The COVID-19 pandemic has highlighted many complexities involved in using data and advanced techn... more The COVID-19 pandemic has highlighted many complexities involved in using data and advanced technologies to help resolve public health emergencies. These complexities highlight the need to embrace a broader framework of data governance with three foundational questions: ( a) who decides about data flows, ( b) on what basis, and ( c) with what accountability and oversight. These questions can accommodate the issues that have arisen in the literature regarding new types of data harms. However, these questions also foreground important issues of power, authority, and legitimacy. Data governance can provide an organizing normative framework to address emerging data themes including access to data, collective decision making, data intermediaries, data sovereignty, design and digital infrastructure, regulatory technologies, the rule of law, and social trust and license. The pandemic experience with contact tracing apps, in particular, showed the many unresolved governance challenges. Expe...
This chapter argues that the relationship between private law and the rule of law has been underd... more This chapter argues that the relationship between private law and the rule of law has been underdeveloped, or ignored, by private law scholarship until recently. Indeed, until recently, there has been relatively little attention to what the rule of law, as a conceptual and critical framework, could bring to private law theory itself. Why this lacuna in the literature? The chapter offers two speculative reasons that take up some of the themes and concerns of the New Private Law. The first reason concerns the U.S. legal academy, while the second reason concerns private law theory in the commonwealth. The chapter then outlines potential critical pathways for reclaiming a rule-of-law perspective on private law that address some of the reasons for its underdevelopment. It also explains how a focus on the rule of law in general, and in relation to some of its specific commitments and virtues, provides an important critical lens in relation to understanding and responding to the way that p...
This is a public report “Seeing Through the Cloud,” including detailed research reports as append... more This is a public report “Seeing Through the Cloud,” including detailed research reports as appendices.
After the Ontario Court of Appeal ruled in R. v. Tessling that the RCMP's use of infrared cam... more After the Ontario Court of Appeal ruled in R. v. Tessling that the RCMP's use of infrared camera technology without a warrant violated s. 8 of the Charter, Mr. Tessling's lawyer argued that this decision "raise[s] the protection of privacy for everyone".2 This comment disagrees and argues that although Tessling puts the brakes on the warrantless use of surveillance technology by the state, it actually makes it easier for the state to get access to information held by third parties without a warrant. This lowers, rather than raises, the protection of privacy in Canada. In particular, the Ontario Court of Appeal's attempt to distinguish the search in Tessling from the Supreme Court of Canada's decision in R. v. Plant may be detrimental to the overall privacy afforded to Canadians under the Charter.
Notwithstanding deep points of disagreement, there is a general — albeit largely implicit — conse... more Notwithstanding deep points of disagreement, there is a general — albeit largely implicit — consensus among theorists of the rule of law around what we call the public law presumption: the view that the rule of law is essentially a public law doctrine. We see this view expressed in influential accounts of the rule of law including the work of Dicey, Hayek, Fuller, and Raz. The goal of this book is to challenge the public law presumption. The chapters in this collection all consider the idea that the rule of law concerns the nature of law generally and the conditions under which any relationship — between citizens as well as between citizens and the state — becomes subject to law. They address two major questions. The first question is whether our understanding of the rule of law is enriched by considering how and to what degree it is expressed or realized in private law. For example, many of the chapters address the ways in which the private law secures rule of law values such as no...
In this paper we argue that data-sharing is an activity that sits at the crossroads of privacy co... more In this paper we argue that data-sharing is an activity that sits at the crossroads of privacy concerns and the broader challenges of data governance surrounding access and use. Using the Sidewalk Toronto “smart city” proposal as a starting point for discussion, we outline these concerns to include resistance to data monopolies, public control over data collected through the use of public infrastructure, public benefit from the generation of intellectual property, the desire to broadly share data for innovation in the public interest, social — rather than individual — surveillance and harms, and that data use be held to standards of fairness, justice and accountability. Data-sharing is sometimes the practice that generates these concerns and sometimes the practice that is involved in the solution to these concerns. Our safe sharing site approach to data-sharing focuses on resolving key risks associated with data-sharing, including protecting the privacy and security of data subjects...
I would like to thank the participants for their comments. I would also like to thank Julia Dryer... more I would like to thank the participants for their comments. I would also like to thank Julia Dryer for our discussions regarding s. 1 of the Charter. All errors remain mine.
This paper draws upon James Scott’s Seeing Like a State (1998) to argue that privacy law currentl... more This paper draws upon James Scott’s Seeing Like a State (1998) to argue that privacy law currently suffers from (at least) three defects: a focus on the legibility of individuals that is too narrow, a focus on collection and subsequent use of data that comes too late, and a focus on rights and harms that ignores the need to create new social structures that can empower more local forms of collective decision-making. What this outlines in broad brushstrokes is the need to enfold privacy concerns within a broader data governance framework concerned with the fair and just terms of social legibility.
We have a data transparency problem. Currently, one of the main mechanisms we have to understand ... more We have a data transparency problem. Currently, one of the main mechanisms we have to understand data flows is through the self-reporting that organizations provide through privacy policies. These suffer from many well-known problems, problems that are becoming more acute with the increasing complexity of the data ecosystem and the role of third parties – the affiliates, partners, processors, ad agencies, analytic services, and data brokers involved in the contemporary data practices of organizations. In this article, we argue that automating privacy policy analysis can improve the usability of privacy policies as a transparency mechanism. Our argument has five parts. First, we claim that we need to shift from thinking about privacy policies as a transparency mechanism that enhances consumer choice and see them as a transparency mechanism that enhances meaningful accountability. Second, we discuss a research tool that we prototyped, called AppTrans (for Application Transparency), wh...
Data trusts are an increasingly popular proposal for managing complex data governance questions, ... more Data trusts are an increasingly popular proposal for managing complex data governance questions, although what they are remains contested. Sidewalk Labs proposed creating an “Urban Data Trust” as part of the Sidewalk Toronto “smart” redevelopment of a portion of Toronto’s waterfront. This part of its proposal was rejected before Sidewalk Labs cancelled the project. This research note briefly places the Urban Data Trust within the general debate regarding data trusts and then discusses one set of reasons for its failure: its incoherence as a model. The Urban Data Trust was a failed model because it lacked clarity regarding the nature of the problem(s) to which it is a solution, how accountability and oversight are secured, and its relation to existing data protection law. These are important lessons for the more general debate regarding data trusts and their role in data governance.
This article argues that the federal Personal Information Protection and Electronic Documents Act... more This article argues that the federal Personal Information Protection and Electronic Documents Act (PIPEDA) provides individuals with control over their personal information in order to protect informational privacy while permitting organizations to collect, use and disclose personal information for legitimate and reasonable purposes. However, in determining whether such control is effective in protecting privacy, a number of issues emerged as important: control over personal information can protect a broader set of values than simply privacy; individual informational privacy can be protected even in the absence of individual consent; determining the scope of the legal entitlement to control over personal information requires an understanding of the values that privacy is meant to protect and a balancing of these against legitimate claims of others in a principled manner; and control will only protect privacy if individuals are presented with meaningful choices regarding privacy opti...
We conduct a global study on the behaviors, expectations and engagement of 1,719 participants acr... more We conduct a global study on the behaviors, expectations and engagement of 1,719 participants across 10 countries and regions towards Android application permissions. Participants were recruited using mobile advertising and used an application we designed for 30 days. Our app samples user behaviors (decisions made), rationales (via in-situ surveys), expectations, and attitudes, as well as some app provided explanations. We study the grant and deny decisions our users make, and build mixed effect logistic regression models to illustrate the many factors that influence this decision making. Among several interesting findings, we observed that users facing an unexpected permission request are more than twice as likely to deny it compared to a user who expects it, and that permission requests accompanied by an explanation have a deny rate that is roughly half the deny rate of app permission requests without explanations. These findings remain true even when controlling for other factors...
the publication of sexually explicit videotapes as a question of confidentiality rather than priv... more the publication of sexually explicit videotapes as a question of confidentiality rather than privacy). 13 The most similar Canadian case is Aubry, which was decided on the basis of the Quebec Charter and not the common law (supra note 10).
Canadian debates about lawful access -- the legal regime that authorizes various methods used by ... more Canadian debates about lawful access -- the legal regime that authorizes various methods used by law enforcement to intercept and/or search or seize information for investigatory purposes -- need a new solution space for the digital age, one that is able to incorporate new technological solutions for minimizing rights-infringements and to provide new forms of accountability and safeguards against misuse. However, this is not simply a matter of adopting the popular framework of “privacy by design”, or even a reworked “lawful access by design”. We argue that an appreciation of the challenges of the digital world require us to rethink our basic constitutional framework. The Canadian constitutional framework for lawful access was set out by the Supreme Court in Hunter v Southam and then refined in the subsequent jurisprudence. We argue that this framework is ill-suited to contemporary digital challenges to informational privacy and requires four fundamental shifts. First, its basic poin...
Many discussions of health information privacy in relation to biobanks focus on the question of i... more Many discussions of health information privacy in relation to biobanks focus on the question of informed consent and, in particular, on why the future of biobanking likely requires the acceptance of some derogation from the traditional standard of informed consent to medical research. Following Neil C. Manson & Onora O’Neill’s recent work on informed consent as a “waiver,” we argue in this paper that the role of consent can be thought of in a narrower but still highly principled manner which is consistent with how consent is dealt with in tort law. Using this conception, we defend the position that the traditional standard of informed consent to participate in a biobank can be met but only where there is a governance structure ensuring consistent information practices and policies across multiple future research projects. We also argue that specific research uses of research samples and associated data in the biobank do not necessarily require informed consent but do require a gover...
Page 1. Property |l:-EI[|E"'.'I.!l' 7 7 The Public Nature of Private Property... more Page 1. Property |l:-EI[|E"'.'I.!l' 7 7 The Public Nature of Private Property Robin Paul I'-.~1aIh:|'_.' |".1ir:h.-ael Diazmnd Page 2. The Public NaTure of PrivaTe ProPerTy Page 3. law, Property and Society Series Editor: Robin Paul ...
How to cite TSpace items Always cite the published version, so the author(s) will receive recogni... more How to cite TSpace items Always cite the published version, so the author(s) will receive recognition through services that track citation counts, e.g. Scopus. If you need to cite the page number of the author manuscript from TSpace because you cannot access the published version, then cite the TSpace version in addition to the published version using the permanent URI (handle) found on the record page. This article was made openly accessible by U of T Faculty. Please tell us how this access benefits you. Your story matters.
The COVID-19 pandemic has highlighted many complexities involved in using data and advanced techn... more The COVID-19 pandemic has highlighted many complexities involved in using data and advanced technologies to help resolve public health emergencies. These complexities highlight the need to embrace a broader framework of data governance with three foundational questions: ( a) who decides about data flows, ( b) on what basis, and ( c) with what accountability and oversight. These questions can accommodate the issues that have arisen in the literature regarding new types of data harms. However, these questions also foreground important issues of power, authority, and legitimacy. Data governance can provide an organizing normative framework to address emerging data themes including access to data, collective decision making, data intermediaries, data sovereignty, design and digital infrastructure, regulatory technologies, the rule of law, and social trust and license. The pandemic experience with contact tracing apps, in particular, showed the many unresolved governance challenges. Expe...
This chapter argues that the relationship between private law and the rule of law has been underd... more This chapter argues that the relationship between private law and the rule of law has been underdeveloped, or ignored, by private law scholarship until recently. Indeed, until recently, there has been relatively little attention to what the rule of law, as a conceptual and critical framework, could bring to private law theory itself. Why this lacuna in the literature? The chapter offers two speculative reasons that take up some of the themes and concerns of the New Private Law. The first reason concerns the U.S. legal academy, while the second reason concerns private law theory in the commonwealth. The chapter then outlines potential critical pathways for reclaiming a rule-of-law perspective on private law that address some of the reasons for its underdevelopment. It also explains how a focus on the rule of law in general, and in relation to some of its specific commitments and virtues, provides an important critical lens in relation to understanding and responding to the way that p...
This is a public report “Seeing Through the Cloud,” including detailed research reports as append... more This is a public report “Seeing Through the Cloud,” including detailed research reports as appendices.
After the Ontario Court of Appeal ruled in R. v. Tessling that the RCMP's use of infrared cam... more After the Ontario Court of Appeal ruled in R. v. Tessling that the RCMP's use of infrared camera technology without a warrant violated s. 8 of the Charter, Mr. Tessling's lawyer argued that this decision "raise[s] the protection of privacy for everyone".2 This comment disagrees and argues that although Tessling puts the brakes on the warrantless use of surveillance technology by the state, it actually makes it easier for the state to get access to information held by third parties without a warrant. This lowers, rather than raises, the protection of privacy in Canada. In particular, the Ontario Court of Appeal's attempt to distinguish the search in Tessling from the Supreme Court of Canada's decision in R. v. Plant may be detrimental to the overall privacy afforded to Canadians under the Charter.
Notwithstanding deep points of disagreement, there is a general — albeit largely implicit — conse... more Notwithstanding deep points of disagreement, there is a general — albeit largely implicit — consensus among theorists of the rule of law around what we call the public law presumption: the view that the rule of law is essentially a public law doctrine. We see this view expressed in influential accounts of the rule of law including the work of Dicey, Hayek, Fuller, and Raz. The goal of this book is to challenge the public law presumption. The chapters in this collection all consider the idea that the rule of law concerns the nature of law generally and the conditions under which any relationship — between citizens as well as between citizens and the state — becomes subject to law. They address two major questions. The first question is whether our understanding of the rule of law is enriched by considering how and to what degree it is expressed or realized in private law. For example, many of the chapters address the ways in which the private law secures rule of law values such as no...
In this paper we argue that data-sharing is an activity that sits at the crossroads of privacy co... more In this paper we argue that data-sharing is an activity that sits at the crossroads of privacy concerns and the broader challenges of data governance surrounding access and use. Using the Sidewalk Toronto “smart city” proposal as a starting point for discussion, we outline these concerns to include resistance to data monopolies, public control over data collected through the use of public infrastructure, public benefit from the generation of intellectual property, the desire to broadly share data for innovation in the public interest, social — rather than individual — surveillance and harms, and that data use be held to standards of fairness, justice and accountability. Data-sharing is sometimes the practice that generates these concerns and sometimes the practice that is involved in the solution to these concerns. Our safe sharing site approach to data-sharing focuses on resolving key risks associated with data-sharing, including protecting the privacy and security of data subjects...
I would like to thank the participants for their comments. I would also like to thank Julia Dryer... more I would like to thank the participants for their comments. I would also like to thank Julia Dryer for our discussions regarding s. 1 of the Charter. All errors remain mine.
This paper draws upon James Scott’s Seeing Like a State (1998) to argue that privacy law currentl... more This paper draws upon James Scott’s Seeing Like a State (1998) to argue that privacy law currently suffers from (at least) three defects: a focus on the legibility of individuals that is too narrow, a focus on collection and subsequent use of data that comes too late, and a focus on rights and harms that ignores the need to create new social structures that can empower more local forms of collective decision-making. What this outlines in broad brushstrokes is the need to enfold privacy concerns within a broader data governance framework concerned with the fair and just terms of social legibility.
We have a data transparency problem. Currently, one of the main mechanisms we have to understand ... more We have a data transparency problem. Currently, one of the main mechanisms we have to understand data flows is through the self-reporting that organizations provide through privacy policies. These suffer from many well-known problems, problems that are becoming more acute with the increasing complexity of the data ecosystem and the role of third parties – the affiliates, partners, processors, ad agencies, analytic services, and data brokers involved in the contemporary data practices of organizations. In this article, we argue that automating privacy policy analysis can improve the usability of privacy policies as a transparency mechanism. Our argument has five parts. First, we claim that we need to shift from thinking about privacy policies as a transparency mechanism that enhances consumer choice and see them as a transparency mechanism that enhances meaningful accountability. Second, we discuss a research tool that we prototyped, called AppTrans (for Application Transparency), wh...
Data trusts are an increasingly popular proposal for managing complex data governance questions, ... more Data trusts are an increasingly popular proposal for managing complex data governance questions, although what they are remains contested. Sidewalk Labs proposed creating an “Urban Data Trust” as part of the Sidewalk Toronto “smart” redevelopment of a portion of Toronto’s waterfront. This part of its proposal was rejected before Sidewalk Labs cancelled the project. This research note briefly places the Urban Data Trust within the general debate regarding data trusts and then discusses one set of reasons for its failure: its incoherence as a model. The Urban Data Trust was a failed model because it lacked clarity regarding the nature of the problem(s) to which it is a solution, how accountability and oversight are secured, and its relation to existing data protection law. These are important lessons for the more general debate regarding data trusts and their role in data governance.
This article argues that the federal Personal Information Protection and Electronic Documents Act... more This article argues that the federal Personal Information Protection and Electronic Documents Act (PIPEDA) provides individuals with control over their personal information in order to protect informational privacy while permitting organizations to collect, use and disclose personal information for legitimate and reasonable purposes. However, in determining whether such control is effective in protecting privacy, a number of issues emerged as important: control over personal information can protect a broader set of values than simply privacy; individual informational privacy can be protected even in the absence of individual consent; determining the scope of the legal entitlement to control over personal information requires an understanding of the values that privacy is meant to protect and a balancing of these against legitimate claims of others in a principled manner; and control will only protect privacy if individuals are presented with meaningful choices regarding privacy opti...
We conduct a global study on the behaviors, expectations and engagement of 1,719 participants acr... more We conduct a global study on the behaviors, expectations and engagement of 1,719 participants across 10 countries and regions towards Android application permissions. Participants were recruited using mobile advertising and used an application we designed for 30 days. Our app samples user behaviors (decisions made), rationales (via in-situ surveys), expectations, and attitudes, as well as some app provided explanations. We study the grant and deny decisions our users make, and build mixed effect logistic regression models to illustrate the many factors that influence this decision making. Among several interesting findings, we observed that users facing an unexpected permission request are more than twice as likely to deny it compared to a user who expects it, and that permission requests accompanied by an explanation have a deny rate that is roughly half the deny rate of app permission requests without explanations. These findings remain true even when controlling for other factors...
the publication of sexually explicit videotapes as a question of confidentiality rather than priv... more the publication of sexually explicit videotapes as a question of confidentiality rather than privacy). 13 The most similar Canadian case is Aubry, which was decided on the basis of the Quebec Charter and not the common law (supra note 10).
Canadian debates about lawful access -- the legal regime that authorizes various methods used by ... more Canadian debates about lawful access -- the legal regime that authorizes various methods used by law enforcement to intercept and/or search or seize information for investigatory purposes -- need a new solution space for the digital age, one that is able to incorporate new technological solutions for minimizing rights-infringements and to provide new forms of accountability and safeguards against misuse. However, this is not simply a matter of adopting the popular framework of “privacy by design”, or even a reworked “lawful access by design”. We argue that an appreciation of the challenges of the digital world require us to rethink our basic constitutional framework. The Canadian constitutional framework for lawful access was set out by the Supreme Court in Hunter v Southam and then refined in the subsequent jurisprudence. We argue that this framework is ill-suited to contemporary digital challenges to informational privacy and requires four fundamental shifts. First, its basic poin...
Many discussions of health information privacy in relation to biobanks focus on the question of i... more Many discussions of health information privacy in relation to biobanks focus on the question of informed consent and, in particular, on why the future of biobanking likely requires the acceptance of some derogation from the traditional standard of informed consent to medical research. Following Neil C. Manson & Onora O’Neill’s recent work on informed consent as a “waiver,” we argue in this paper that the role of consent can be thought of in a narrower but still highly principled manner which is consistent with how consent is dealt with in tort law. Using this conception, we defend the position that the traditional standard of informed consent to participate in a biobank can be met but only where there is a governance structure ensuring consistent information practices and policies across multiple future research projects. We also argue that specific research uses of research samples and associated data in the biobank do not necessarily require informed consent but do require a gover...
Page 1. Property |l:-EI[|E"'.'I.!l' 7 7 The Public Nature of Private Property... more Page 1. Property |l:-EI[|E"'.'I.!l' 7 7 The Public Nature of Private Property Robin Paul I'-.~1aIh:|'_.' |".1ir:h.-ael Diazmnd Page 2. The Public NaTure of PrivaTe ProPerTy Page 3. law, Property and Society Series Editor: Robin Paul ...
How to cite TSpace items Always cite the published version, so the author(s) will receive recogni... more How to cite TSpace items Always cite the published version, so the author(s) will receive recognition through services that track citation counts, e.g. Scopus. If you need to cite the page number of the author manuscript from TSpace because you cannot access the published version, then cite the TSpace version in addition to the published version using the permanent URI (handle) found on the record page. This article was made openly accessible by U of T Faculty. Please tell us how this access benefits you. Your story matters.
Uploads
Papers by Lisa Austin