Sally Yoon is an IPilogue Writer, IP Innovation Clinic Fellow, and a 2L JD Candidate at Osgoode Hall Law School.

As discussed in , Human Rights Watch (HRW) released a in late May outlining the privacy risks school children face across the globe. After a short summary, the report immediately explores ways we can address the risks, through a comprehensive list of recommendations to governments, ministries and departments of education, education technology companies, advertising technology companies and other third-party companies that may receive data from EdTech Products.

Recommendations to the government, education technology companies, AdTech companies and other third-party companies receiving sensitive data all included urgent remedial action to address the children who have been exposed to the risk of misuse and exploitation – identify, remove, and prevent the further spread of children’s data. Governments were also specifically suggested to bear the responsibility of demanding AdTech companies delete all children’s data received from EdTech during the pandemic. Further recommendations also included law reform to adopt, update, strengthen, and hold accountable child data protection laws “to deliver a modern child data protection framework that protects the best interests of the child in complex online environments.”

Alarmingly, the report found that out of the 49 countries examined, 14 countries lacked any form of data protection whatsoever, while others merely referred to children or were outdated and did not address more modern technology. The do include a specific section on consent and children and the importance of adult supervision for data collection for children below the age of 13. However, Canada still falls behind in implementing modern privacy legislation that addresses child consent. For example, under the , businesses cannot sell personal information of children who are less than 13 years of age, unless the child’s parent or guardian affirmatively authorizes the sale. Moreover, sets the age of consent at 16, requiring parental consent from those 15 years old or younger. Section 15 in Canada’s Bill C-11 mandates that “an organization must obtain an individual’s valid consent for the collection, use or disclosure of the individual’s personal information,” but does not specifically address a minimum age for consent.

Additionally, the report provided recommendations for ministries and departments of education. These recommendations included monitoring endorsed educational services and the companies providing those services, as well as creating written contracts regarding children's data protection between institutions and EdTech providers — not with the child. Moreover, EdTech companies are advised to write their privacy policies in “clear, child-friendly, and age-appropriate language” and provide separate legal terms for guardians and educators.

With all this said, we perhaps should not be too eager to place all the blame on governments and companies. In its final segment, “Failure to Protect”, the report highlighted testimonies from parents and educators. This showed how students, parents and educators alike were all operating in blind faith during the pandemic. The exceptional situation of the pandemic made everyone too willing to accept and comply with quickly-changing environments – children trusted their parents, parents trusted the teachers, and teachers trusted their schools and their governments.

The report's recommendations highlight a collective responsibility in ensuring the safety of our children online. We are all responsible to remedy past wrongs and prevent further risks to our children by addressing modern technology’s most glaring privacy issues.

The post Your Child is Being Watched: EdTech and Children’s Privacy Part 2 appeared first on IPOsgoode.

Sally Yoon is an IPilogue Writer, IP Innovation Clinic Fellow, and a 2L JD Candidate at Osgoode Hall Law School.

Pandemic-related school closures pushed the adoption of educational technology (“EdTech”) in classrooms to new heights. In fact, that the industry will surpass $377 billion by the year 2028. In response to the pandemic, Teachers across the globe were forced to adapt to online settings and were left scrambling for fun virtual tools to keep their children engaged in the classroom – but at what cost?

On May 25^th, Human Rights Watch (“HRW”) – “a global investigation of the education technology (EdTech) endorsed by 49 governments for children’s education during the pandemic.” A thorough analysis of the selected EdTech products showed that a vast majority of the government-endorsed online learning platforms risked children’s privacy and violated children’s rights. Many of the products were found to collect children’s personal information without the child’s or parent’s consent. This included data like “who they are, where they are, what they do in the classroom, who their family and friends are, and what kind of device their families could afford for them to use”– information unrelated to education.

The findings from the HRW also included , CBC Kids, Math Kids, ABRACADABRA, LEARN, Active for Life, Mathies, Prof Multi, Storyline Online and Storyweaver. Aside from LEARN, Math Kids, and Prof Multi, the other products were found to collect and transmit data, some via means of a third party. Notably, these platforms also all had government affiliation – all products were promoted by the Government of Quebec through “L’ecole ouverte,” a website that suggests digital education resources “approved by a team of experts from the Ministere de L’Education,” while “Mathies” was developed by Ontario’s Ministry of Education.

To illustrate how tracking technologies are so deeply integrated into children's lives, the report opens with a compelling story about a student named Rodin. Rodin logs onto his virtual classroom, draws on the virtual whiteboard during break time, and posts his homework using a social media platform— just like every other school day during the pandemic. However, what he doesn’t realize is the countless tracking technologies that surveil his online interactions by following him across the internet. Information about his browsing habits, location, and family contacts is passed along to advertising technology (“AdTech”) and other companies to eventually “piece together an intimate portrait” of him and to figure out what may influence him and make predictions about his future behaviour. These valuable insights can then be sold to other parties, who wish to target children just like Rodin in the future.

While they may impress us with their tech-savvy abilities, children are children. We cannot expect them to freely make decisions online and understand their full impact. Although parents are often willing to sacrifice whatever it takes to ensure their children’s safety, they have only limited control. The surveillance took place in virtual classrooms via various EdTech products where neither children nor their parents could object to it. With no proper protective measures in place, children around the world were left open to harm, all in the name of education. 

Part 2 will discuss the HRW report’s recommendations and the initiatives being taken to address the risks that EdTech poses to child privacy.

The post Your Child is Being Watched: EdTech and Children’s Privacy Part 1 appeared first on IPOsgoode.

Somewhere out there, there is an old photograph of a very young child standing completely naked, showing the marked signs of a most unusual medical condition.

I met that child when she was well into her old age, one winter afternoon over a decade ago.

Mariana (not her real name) had just returned from the cemetery where her husband is buried. Dressed all in black, her hands clutching a small-change purse wrapped in a clear plastic bag, she regarded me warily when she saw me waiting by her front door.

‘I am not Mariana’, she protested when I greeted her by name. ‘I am her sister. What do you want from her?’

But I knew she was Mariana. There were dark circles under her droopy eyes, just as in the photo that had accompanied the news of her medical case several decades earlier. Her hands trembled as she tried to unlock the door to her crumbling plastic-roofed shack.

I explained that I had just finished reading a recent book about ‘her sister’ and that I only wished to speak to her about conflicting information contained in that publication, as I was conducting research about her medical condition.

Mariana listened in perfect silence, eyeing me suspiciously. Upon hearing the name of the author of the book, her nervousness turned to fury.

‘God knows whether that man is even a doctor! Are you a friend of his? Did he send you here? Why on earth should I give a damn about your research?’ she shouted, veins throbbing at her temples. ‘I am not a guinea pig!’

Mariana’s reaction startled me. Unknowingly, I had opened old wounds, and I felt profound guilt for making them fresh again. My unexpected visit, as it turned out, was just another one of those harassing knocks at the door that she had endured throughout her life.

‘I recognize you!’ she snapped, jabbing a finger at my face. ‘You have been following me’.

I tried reassuring her that this was not the case, but Mariana struggled to take my word for it. Her privacy has been repeatedly invaded by complete strangers since childhood. Treating her as an object of their curiosity, her emotional wellbeing has been collateral damage. She now finds it difficult to trust anyone.

‘Please forget me,’ she then said, her voice cracking. ‘I just want to be left alone’.

LOOKING FOR ANSWERS

Mariana’s photograph was originally taken without her consent in the course of a medical examination, years before the internet existed. Soon after, it was published in a French medical journal, along with her full name and medical details. Her story then appeared in newspapers and magazines around the world. Decades later, when it was posted online, the photograph quickly went viral, taking on a life of its own. It has now been viewed millions of times, making it impossible for her to be left in peace.

Throughout her life, perfect strangers have invaded her privacy without regard for her emotional wellbeing

Unquestionably, the circulation of such sensitive material violates Mariana’s privacy, dignity and family-life interests as guaranteed by national laws and international human rights treaties. Less clear, though, is the practical question of how one goes about stopping the infringement of these rights. What can be done to stop the circulation of harmful (and non-consensual) content of this nature? Where does one even begin?

Haunted by Mariana’s lifetime of distress, and in search of answers, I landed at Osgoode Hall Law School in Toronto.

As journalist-in-residence there, I worked from 2017 to 2019 with a team of 20 law students and 18 law professors, alongside lawyers from several countries, on a project entitled ‘A Child’s Right to be Forgotten’. Our objective was to analyse Mariana’s case and find a potential solution to this extraordinary situation.

After a careful examination of multiple areas of law and a plethora of expert opinion – from legal academics, jurists, ethicists, medical professionals, trauma psychologists and scientists – we pursued several lines of approach.

COMPLICATED MATTERS

First, we considered copyright law to try to stop the circulation of the photograph. Given that it had been first published in France, UK legislation presented an opportunity to undertake corrective measures. Through the Berne Convention, the UK and France recognize each other’s copyright regimes. In France, the copyright was technically still valid – provided it could be established that the photograph was an intellectual creation under French law. If Mariana’s picture was being published online without the authorization of its owner, a request could be made to the rights holder, we reasoned, to revoke any use not bound by contract.

But we ran into difficulties locating the owner of the copyright as the image had no credit line. We tried contacting the medical journal in France, only to discover that it had since been acquired by another publisher, Elsevier Masson.

We reached out to Elsevier, but, surprisingly, they did not know whether or not they owned the copyright.

In a baffling email response, an employee from the company’s copyright unit wrote: ‘[W]e are unable to confirm that we are the legal copyright holders of the figure… and that we are entitled to deliver permissions to third parties. Therefore, although Elsevier Masson has no objection for you to use the aforementioned material subject to suitable acknowledgement to the source, it is important that you obtain, prior to use, written permission from the author(s) (or heirs) of the figure…’.

The only possibility of finding out who held copyright for the photograph was to ask the publisher if they had kept a copy of the contractual agreement with the photographer. But that turned out to be a dead end.

FURTHER INTO THE MAZE

Next on our list was image rights legislation. The island of Guernsey has legislation for the protection of a person’s image rights. This is a somewhat niche course, used mostly by celebrities, enabling them to register their image rights there and bring legal action against breaches. It sounded promising, but only Mariana, or someone acting on her behalf with her consent, could assert those rights. Seeing how Mariana avoided all contact with outsiders, and determined to prevent exacerbating her trauma by raking it all up again, we couldn’t pursue this route further.

We then looked into data protection and the right to be forgotten as a new line of inquiry. As it is in the EU, personal data is protected in Mariana’s country. Given that Mariana has not consented to the use of her personal information on the internet, a request can be made to those processing her information to remove it. This can be accomplished pursuant to her country’s Data Protection Act.

Better still, a request can be made directly to search engines (as opposed to individual websites) to remove search results containing infringing content. While this course of action normally would require Mariana’s direct intervention, there is a legal provision that makes it possible for a third party to lodge a formal complaint of infringement with the National Authority for the Protection of Data in that country. Mariana’s consent was not required for this action.

Encouraged by this new window of opportunity, we prepared to make our move. But soon other complexities arose. The complaint to the regulatory agency had to be filed in person, which we did – even though this required a long-distance trip. After securing the assistance of lawyers with relevant experience in Mariana’s country, we proceeded with a complaint against Google for infringing on her rights. But then, bureaucracy took on a Kafkaesque turn.

Our case was deemed inadmissible. Why? It turned out that Mariana’s consent was required after all for any action initiated to remove the very material that had been originally made public without her consent. But had Google obtained Mariana’s consent before making her personal data public online? Of course not. Could the regulatory agency make that inquiry? They failed to address this question. Two appeals later, our case was closed.

We then resorted to a non-legal approach. Bearing in mind that there is public interest in this matter, as well as a legal and moral obligation to put an end to decades of harm, we brought the case to the attention of five United Nations special rapporteurs seeking their intervention. Unfortunately, that avenue produced no fruitful outcome either.

A letter was then sent to Elsevier briefing them on the serious privacy impacts of the use of Mariana’s name and image in their publications. Would they consider removing them? Or at least blurring her face when using that image and anonymizing her details? It went unanswered.

No matter what we tried, we came up against hurdles.

THE BIGGER PICTURE

At the end of the day, this work is not just about Mariana. Her story is part of a much bigger picture. It is the story of countless vulnerable people being harmed by the online circulation of intrusive content, while internet intermediaries profit from such material.

According to trauma psychologists, Mariana will likely never be able to develop trust in others. The consequences of her childhood trauma and public exposure are profound, dramatic and long-lasting. And that is to say nothing of the strangers interested in her story, whose curiosity makes her relive her trauma again and again.

Countless vulnerable people are being harmed by the online circulation of intrusive content, while internet intermediaries profit

The literature on image-based abuse suggests that the re-posting of such images is, in and of itself, a form of abuse. The online availability of the images causes great damage to survivors.

Taking into account Mariana’s lack of agency, it is unreasonable to expect her, or someone in a similar situation, to stand up to tech giants and fight for her right to privacy. Given that online material can be shared globally, it is challenging to identify the jurisdiction in which infringements take place.

Even when there is agency, case law shows that filing a take-down request against search engines and social media platforms is onerous. While they boast about their global reach and presence, they can be quick to argue that they are based in the state of California and are not bound by laws outside that jurisdiction.

Mariana’s story is a cautionary tale of the consequences of failing to remove harmful content from search engines and the internet. Privacy matters. To protect it, regulation is essential. But legislation also needs strengthening to be sensitive to the trauma of those suffering from the unwanted online distribution of harmful personal data.

Remember that behind a photo there is a real person; it’s not just an image waiting for a click of your mouse.

The post A Child's Right to be Forgotten appeared first on IPOsgoode.

The practice of "sexting" - teens sending sexual, nude or semi-nude photos of themselves through text messaging programs on cell phones - is currently garnering a lot of media attention, especially in the United States.  This attention tends to follow two threads.   Either the media addresses whether it is appropriate to charge the teens making, sending and/or receiving these messages with child pornography offences, given that at least one has identified sexting as a wide-spread practice among teens, or the focus is on the hardships suffered by the young people whose images are circulated beyond the originally intended recipient.

The thread focusing on harm to subjects of sexual photos typically arises where a jilted ex-boyfriend more or less widely circulates a consensually taken and sent photo after the relationship goes sour.  The harm here lies not only in the circulation of the photo per se, but the ridicule, harassment, and other forms of bullying the subject of the photo is subjected to by her peers - harm that is imminently foreseeable (and often intended) by the ex-boyfriend who got the ball rolling.  On the March 6^th edition of the , the tragic story of one such victim, Jesse Logan, is recounted by her grieving mother: after months of taunting and abuse by her peers which was sparked by the widespread circulation of a nude photo by her ex-boyfriend, 18 year old Jesse committed suicide.  Jesse's mother is on the show to inspire two actions: discourage other teens from sending sexual photos in the first place, and encourage schools and police forces to intervene and remedy the situation, before it escalates to the point of hopelessness.

In what appears to be a follow up episode on March 10^th, the aired another segment on the perils of sexting, this time focusing on the consequences for those who make or send the photographs, and asking whether slapping child pornography charges on teens is appropriate.  While Jesse Logan's story is raised again, the lead example is of Florida resident Phillip Alpert, who at age 18 was convicted of transmitting child pornography when he retaliated against his sixteen year old ex-girlfriend by sending her nude photo to over 70 people, including her parents, grandparents and teachers.  Given Florida's draconian sex offender registry system, Alpert is under close supervision and on the sex offender registry.  The upshot of the segment is that for one stupid and admittedly mean spirited act, his life has been ruined.  Florida "First Amendment and Internet law" attorney Lawrence Walters is the expert on the show, stating that 1) while these acts are wrong, they should not fall under child pornography offences (which he characterizes as being really about adults consuming images of children being sexually abused); and 2) that we are holding teens to a higher standard than adults by punishing activities which adults engage in all the time.

What strikes me about Walters' reasoning is that it either conflates consensually held photography with non-consensual circulation, or it holds that because we don't punish adults who engage in the mean spirited non-consensual circulation of sexual photos of their ex-lovers we should not punish adolescents for this behaviour either.  The Canadian approach to the harms of child pornography excludes the taking and sharing of sexual photos by minors over the age of consent, as long as such photos are kept privately and for the mutual pleasure of the intimate partners involved in taking the photo ().  Thus in Canada, it is only where the photo is circulated outside of the original intimate partnership that the acts of possessing or distributing the photo qualify as child pornography offences.  This approach avoids some of the more egregious mismatches highlighted by , where privately held sexual photos of teens were discovered by teachers or coaches who confiscated cell phones under school cell phone bans, for instance, rather than due to the photos themselves causing disruption in the school.  

But Canada and the U.S. share an uncomfortable fit between malicious circulation of once consensual sexual photos among peers and child pornography offences, as well as a lack of accessible remedies for adults who fall victim to similar malicious behaviours.  In other words, I would turn Walters' argument in a different direction, namely that part of the problem of the perceived mismatch of action to punishment among teens is the unavailability of a remedy for this kind of behaviour by adults vis a vis other adults, which is connected to that fact that only child pornography law applies, rather than, say, a criminal variant of invasion of privacy. 

There are sound reasons why child pornography offences apply (again, set out in R. v. Sharpe) and why we deem youth under 18 as incapable of consenting to being the subject of sexual photography that is publicly disseminated.  But there are also some underdeveloped threads within privacy law regarding the exposure of a person to ridicule via photography which are broached in Aubry v. Editions Vice Versa that could justify an offence of invasion of privacy in cases of malicious publication or circulation of intimate photos - which may be a preferable route over child pornography offences for at least some of the teen-on-teen cases, in that they would not be sexual offences per se and could carry a lesser penalty. 

Aubry, being concerned as it is with a civil law breach of the Quebec Charter's protections of "private life", struggles with the degree to which the facts in that case lend themselves to a finding that the subject of the photograph (a 17 year old girl sitting outside on the steps of a building) suffered harm as a consequence of the non-consensual taking and publication of the photo at issue.   Interestingly enough, the final ruling in favour of the plaintiff depends more on the specificity of a teenager's social circle than some more universal standard of harm, where it is precisely a "teenager's sensitivity to teasing by her friends" that is foreseeable by the photographer taking and publishing her picture without her consent.  Where the circulation of sexual photographs is concerned, the elevation of the civil standard of foreseeability to the criminal standard of mens rea is not far fetched - particularly where photographs of teens are concerned, and where indeed the point of the circulation of the photograph is clearly to both humiliate (by sending the photographs to parents, grandparents and teachers) and to incite the bullying behaviours of peers.    The availability of such an offence might mean that people who circulate sexual images of teens within the subject's social world would still be more likely to meet the elements of the offence than a person who circulates a photo of an adult, but the offence would not reinforce the somewhat arbitrary disappearance of protection that currently occurs once a young person turns 18.

An additional benefit of such an offence is that it emphasizes the dignity-based privacy values which underlie the harms caused by these actions, and the offence would not be limited to sexual photos but could include other types of compromising photos (washroom photos, for instance).  It is certainly important to note that for the most part the victims of these actions are girls or young women, for whom the maintenance of dignity in the realm of sexuality is still, sadly, hard to come by.

The post Sexting, Teens And A Proposed Offence Of Invasion Of Privacy appeared first on IPOsgoode.