A model of the proposed development and its associated embedded technologies – Sidewalk Labs Toronto June 2019 Open House. Photo taken by Kevin Szeto.
Kevin Szeto[1] Student Writer, Windsor Law LTEC Lab JD Candidate, 2021
Waterfront Toronto, a tri-governmental agency, entered into an agreement on July 2018 with Sidewalk Labs to plan and develop the quayside area. Sidewalk Labs is a subsidiary of Alphabet Inc., which also owns Google LLC. Sidewalk Labs uses new technology to address big urban challenges to improve the quality of life in cities.[2] The plan is designed to transform the quayside area of the eastern Toronto waterfront into a “smart city.” A smart city is an urban development that utilizes technology to gather information in order to improve the management of resources. This particular smart city development would use sensors and technological devices embedded throughout the neighbourhood to connect components from across the development, deriving data to then improve the lives of citizens and visitors.
An unveiling of the new Master Innovation and Development Plan at the Sidewalk Labs Toronto Open House, June 2019. Photo taken by Kevin Szeto.
The Canadian Civil Liberties Association (CCLA) is a not-for-profit organization that fights for civil liberties, human rights, and democratic freedoms for all people across Canada.[3] It relies on the support of pro-bono lawyers in conjunction with the financial support of its members, supporters and non-governmental organizations to fulfill its mission. As such, on April 19, 2019, the CCLA filed a lawsuit against Waterfront Toronto and all three levels of government regarding the Sidewalk Labs deal. The aim of the lawsuit is to protect the Canadian public from the risks of surveillance and commoditization of our streets, which CCLA also refers to as “surveillance capitalism.”[4] Surveillance capitalism, being partaken by companies such as Google and its sister company Sidewalk Labs, is the claiming of human experience as free raw material for the translation of behavioural data. This data is then analyzed through sophisticated processing techniques known as machine intelligence, which generates predictions based on patterns in the data, in order to anticipate what users will do and purchase in the present and future.[5]
The CCLA’s grounds for the lawsuit are that “by entering into or permitting or acquiescing in the decision to approve the Quayside Agreements, the government has violated or will violate Canadians’ personal and collective privacy rights under section 8 of the Charter of Rights and Freedoms, and their freedoms, and privacy rights in respect of the freedoms.”[6] Furthermore, the lawsuit claims that “data captured from Quayside raises serious concerns about surveillance. It will not be feasible to obtain the meaningful, informed consent of individuals for the personal information captured in public spaces or ensure with certainty that such data is de-identified and not re-identified. In any case, surveillance and commoditization are purposes that a reasonable person would not consider appropriate in the circumstances, contrary to section 5(3) of the Personal Information Protection and Electronic Documents Act, S.C. 2005, c. 5(“PIPEDA”).”[7]
Traditionally applied in criminal law contexts with regards to police searches, section 8 of the Charter states that “Everyone has the right to be secure against unreasonable search or seizure.”[8] The purpose of section 8 of the Charter is to protect citizens from unreasonable searches by the government, particularly protecting their personal, territorial and informational privacy interests. Section 8 of the Charter involves a two-step analysis. Firstly, it has to be established that there has been a “search” or a “seizure.” Secondly, the search or seizure must be determined to be reasonable.
Has there been a “search” or a “seizure”?
A search is considered an inspection. A seizure is taking when a person has a reasonable privacy interest in the object or subject matter of the state action and the information to which this search or seizure gives the state access.[9] The subject matter in which a reasonable privacy interest could be accorded is the informational privacy of citizens who will enter or live within the smart city development. This informational privacy includes personal data with the potential to be identifiable to specific individuals, such as energy consumption within a home or license plate information for demand-based pricing for curb parking.[10] In order to constitute a search or seizure, the government does not have to be the party directly capturing and obtaining personal data from individuals. In the case of R. v. Colarusso, a collection of medical information by doctors that was subsequently disclosed to the police was considered a seizure.[11] Therefore, the collection of private personal data by Sidewalk Labs as empowered by Waterfront Toronto could potentially constitute a search or seizure under section 8 of the Charter if the data is held in an independent trust as currently suggested, and shared with Waterfront Toronto and the various levels of government.[12]
Consent, or rather a lack thereof, is vital to establishing whether a wrongful search or seizure has taken place. With regards to the lawsuit, this would mean that the CCLA would have to establish that Sidewalk Labs and the government are collecting data without the meaningful and voluntary consent of participants within the development. If the government and Sidewalk Labs provide evidence of meaningful and voluntary consent of all participants in the development, the claim brought forth by the CCLA will be weakened.[13] This evidence could be established through means such as clear signs indicating to visitors the extent of data collection should they enter into the smart city, along with detailed and explicit wording outlining the extent of personal data being collected within real estate contracts for individuals who purchase condominium units within the smart city development. Subsequently, individuals who then proceed to enter or agree to live in the development could thus be considered to be voluntarily giving their meaningful and informed consent to the agreed upon data collection. However, there are important limitations to these methods of obtaining consent prior to entering the smart city development. For example, where an individual must enter the premises, such as a guest visiting a sick friend within the smart city, if this guest does not consent to surveillance by their own will, but rather out of necessity, it seems unlikely that visiting the smart city (even with knowledge of the clear data collection signs and notices) would amount to giving valid consent. Therefore, without voluntary consent, the data surveillance within the smart city would likely be considered a search or seizure of personal data and proceed to the next steps of the section 8 test as described below.
Digital Innovation and Privacy Concerns, Sidewalk Labs Open House June 2019. Photo taken by Kevin Szeto.
Was the search or seizure reasonable?
It must be determined through the “totality of the circumstances test” whether or not the state action interfered with a reasonable expectation of privacy. Assuming that meaningful consent was not obtained, the test would comprise four parts: 1) an examination of the subject matter of the search; 2) a determination as to whether the claimant had a direct interest in the subject matter; 3) an inquiry into whether the claimant had a subjective expectation of privacy in the subject matter; and lastly 4) an assessment as to whether this subjective expectation of privacy is objectively reasonable.[14]
The first part of the test examines the subject matter of the search, which in this case is the informational privacy of citizens within the smart-city that is potentially being infringed upon by the data collection that is taking place. Informational privacy has been defined as “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.”[15] Furthermore, there are three forms of privacy as defined in R. v. Spencer, which include privacy as secrecy, privacy as control, and privacy as anonymity. The Responsible Data Use Plan currently suggested by Sidewalk Labs could help alleviate some of these issues in regards to a reasonable expectation of informational privacy.[16] For example, data will be de-identified at the source, which would alleviate any infringement of privacy as anonymity, a form of privacy. If de-identification could be achieved as the Responsible Data Use Plan suggests, data that no longer contains any personally identifiable information would still preserve the anonymity of users while contributing to the objectives of the smart city development. However, skepticism exists as to whether or not de-identification can be achieved, as demonstrated by the high-profile departure of Sidewalk Lab’s privacy expert Ann Cavoukian amid privacy concerns.[17] The problem of users not being able to access and control their own data could also present issues of privacy as control, as they seem to lack an ability to communicate or retain their information as they see fit.[18] Presently, there is no option for individuals to opt-in or out of the collection of data to which they are concerned with.
Proceeding to the next steps of the test, it is unlikely that the courts would find issue with whether or not the claimants have a direct interest in the subject matter, and whether or not there was a subjective expectation of privacy and if that expectation was objectively reasonable. As this motion is being brought forth by a community member from the impacted neighbourhood, as well as the fact that surveillance occurs in one of the most private areas within an individual’s life, their home; it is likely that the claimant has an objectively reasonable and subjective expectation of privacy. However, if an individual were to voluntarily consent to data surveillance within the smart city in conjunction with a meaningful understanding of the data being collected, that consent could be used as a method of lowering an individual’s objectively reasonable and subjective expectation of privacy. Additionally, an individual’s expectation of privacy can also be lowered as a space becomes more accessible to the public. Therefore, data collection that occurs within a public space such as a city street or a public park would not violate an expectation of privacy to the same degree it would if such collection occurred in a private dwelling.
Lastly, it is difficult to determine whether or not the state action through the proposed development of Sidewalk Labs will be found to violate privacy rights under the Charter. On its face, it would be difficult for the government to justify this scheme based on the copious amounts of surveillance that appears to have the potential to infringe on the privacy rights of individuals within the community.
It will be interesting to observe how Waterfront Toronto and Sidewalk Labs manage to balance and mitigate privacy risks associated with their project going forward. With the current proposal, there is a possibility for the courts to weigh in favour of the CCLA if the promises of responsible data use by Sidewalk Labs are not fulfilled to the extent indicated.
[1] I would like to thank Dr. Pascale Chapdelaine, Professor Kristen Thomasen and Alethea Song for their contributions and assistance in reviewing the blog. All errors are my own. [2] “About Sidewalk” online: Sidewalk Labs <https://sidewalktoronto.ca/>.
[3] “Our Mission and History” online: Canadian Civil Liberties Association <https://ccla.org/our-mission-and-history/>.
[4] Letter from Michael Bryant and Dr. Brenda McPhail to The Rt. Hon. Justin Trudeau, The Hon. Doug Ford and His Worship John Tory (March 5, 2019) online: <http://ccla.org/cclanewsite/wp-content/uploads/2019/03/CCLA-WT-RESET-LTR-TO-PMPM-3-5-19.pdf>. [5] John Naughton, “’The goal is to automate us: welcome to the age of surveillance capitalism”, The Guardian(January 20, 2019), online: <https://www.theguardian.com/technology/2019/jan/20/shoshana-zuboff-age-of-surveillance-capitalism-google-facebook>. [6] Corporation of the Canadian Civil Liberties Association & Lester Brown v. Toronto Waterfront Revitalization Corporation, City of Toronto, Her Majesty in Right of Ontario, Her Majesty in Right of Canada, & Attorney General of Canada(April 16, 2019), Toronto, Ont CA (Notice of Application) at para 5.
[7] Ibidat para 29.
[8] Canadian Charter of Rights and Freedoms, s 8, Part I of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK), 1982, c 11. [Charter]
[9] R. v. Colarusso,[1994] 1 SCR 20 at page 58, 110 D.L.R. (4th) 297.
[10] Alyssa Harvey Dawson & Craig Nevill-Manning, “Master Innovation and Development Plan Briefing for Assistant Deputy Ministers”, Sidewalk Labs (March 5, 2019), online: <https://storage.googleapis.com/sidewalk-toronto-ca/wp-content/uploads/2019/06/20223257/Digital-Innovation-_-Data-Governance-Master-Innovation-And-Development-Plan-Briefing-For-Assistant-Deputy-Ministers.pdf> at p. 6, 20, 39, 64 and 66.
[11] Supranote 9. [12] Ibidat 56. [13] R. v. Borden, [1994] 3 S.C.R. 145, 119 D.L.R. (4th) 74; Godbout v. Longueuil (City), [1997] 3 S.C.R. 844 at para 72, 152 D.L.R. (4th) 577.
[14] R. v. Spencer, 2014 SCC 43 at para 18, [2014] 2 SCR 212.
[15] R. v. Tessling, 2004 SCC 67at para 23, [2004] 3 SCR 432.
[16] “Responsible Data Use Assessment Summary: Overview of Digital Transparency in the Public Realm Digital Channel” online: Sidewalk Labs Documents <https://storage.googleapis.com/sidewalk-toronto-ca/wp-content/uploads/2019/06/29100441/RDUA-Summary_-Overview-of-Digital-Transparency-in-the-Public-Realm-Digital-Channel.pdf>.
[17] “’Not good enough’: Toronto privacy expert resigns from Sidewalk Labs over data concerns”, CBC News (October 21, 2018), online: <https://www.cbc.ca/news/canada/toronto/ann-cavoukian-sidewalk-data-privacy-1.4872223>. [18] Supranote 15 at para 40.