Privacy commissioner raises concern over proposed online streaming bill

Privacy Commissioner of Canada Philippe Dufresne recently appeared before the Standing Senate Committee on Transport and Communication to offer his observations concerning the proposed online streaming bill.

On February 2, Minister of Canadian Heritage Pablo Rodriguez introduced the Online Streaming Act (Bill C-11). If passed, the proposed law would amend the Broadcasting Act to put online streaming services under its domain and require them to contribute to creating Canadian content.

In his remarks before the committee, Dufresne addressed how the bill deals with “online undertakings,” which he claimed have raised privacy concerns for several stakeholders. “Online undertakings” include any services that transmit programs over the internet in Canada. He also offered suggestions on improving privacy provisions in the Broadcasting Act generally.

Dufresne first referred to discoverability provisions in the bill, which authorize the CRTC to impose conditions respecting the presentation of programs and programming services for selection by the public, including the showcasing and discoverability of Canadian programs and programming services, such as original French language programs.

“While the bill specifies that in doing so the CRTC could not require the use of a specific computer algorithm or source code, discoverability conditions could nonetheless potentially require the adaptation of existing algorithms that rely on personal information or the analysis of personal information to determine whether user-generated content is Canadian,” Dufresne said.

According to Dufresne, the potential privacy impacts would depend on the specific circumstances of each case, including how the CRTC would exercise its authority and how regulated entities would respond to new obligations by collecting and analyzing personal information. Given this, it will be important that these privacy implications be “fully assessed and mitigated” before the CRTC imposes the conditions, he added.

Dufresne also referred to another bill provision giving the CRTC the power to require broadcasters to provide information related to audience measurements.

“Here again, the implementation of the bill in a way that ensures that requested information is de-identified or anonymized will be essential and my office will be available to provide the necessary advice and guidance,” Dufresne said. “In light of the fundamental importance of privacy, the committee could consider amending section 3 of the Broadcasting Act to include the protection of the privacy of persons as a policy objective of that Act.”

Moreover, Dufresne raised to the committee’s attention the European Union’s Digital Services Act − which the European Parliament adopted in July. Once in effect, the new law will require major online platforms to provide individuals with an option to turn off recommendations based on individual profiling.

He also reiterated his recommendation that the preparation of timely privacy impact assessments by public institutions be made a “binding legal requirement” in a modernized version of the Privacy Act.