September 2019
Ontario Information and Privacy Commissioner Raises Concerns over Sidewalk Labs’ Data Collection

2019-09-30 3:15:12 PM

CATEGORIES: Access & Privacy

Ontario’s Information and Privacy Commissioner (IPC) Brian Beamish in a letter written to the Chairman of the smart city Waterfront Toronto project expressed concern over a proposed ‘Urban Data Trust’.

Sidewalk Labs’, a Google-affiliated company heading the development plan, has proposed that data would be protected by an independent ‘urban data Trust’. The Trust would be responsible for balancing personal privacy, public interest, and innovation, and approve any exercise involving the collection or use of “urban data”. According to the proposal, the trust would be managed through a democratic process and will be aligned with existing and future privacy laws in Ontario and Canada.

The proposed Trust would be implemented in two stages:

Phase One: establish itself as a non-profit organization overseen by a five-member Board of data governance/privacy/intellectual property expert, community representative, a public-sector representative, an academic representative, and a Canadian business representative.

Phase Two: the Trust becomes a public-sector agency or quasi-public agency requiring enabling legislation.
However, Beamish called the data collection body ‘problematic’ as it could create precedent for future smart cities in the province.

Below is a brief summary on his recommendations, concerns and potential municipal implications:

  • A lack of an independent public oversight during phase one of the Trust.

    • Given that in Phase One the Trust would be a non-profit organization instead of public-sector agency, it would no be subject to Ontario’s access and privacy laws and any independent oversight of the decisions made by the Trust. Beamish recommends the provincial government review the Trust model and determine legislation should be enacted to govern privacy in smart city technology.

  • Unclear role for the City of Toronto

    • From the IPC’s review, it is unclear what role Toronto will play to implement the development plan. Beamish argues that since the City has experience in municipal service delivery and the ability to pass laws regulating smart city technology, the City’s role must be clearly articulated and must be the voice determining what is in the interest of the public.

  • The provincial government must put a legislative framework in place to ensure that data protections are upheld and enforceable by an independent oversight agency.

    • Beamish argues that current privacy and access laws are outdated and that existing laws must be reviewed and modernized. Amendments can include mandatory requirements for data minimization, ethical safeguards, and more protections for individual and group privacy. Beamish also suggests that PIPEDA (Personal Information Protection and Electronic Documents Act), the federal law that governs private sector engagement in commercial activity, be brought up-to-date or the provincial government consider stand alone smart city legislation.

The use of smart city technology is becoming an increasing trend as municipalities worldwide are beginning to implement some form of the technology. For example, Barcelona is using sensor technology to gather real time data from an irrigation system in a city park to let gardening crews know how much water is required for the park’s plants.

This topic is one of many that will be addressed during AMCTO’s upcoming annual Municipal Information and Privacy Forum on November 15th in Mississauga. Moreover, IPC Commissioner Brian Beamish is scheduled to deliver a keynote, which includes discussing upcoming trends for the near future. 

For more information, please see below:

IPC Commissioner Letter RE: Sidewalk Labs’ Proposal

CTV News: Privacy commissioner calls on province to review privacy laws in preparation for smart cities

Toronto Star: Sidewalk Labs urban data trust is 'problematic,' says Ontario privacy commissioner

AMCTO: 2019 Municipal Information Access and Privacy Forum


Blog post currently doesn't have any comments.