their services?

Cross-posted to Slaw

Supreme Court of Canada overrides forum clause in Facebook agreement

The Supreme Court of Canada has decided that a British Columbia privacy class action may proceed against Facebook in the courts of BC, despite the contract naming California as the forum for legal actions.

My personal view is that in business to consumer contracts, if a court decides that a local law is important enough, or if the actions of the business offends local sensibilities, it will find a way to apply local laws and hear the case. This Douez v Facebook decision will be relevant for any future actions in Canada that question the applicability of portions of online or other business to consumer agreements.

Here are some points to take away from the case.

  • The decision only decided that the class action may proceed in BC. The substantive privacy claim has yet to be litigated.
  • The decision shows how difficult this issue is to decide. Of the 7 SCC judges, there were 2 different majority opinions, and a dissent by 3 judges. They were fairly consistent about the test, but came to different conclusions based on the facts and legal philosophy.
  • The case was decided based on the BC Privacy Act that includes a statutory privacy breach tort. It remains to be seen how it would apply to other provinces that may only have a common law privacy tort. Or how it would apply to other issues.
  • It does not render choice of law clauses irrelevant. Nor does it render click-wrap agreements unenforceable. It is still important for vendors to include clear choice of law and forum clauses.
  • It has created uncertainty, and vendors need to know that courts may choose to override forum clauses and perhaps others. The fairer a court perceives the document to be in general (especially in the context of local laws), the more likely it will be followed.
  • Getting privacy right is crucial. If vendors offer services to those in countries with strong privacy laws, they must pay close attention to those laws when designing their products and new features. That includes developing Canadian laws, and for those providing services to European customers, the pending GDPR.

Cross-posted to Slaw

CASL private right of action suspended – but CASL is still here

The Canadian government has suspended the CASL private right of action that was to have come into force on July 1.  The private right of action (most likely in the form of class actions) would have allowed people to sue anyone for sending spam.  Or more accurately for those who violated the technical provisions of CASL.

This is a welcome move.  But while we can breathe a sigh of relief that this remedy is gone, CASL still remains in force and must be complied with.

The government’s press release said:

Canadians deserve an effective law that protects them from spam and other electronic threats that lead to harassment, identity theft and fraud. At the same time, Canadian businesses, charities and non-profit groups should not have to bear the burden of unnecessary red tape and costs to comply with the legislation. 

The Government supports a balanced approach that protects the interests of consumers while eliminating any unintended consequences for organizations that have legitimate reasons for communicating electronically with Canadians. 

For that reason, the Government will ask a parliamentary committee to review the legislation, in keeping with the existing provisions of CASL.

There is no indication that the CRTC will lighten up its enforcement against those who try to comply with the spirit of the legislation, but can’t get the technical details right.

We don’t know how long this review process will take or how long it might be until changes are passed.

And frankly I’m skeptical that the “balanced approach” will go nearly as far as I and others would like to see it go.  I (and I’m certainly not alone in this) have maintained from the start that CASL is one of the most ill-conceived, badly written, impractical pieces of legislation I’ve ever seen.  It provides little benefit – at a great cost.  Tinkering with the legislation won’t fix it – it needs a major overhaul.

Cross-posted to Slaw

Ransomware – fix it before you Wanna Cry

The WannaCry ransomware attack of almost 3 weeks ago may be a fading memory – but we can’t forget how important it is to protect our computer systems.  This is true no matter what kind of business or organization you are.

This video does a good job of summarizing what happened.

The bottom line is that there are some basic things everyone needs to do to reduce the chances of ransomware or malware affecting us.  Unfortunately not everyone does these simple things.

They include:

  • Keeping software and patches up to date
  • Upgrade operating systems before support ends (that means you if you still use Windows XP)
  • Use up to date virus protection
  • Have effective backups
  • Educate users on what not to do
  • Use strong passwords and take advantage of security features such as multifactor authentication

Perhaps the best advice is to not dabble in security, and don’t just follow a checklist like mine above.  Effective security requires a holistic system wide approach designed, implemented, and updated by IT professionals.  Security is a whack a mole game that is constantly changing – it doesn’t follow the “Universal operating instructions” joke of “Set lever A and lever B”.

Cross-posted to Slaw

Self driving cars – privacy points to ponder

Cars collect a significant amount of information about our driving. That data will increase dramatically as we move to autonomous vehicles – and with more data comes more ways to use it.

This information can be used now to find fault in an accident or convict us of driving offences. Some insurance companies offer discounts if we share that data with them and they decide we are a safe driver.

Cars increasingly rely on electronic systems for safety features, and self driving cars are coming. They will increasingly collect and store data about not just the car itself but also its surroundings, and will share that with other cars around it.

What might our morning commute look like in a few years?

A driverless car pulls up to your door. You are ready to go because the car sent you a text when it was 2 minutes away. When you get in the car greets you by name, and tells you traffic is light today. As it pulls out it, it asks if you would like to try a new coffee on promo at Starbucks instead of your usual Tim’s stop. You say yes, and it takes you through the Starbucks drive through. Your coffee is ready because the car has already ordered it and told Starbucks when you will arrive. And the car paid for it.

The car tells you your Amazon package should arrive at the pickup point today, and asks if you want to stop there on the way home.

You pass near a restaurant you have gone to before, and the car tells you about an upcoming special. The car makes a reservation for Friday at your request. As you near your office it shows you your schedule for today, and asks if you want to be picked up a few minutes later because of a late meeting.

So what’s going on here?

You may have programed in things like stopping at Tims on the way to work. Or it may have learned your habit after a couple of commutes. Starbucks may have paid for the special to be mentioned. It may have learned about the restaurant and your Amazon order by reading your emails and schedule.

That all sounds very convenient, but the price of convenience is surveillance. And with surveillance comes the ability for others to use that information for good and for evil.

It has been estimated that a self driving car might generate a gigabyte of data per second. It will be tempting to use that data for all sorts of things.

One vehicle data startup CEO says that by 2020, automakers will be able to make more money selling vehicle data than the cars themselves.

It is not far-fetched to imagine a scenario where a self-driving taxi ride could be immensely cheap or even free, because the revenue from advertising and data generated from the ride might be more valuable than the taxi fare.

For example, car cameras and sensors could spot available parking spaces, know how much traffic there is, how many pedestrians are on a block, and how many cars are in line at a drivethrough.

Who owns this information? Who has the right to use it? Car manufacturers will no doubt claim they do. Keep in mind that in the US secondary use of personal information is more acceptable than it is in Canada or Europe.

The privacy implications are enormous. It’s one thing to know that there are two empty parking spaces on a block. Its totally another to know that my car is parked there, or what stops I make on my commute.

Current privacy laws may not be adequate to deal with these issues. And it challenges the notion of meaningful consent.

As interesting as the idea of self driving cars is, we need to be sure that the price is not too high in terms of privacy and surveillance.

Anyone interested in a deeper dive (drive?) on this subject should look at the BC Freedom of Information and Privacy Association study titled The Connected Car: Who is in the Driver’s Seat?

Cross-posted to Slaw