Approaching Access

Despite access to personal information being a bedrock of personal information protection legislation, and having existed as law for over a decade in Canada, we found that companies routinely lack mature policies to help customers understand what information is collected, processed, and used in the course of providing services to them. [...] The aggregate result is that the number of compa- nies that consumers know are processing their data is growing, but the number of companies processing their data that are unknown to the consumers is also growing, perhaps even more quickly.27 Neither privacy policies, nor other corporate literature, necessarily disclose to a cus- tomer what data in particular is collected, for how long they are re [...] Technical mistakes or poor inter-departmental communication internally may cause a company’s activities to deviate from those explained to customers.30 Ultimately, then, the rationale for this line of research is threefold: 1. To help individuals understand the agreements they consented to and which govern the collection and use of their data and personal information. [...] We examined available case law, legislation, scholarly articles, and decisions by the Office of the Privacy Commissioner of Canada to understand the contours of how telecommunications companies collected data and their obligations to inform customers as to how these providers collected, processed, stored, and secured the collected information. [...] The approach also involved discussions with some telecommunications industry and govern- ment stakeholders to understand the broader context of government requests for data held or collected by telecommunications companies, actively asking companies to explain their data collection and handling practices, and filing access to information requests with government organizations to understand governm