Ann Cavoukian, the former Ontario Privacy Commissioner whose framework for embedding privacy principles into technology is considered a global standard, resigned as an adviser to Toronto’s Quayside technology-driven community Friday over concerns that her own framework would go unheeded.
“I wanted this to become a smart city of privacy – not a smart city of surveillance,” Ms. Cavoukian said in an interview Saturday.
Ms. Cavoukian was a paid consultant for Sidewalk Labs, the Alphabet Inc.-owned Google sister company that has partnered with development agency Waterfront Toronto to design a 12-acre project on the shore of Lake Ontario. The proposal, which still requires government approvals, includes installing internet-connected devices such as pedestrian counters and air-quality sensors, which have the potential to create a deep trove of data on residents, throughout the neighbourhood.
After months of concern and criticism from Canadian tech leaders – many of whom worried that New-York-based Sidewalk Labs would have the upper hand in accessing and developing valuable products with that data – last Monday Sidewalk revealed a digital-governance framework for the Quayside project that proposed housing data in an independent trust. The framework included assurances that anyone would be able to access data generated by the community to develop innovative urban technologies.
It’s this proposal that frustrated Ms. Cavoukian to the point that she decided resigning from the project was her only choice.
Called Privacy by Design, the framework developed by Ms. Cavoukian insists that people’s privacy be protected pro-actively at all stages of developing technology; its principles have been widely adopted, including by the European Union’s new stringent General Data Protection Regulation.
She said that Sidewalk has given her reassurances that its team would abide by the principles of Privacy by Design in its own data collection and use – in particular, that any data collected about individuals by the many sensors and cameras that would line the neighbourhood would strip identifying details at the point of collection. But Ms. Cavoukian said that, in the proposal as written, third parties involved in the project would not have to abide by those same rules.
“If personally identifiable data are not de-identified at source, we will be creating another central database of personal information (controlled by whom?), that may be used without data subjects’ consent, that will be exposed to the risks of hacking and unauthorized access,” Ms. Cavoukian said in a letter sent to Sidewalk Labs on Friday.
“The last thing I wanted to do was resign,” she said in an interview. “But I had no other choice.”
Last week marked one year since Waterfront Toronto, an economic-development agency representing all three levels of government, announced Sidewalk as its “innovation and funding partner” to develop an underused space along Lake Ontario, with the company promising to spend an initial $50-million on plan development and public consultations. It was also a turbulent week for the project, as three of Waterfront’s digital-strategy advisers threatened to resign if the agency did not assert control over data policy.
At a key meeting Thursday, the partner organizations repeatedly stated that Waterfront Toronto and its digital advisers, not Sidewalk, would have final say over that policy. The three academics said they were confident their concerns had been addressed and that they would remain on the panel.
At the Thursday meeting, Alyssa Harvey Dawson, Sidewalk’s head of data governance, said that as a result of its plan for an independent trust to handle the data, Sidewalk could not guarantee that others would adhere to Privacy by Design principles in accessing data in such a trust. "Alyssa indicated this group would be ‘encouraged’ to de-identify personally identifiable data, but that the decision would be theirs to make,” Ms. Cavoukian said in her letter, first reported by tech website The Logic.
“Sidewalk Labs has committed to implement, as a company, the principles of Privacy by Design. Though that question is settled, the question of whether other companies involved in the Quayside project would be required to do so is unlikely to be worked out soon, and may be out of Sidewalk Labs’ hands," Sidewalk spokesman Dan Levitan wrote in an e-mailed statement.
Ms. Cavoukian, who now runs the Privacy by Design Centre of Excellence at Ryerson University, told The Globe and Mail she would happily return to the project if Waterfront Toronto and its digital-strategy advisers clearly confirmed that all parties who wished to use data generated by the project would strip citizens’ personal information from it at the source.
She said she would meet soon with Kristina Verner, Waterfront Toronto’s vice-president of innovation, to discuss the matter.
“I think they have to take a stronger governance role,” Ms. Cavoukian said of Waterfront Toronto.
In an e-mailed statement Saturday, Ms. Verner said that “much more work remains ahead in considering the important issues touched upon in the proposal and there may also be other approaches to be explored.”
Waterfront Toronto also provided a statement from Chantal Bernier, the former interim privacy commissioner of Canada, who is now counsel at Dentons Canada LLP and advising the agency on privacy matters. “We are just at the beginning of this process,” Ms. Bernier said. “This means we are still identifying every privacy risk to which we will apply every privacy protection available to us. And those protections are very real.”
A final “Master Innovation and Development” plan for the Quayside project is expected early next year, although Waterfront Toronto has said it is speaking with Sidewalk about extending its deadline to focus on digital-governance policies.
Ms. Cavoukian’s decision follows resignations by Waterfront Toronto board member Julie Di Lorenzo and two digital-strategy advisers, entrepreneur Saadia Muzaffar and venture capitalist John Ruffolo. These three resigned in recent months over what they felt was Sidewalk’s heavy-handed involvement in a project that should be led by the public agency.
Josh O’Kane