By: Meghan Sali, Communications Manager at OpenMedia
This week, as Canada heads into the first round of negotiations to update the North American Free Trade Agreement (NAFTA), we should be looking out for what impacts a “modernized” agreement could have on Canadian privacy.
Recently, the United States Trade Representative (USTR) outlined its priorities with regards to a re-negotiated NAFTA, and top of the list were issues of digital trade. Worryingly, Washington's wishlist includes the goal of establishing “rules to ensure that NAFTA countries do not impose measures that restrict cross-border data flows and do not require the use or installation of local computing facilities.”
While that may sound innocuous, we know that certain types of data are more sensitive than others. Take for example medical data collected about individuals in the course of seeing their doctors — we can likely all agree that this kind of information is deeply revealing, and potentially encompasses everything from one’s sexual orientation, to mental health information, hospital records, and family history.
Because of how telling this data can be, it’s exactly the type of information that some Canadian jurisdictions have sought additional protections for. British Columbia and Nova Scotia have laws requiring exclusively Canadian storage of information that any public body has “in its custody or under its control”. Extending beyond medical data, this means that voting information, citizens’ statements to public consultations, biometric data, and any other information collected by provincial governments on citizens and residents must be stored on servers in Canada. These rules were originally prompted by fears over the reach of the U.S. Patriot Act, and the ability of American government agencies to use this legislation to gain access to the data of Canadians.
Beyond provincial jurisdiction, the federal government in its 2016 Cloud Adoption Strategy also signalled its intention to manage the transmission and storage of Canadians’ data, saying that “to ensure Canada’s sovereign control over its data, all sensitive or protected data under government control will be stored on servers that reside in Canada. Data in transit will be appropriately encrypted.”
This seems to be the exact type of regulation that could set Canada on a crash course with Washington under NAFTA, as U.S. negotiators seek to secure policies that would place restrictions on what is often referred to as “data localization”.
By comparison, the U.S. has fairly few regulations designed to ensure the private data of American citizens and residents is retained within the U.S., and even fewer still when it comes to the data of foreign nationals. We know that once stored in the U.S., the data of Canadians can be accessed with less oversight by government agencies, a concern recently echoed by the federal Privacy Commissioner. These concerns are compounded when we contemplate the vast range of sensitive information the typical citizen shares with the government in the course of their day-to-day life.
For example, something as routine as updating one's provincial health or ID card can involve providing multiple items of personal information, including one's photograph. To immigrate to Canada, applicants need to provide information on every job they have ever worked, every place they have ever lived, police reports from every country in which they lived, and sometimes even personal testimonials from friends and family.
As things stand, Canadians' sensitive private data is much better protected when it is stored in Canada, and Canadians are unwilling to put this issue up for trade. Already, thousands have raised this concern as they participate in the ongoing Global Affairs Canada consultation on NAFTA, sending letters to the ministry responsible for trade negotiations and highlighting data privacy as one of the key issues on which Canada must stand firm.
The outcome of the NAFTA negotiations must, at a minimum, preserve Canada’s flexibility to robustly protect individual privacy. In short, we should be able to make our own data privacy policies without the interference or intervention of other state actors, and Canadians’ sensitive data and privacy rights must not become a bargaining chip in these upcoming negotiations.
Visit act.openmedia.org/nafta to send a message to Global Affairs Canada about data privacy.
Meghan Sali is the communications manager at OpenMedia, an international digital rights organization that works to keep the Internet open, affordable, and surveillance-free.