A position paper argues for something. These carry the evidence behind them, and say which rung of the assurance ladder we occupy, so a reader can weigh the argument against the party making it.
Assessments examine what a service discloses in practice and are published at /research. Positions argue for a change in how transparency is governed. They are separated because they carry different obligations: an assessment stands on its evidence, and a position stands on its argument and on the conduct of the party advancing it.
Every position published here states where Global Privacy Rights itself stands on its own assurance model, at /assurance, rather than leaving that to be inferred.
Made in Canada at Global Privacy Rights. A response to State of Digital Governance in Canada 2026, which defines digital sovereignty as the capacity to choose. We extend that choice from the organisation to the person: consent and autonomy, and the right to choose whether, when and by whom we are identified online, including across borders.
Two groups make it urgent. Children, because the systems built to protect them online increasingly do it by identifying them. And the environment, because claims about where a product came from are only as trustworthy as the record that carries them. Bill C-36 sections 92 to 96 offer the route.
Our submission to the federal consultation run by Innovation, Science and Economic Development Canada. The discussion paper treats transparency as information that developers and deployers provide. That is necessary and it is not sufficient, because once a disclosure has been made the individual holds nothing showing what they were told, by whom, or when.
The submission asks Canada to treat transparency as evidence as well as information: the accountable organisation identified before any interaction, disclosures versioned so they can be retrieved as they stood on a given day, and a receipt of the disclosure available without an account or identification. It also puts the security of AI systems as a transparency question, since security requirements ask whether unauthorised access occurs and rarely ask whether authorised access is accountable.
Nine recommendations, four figures, and a route that needs no new legislation: Bill C-36 sections 92 to 96 already open an approved codes of practice and certification track with independent verification written into it.
A response to the Québec data sovereignty agenda and the four pillars published by Données Souveraines Québec. Digital sovereignty requires more than local hosting: it requires a visible, portable and testable account of who has authority over data, under which rules, for what purpose, and with what controls when data crosses a boundary.
The paper sets out the authority positions that must not be collapsed into one another, a six step chain of evidence, and a proposed Digital Transparency Impact Assessment. It names a collective authority position and deliberately does not describe it, because that is for the rights holders concerned to define. It states where our own registry stands: Level 0 live and self-asserted, Level 2 not built.
How inspectable, bilateral transparency and derivative rights controls give a supervisory authority capacity it does not have today, demonstrated through age assurance. Transparency that is asserted can only be audited after the fact, by hand, one complaint at a time.
An organisation arguing that disclosure should be evidenced has to evidence its own. Our controller identification record is published at /.well-known/transparency/cir.json, and the rung we occupy is stated at /assurance rather than asserted in prose.
Where a position responds to another organisation's published work, it is offered for discussion and is not a joint statement. No endorsement should be inferred from it.