Jennifer Stoddart

The Lunch

Jennifer Stoddart: making your privacy her business

The Globe and Mail

Canada's fearless privacy cop is having an awkward public moment.

It's not because I've asked Privacy Commissioner Jennifer Stoddart about government secrets gushing from the leaky pipe that is Wikileaks. Or creepy Internet stalkers who collect personal information from giant Web utilities such as Facebook or Google. Or even because I stuck my nose into her private life.

No, Ms. Stoddart is agitated because I'm fumbling through the flotsam of my purse in search of a misplaced credit card to pay for lunch at Play, the latest irreverent eatery from award-winning Ottawa restaurateur, Steve Beckta.

Noooooo," she protests. "I cannot allow this."

Slapping a purple wallet the size of a small cabbage on the table, she yanks out a series of green and blue bills to pay for lunch, ignoring the receipt. The lady who rescued the Privacy Commission from a previous administration's near-fatal expense account scandal is paying for a lunch out of her own pocket. It absolutely won't do to have a journalist pay for her meal.

"I must be like Caesar's wife," she says, glancing quickly behind herself at the fortress-like U.S. embassy that faces the restaurant, "above suspicion!"

That such a formidable regulator would be so agitated about a modest lunch bill won't surprise anyone in the nation's capital, a buttoned-down town where bureaucrats post expense accounts on government websites and cabinet ministers issue puritanical edicts about what civil servants can and cannot consume. But to a frequenter of Bay Street watering holes, where deal dogs don't blink at lunch bills that can cost more than some Canadians' monthly mortgage, her momentary panic is a revelation.

It's one of one of many surprises that the elegant 61-year-old, whose athletic frame is wrapped in a flowing black wool sweater, serves up over a lunch of "sweet mama squash soup," seared Digby scallops and catfish tacos.

The biggest stunner is that Canada's privacy cop, who is quietly dismissed in some Silicon Valley circles as an old-fashioned scold, is something of an Internet rebel. The same regulator who famously stared down Facebook and forced it to tighten privacy standards for 500 million global users, is in fact, she shares, an early advocate for access to information on the Internet.

Her technology epiphany occurred in the early 2000s when Ms. Stoddart travelled to Britain as the president of Quebec's Commission on Access to Information to get a close look at the country's innovative access-to-information laws.

"It blew my mind," she says of her meetings with regulatory, academic and archival leaders who were leading the global charge to put Britain's government documents, regulations, archival data and service information on the World Wide Web.

"I came back and told my staff, 'this is it, the Brits have figured it out.' "

What they figured out, and what continues to shape her thinking as a regulator, is that the Internet is a powerful tool that can ensure greater transparency and accountability in governments and other organizations.

"Governments shouldn't hoard information. The information is there and it belongs to the people," she says. "Information and the manipulation of information is the key to power. Those who can control the information can influence society enormously. The more accurate the flow of information the … more productive we can be."

How can this philosophy be reconciled with the woman who publicly frets about people who share too much personal information on the Web and the companies who harvest their data?

Part of the answer is that Jennifer Stoddart has always been something of a maverick. After an early career as an academic specializing in Quebec social history, she shifted her pragmatic mind to a law degree so that she could help modernize regulations standing in the way of gender, cultural and employment equity. By the time she was tapped as Canada's Privacy Commissioner in 2003, she had devoted more than 20 years to promoting the rights of women, human rights, and access to information.

The other thing you need to know is that Ms. Stoddart is not in the least bit dewy-eyed about the innovative marvels of the Internet. Although she recognized in the early 2000s that the Web represented a "tectonic shift" in human society and communications, she was always skeptical that an open digital world was a gateway to the better life that its early inventors promised.

"I never believed the purists when they talked about the Internet being about everything good. I have studied too much history. Most Utopian experiments … never survive in their original shape because negative forces, some would say evil forces, are always present."

Ms. Stoddart's public-policy sensibilities probably would have gone largely unnoticed had it not been for the restless innovative mind of a Harvard University dropout named Mark Zuckerberg. When a group of Ottawa University students filed a complaint that Mr. Zuckerberg's wildly popular social network Facebook was sharing users' personal information with outsiders without permission, she found herself confronting a challenge for which she had been preparing her entire career.

"I had to find the correct line for interpreting laws and reflecting modern societal values," she says. "It was the whole philosophical challenge of being a privacy purist or realizing that this was a radical new form of communication that clearly had many benefits."

The Privacy Commission took on the difficult job of finding the right line for two reasons. Unlike the United States, Canada has privacy laws that prohibit companies from sharing personal data without customers' consent. The other factor was Ms. Stoddart. Despite a few sleepless nights, she wasn't going to shy away from enforcing the law, even if the target was the world's fastest growing enterprise.

"We went out on a limb. We had to interpret how you could continue [Facebook's]business within the confines of Canadian law," she says. At the heart of the regulator's concerns were the many "opacities" at the social network which made it hard for users to understand how to protect their data from unwanted prying eyes, particularly application makers.

"The principle of consent was important. You can't really consent if you don't know what is going on," she says. Without consent, she says, it was open season for "all those organizations behind the scenes scarfing your personal information."

The commission grabbed international headlines in 2008 and put privacy fears on the public radar when it announced the world's first privacy investigation into Facebook. Ms. Stoddart says it took a while for the California-based company to "wake up and smell the coffee," but after months it agreed to a number of changes to give Facebook users more powers to shield their data and opt out of applications that gave outside organizations access to that data.

The hardest part about the Facebook investigation was not the difficult negotiations with the upstart company, but rather the company's privacy flip-flops. After the initial discussions, the company had agreed to allow users to block application developers from grabbing their photos, videos and personal information. That change was to take effect in August, 2010. But then, last spring, Facebook suddenly shifted course and said it would allow the developers to grab data after all.

"It was a very difficult moment," Ms. Stoddart recalls, because it appeared that Facebook was gearing up to test the small regulator's limited enforcement powers. Under current legislation, the Privacy Commission has no power to fine or restrict privacy offenders. Instead it can only refer cases to a Federal court.

"Thank goodness," Ms. Stoddart says, Facebook blinked and rolled out a series of clear and potent privacy protections that are starting to be emulated by other technology companies. Indeed this week Microsoft announced that it is reviving a powerful privacy tool in the next version of its Internet browser that will allow users to stop websites and tracking companies from gathering information about them.

Ms. Stoddart says the Internet privacy battle "is not over yet, because it is such a fast-changing world." After the federal government extended her mandate this week by another three years, she hints she will be seeking more enforcement powers for the commission, but she declines to divulge specifics.

More clout would definitely make her job easier, but if the social philosopher had one wish, it would be to create a button to make things disappear on the Internet. "What if after five years you could press a 'delete' button" she says, that could wipe out embarrassing photos or posts that never die on the Web. "People have the right to be forgotten."

______

CURRICULUM VITAE

Beginnings

Born in Toronto, 1949. Daughter of an Ontario government transport lawyer and a kindergarten teacher. Fluent in five languages, she says her early exposure to French in preschool gave her a life-long interest in culture and social issues.

Education

Devoted seven years in Ontario, Quebec and Paris to studying Quebec social history. She completed course work for her doctoral degree at the Université de Paris VII, but did not write her thesis. In 1980, she added a law degree to her collection when she graduated from law school at McGill University. She was called to the Bar in 1981.

Career

Has been Canada's Privacy Commissioner since 2003 and her term was extended this week for another three years. Before that she headed the Quebec Commission on Access to Information and had senior positions at the Quebec Human Rights and Youth Rights Commission, the Canadian Human Rights Commission and the Canadian Advisory Council on the Status of Women.

Personal

Lives in Ottawa during the week, but returns home to Montreal on the weekend, where she lives with her husband, an architect and professor of urban planning. They have two adult sons.

Passions

Keeps an Arabian endurance horse outside of Montreal where she trains to compete in long-distance rides. Earlier this year she rode for four hours on a 25-mile endurance competition in Vermont and is now training for a longer course. "Before I get too old I want to do a 50-mile endurance competition."

______

IN HER OWN WORDS

On arriving at the embattled Privacy Commission in 2003 after her predecessor George Radwanski departed under the cloud of an expense account scandal:

"The office was in such bad shape that anyone who came to work for us thought they would be committing career suicide."

On the eruption of government secrets from WikiLeaks:

"This isn't about open government. These are leaks of information that would otherwise be inaccessible. It seems folly to say there are things in government that should not be confidential, particularly in a volatile world where national security issues in a heavily armed world are crucial."

On regulating privacy in a rapidly evolving digital world:

"I think we have to keep talking … privacy is an inherently subjective concept. To apply rules rigidly is not helpful. It stifles the economic benefit it creates."

On her biggest privacy fears:

"I worry about the kids. The teens, the 20-year-olds who are experimenting, sharing things, taking risks and acting out like we all did. But on the Internet this behaviour is documented forever."