D. Topics in Computer Science · Topics in Computer Science: Sustainability, Ethics, Emerging Technologies and Careers

Privacy and Personal Data: Law, Re-identification and Privacy by Design

D2.1 D2.3About 75 minutes

Learning goals

I can explain what personal information and quasi-identifiers are and how linking attacks re-identify people.
I can describe the main privacy laws that apply in Ontario and Canada and the status of federal reform as of October 2026.
I can apply privacy by design and data minimization when building software.
I can measure k-anonymity and generalize data in Python, and use strategies to protect my own privacy.

Words to know

personal information
Information about an identifiable individual.

quasi-identifier
A detail, such as age or postal area, that can identify someone when combined with other details.

linking attack
Re-identifying people by joining datasets on shared quasi-identifiers.

k-anonymity
A property of a dataset in which every combination of quasi-identifiers appears in at least k records.

data minimization
Collecting and keeping only the personal information needed for a stated purpose.

privacy by design
Building privacy protections into systems from the start, with privacy as the default.

PIPEDA
Canada's federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act.

"I have nothing to hide"

Many people say privacy doesn't matter to them because they have nothing to hide. But you close the bathroom door, you don't post your bank PIN, and you probably wouldn't want a stranger reading your search history. Privacy is about control: who knows what about you, and what they can do with it. Computers make it cheap to collect, store, combine and copy personal data forever, which makes privacy one of the central ethical issues in computing.

Personal information and why "anonymous" data often isn't

Personal information is information about an identifiable individual: obvious items such as a name, address or student number, but also photos, location history, purchase records and online identifiers.

Removing names is not enough. Quasi-identifiers are details that are not unique alone but can identify someone in combination: age, gender, postal area, school, job. A widely cited 2000 study by computer scientist Latanya Sweeney estimated that about 87% of people in the United States could be uniquely identified by just their five-digit ZIP code, date of birth and sex. Joining a "de-identified" dataset to a public one on quasi-identifiers is called a linking attack.

A linking attack. Neither dataset alone reveals J. Doe's diagnosis, but joining them on age, postal area and gender may. (The data are made up.)

Privacy law in Canada and Ontario (as of October 2026)

PIPEDA (Personal Information Protection and Electronic Documents Act) is the federal law for how private-sector organizations handle personal information in commercial activities. It is built on ten fair information principles: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure and retention; accuracy; safeguards; openness; individual access; and challenging compliance. The Office of the Privacy Commissioner of Canada oversees it.
Ontario's public sector follows the Freedom of Information and Protection of Privacy Act (FIPPA) and, for municipalities and school boards, the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). The Information and Privacy Commissioner of Ontario oversees them.
Ontario's Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (S.O. 2024, c. 24) lets the province set rules for public-sector cyber security, artificial intelligence, and digital information about people under 18 collected by school boards and children's aid societies.
Reform in progress: on June 15, 2026, the federal government introduced Bill C-36, which would replace the privacy part of PIPEDA with a new Protecting Privacy and Consumer Data Act. It would treat children's personal information as sensitive, define de-identified and anonymized information separately, give people a right to an explanation of significant automated decisions, and allow penalties up to the greater of $10 million or 3% of global revenue (higher for the most serious offences). As of October 2026 it had passed only first reading, so PIPEDA is still the law. Two earlier attempts (Bill C-11 and Bill C-27) died before becoming law, so check the bill's status before relying on it.

Privacy by design

Privacy by design, developed by Ann Cavoukian when she was Ontario's Information and Privacy Commissioner, says privacy should be built into systems from the start, not added later. For a programmer this means:

Data minimization: collect only what you need. If you need to know a user is over 18, store "over 18: yes", not their birth date.
Purpose limitation: use data only for the purpose you told people about.
Privacy as the default: the most private settings are on unless the user changes them.
Security: encrypt data, limit who can see it, and delete it when it is no longer needed.
Generalization before sharing data for research: replace exact values with ranges so each record matches several people.

Generalizing quasi-identifiers. Each step to the right protects privacy more but gives researchers less detail.

k-anonymity

A dataset is k-anonymous if every combination of quasi-identifiers appears in at least k records. Then any person could be any one of at least k people, and a linking attack can't single them out. The program counts the size of the smallest group.

from collections import Counter

records = [

(17, "P3E", "F"), (16, "P3E", "M"), (17, "P3E", "F"),

(18, "K7L", "M"), (16, "P3E", "M"), (18, "K7L", "M"),

(17, "K7L", "F"),

]

def k_of(rows):

groups = Counter(rows)

return min(groups.values())

def generalize(row):

age, area, gender = row

band = "15-19" if 15 <= age <= 19 else "other"

return (band, area, gender)

print("k before:", k_of(records))

general = [generalize(r) for r in records]

print("k after age bands:", k_of(general))

print(Counter(general))

no_gender = [(band, area) for band, area, gender in general]

print("k after also removing gender:", k_of(no_gender))

Counter counts how many times each combination appears; the smallest count is k.

k before: 1

k after age bands: 1

Counter({('15-19', 'P3E', 'F'): 2, ('15-19', 'P3E', 'M'): 2, ('15-19', 'K7L', 'M'): 2, ('15-19', 'K7L', 'F'): 1})

k after also removing gender: 3

Output of the program above (what Python prints).

Worked example

Example 1: Finding k by hand

Use the seven records in the program. (a) Group them by (age, area, gender) and find k. (b) Which record is at risk? (c) After age is generalized to 15-19, what is k now, and why isn't it higher?

(a) Groups: (17, P3E, F): 2; (16, P3E, M): 2; (18, K7L, M): 2; (17, K7L, F): 1. The smallest group has 1 record, so k = 1.
(b) The record (17, K7L, F) is unique, so anyone who knows a 17-year-old girl in area K7L is in the data can identify her.
(c) With age bands: (15-19, P3E, F): 2; (15-19, P3E, M): 2; (15-19, K7L, M): 2; (15-19, K7L, F): 1. Still k = 1, because the K7L female record is still alone: every record was already in the 15-19 band, so generalizing age didn't merge any groups.
To raise k we would generalize something else (for example the area to its first letter, or remove gender), or remove the outlier record.

(a) k = 1 (b) the 17-year-old female in K7L (c) still k = 1: generalize the area or gender too, or suppress that record. The program's last line shows that removing gender gives k = 3.

Just for fun

Why did the browser cookie go to the Privacy Commissioner?

It felt like it was being tracked.

Strategies you can use now (D2.3)

Review app permissions (location, contacts, microphone) and turn off what an app doesn't need; use private defaults on social media; think before posting other people's information or photos; use your right to ask an organization what personal information it holds about you; and when you build software, collect less.

Hands-on activity

Privacy audit of your own phone or computer

You need: your phone, tablet or computer (with a parent's help for shared devices), and paper.

Open the permission settings. List five apps and which permissions each has (location, camera, microphone, contacts, photos).
For each permission, write whether the app needs it for a feature you use. Turn off at least one that isn't needed.
Pick one app or service you use and find its privacy policy. Record: what it collects, why, who it shares with, and how long it keeps data. Which of PIPEDA's ten principles does the policy address?
Write three data-minimization suggestions for that app's designers.

What to look for: a permissions table, at least one change made, a policy summary in the student's own words, and suggestions that reduce collection rather than just "add more security".

Your turn

What is a quasi-identifier? Give two examples.

Explain a linking attack in one or two sentences.

Which federal law governs how businesses handle personal information in Canada, as of October 2026?

Name four of PIPEDA's ten fair information principles.

What is data minimization? Give an example for a sign-up form.

A dataset has groups of sizes 4, 3, 7 and 2. What is k?

Who developed the idea of privacy by design?

More practice: warm-up

Which Ontario law covers privacy at school boards?

True or false: removing names from a dataset always makes it anonymous.

What does Counter(["a", "b", "a"]) count?

What is the first three characters of a Canadian postal code called in this lesson's example?

Who oversees PIPEDA?

More practice: on your own

Modify generalize so the area becomes only its first letter (for example "K7L" → "K"). What is k for the seven records now?

Bill C-36 would separate 'de-identified' from 'anonymized' information. Explain the difference.

Why does generalization involve a trade-off?

A fitness app collects continuous GPS location even when not in use 'to improve services'. Which PIPEDA principles does this raise concerns about?

Your friend posts a group photo with everyone's school and location tagged. Give an ethical argument against and a strategy that respects privacy.

Challenge

Write at_risk(rows, k) that returns a list of the combinations appearing fewer than k times. What does at_risk(records, 2) return for the original seven records?

A school board wants to publish a spreadsheet of Grade 12 marks by course with each student's birth month, postal area and gender, but no names, "for transparency". Analyse the privacy risk and propose a safer way to meet the goal.

Explain why the idea 'I have nothing to hide' misunderstands privacy, using two computing examples.

Check your understanding

Quiz

A dataset's quasi-identifier groups have sizes 5, 2, 9 and 3. What is k?

Which statement about Bill C-36 is accurate as of October 2026?

What is a linking attack?

Which design choice best follows data minimization?

Who oversees privacy for Ontario school boards under MFIPPA?

Why does generalizing ages into ranges help privacy?

Who developed privacy by design?

For parents and teachers

Big idea: Privacy is one of the main ethical issues in computing (D2.1), and the lesson ends with practical strategies (D2.3). Students learn why removing names is not enough, which laws apply, and how programmers protect privacy by design.

How to help: Do the permissions audit together on your own phone as well as your teen's; it is a good conversation about what apps really need. Ask your teen to explain k-anonymity using your family as a "dataset".

Common difficulties:

Believing de-identified data is automatically anonymous.
Thinking Bill C-36 is already law. As of October 2026 it has only passed first reading; PIPEDA still applies. Check the bill's current status (parl.ca LEGISinfo) before quoting it.
Confusing encryption (protects stored data) with minimization (collects less).
In Example 1, noticing that generalizing age did not raise k because every record was already in the same age band.