Information & Ethics Committee on June 7th, 2012

[Charlie Angus, NDP, Timmins—James Bay, ON]

I'm sorry that this grandstanding is happening. There was a discussion in camera and you can call me out of order for it if you want. At that discussion, there was a gentleman's agreement that we would talk to each other and come back to the committee with a recommendation. Unfortunately, Mr. Del Mastro went into the House and made a public statement. Now you're using this on a televised broadcast to make a public statement.

This was something we agreed to deal with within our committee and then come forward with recommendations. So I think you're just trying to embarrass him.

I'd tell Mr. Andrews he should wait until we go back to continuing the conversation that we had on Tuesday.

[The Chair, NDP, Pierre-Luc Dusseault]

I will let Mr. Andrews decide what he wants to do. If he wishes to continue the discussion with the witnesses and to come back to this topic a little later, in accordance with the agenda, we can leave the matter there.

Mr. Andrews, you may continue.

[Scott Andrews, Liberal, Avalon, NL]

Before you go into my time, maybe we should discuss this in public after our witnesses, and I'd be willing to address Mr. Tweed's comments at that particular time. I would not want to do it in camera as is suggested on our order paper. I will address that at a later point.

So can I continue with my questioning?

[The Chair, NDP, Pierre-Luc Dusseault]

Yes. You have seven minutes.

[Scott Andrews, Liberal, Avalon, NL]

Thank you.

Ms. Denham, I have three questions for you. Mr. Calkins just talked about knowledge and consent, and one of the other things you mentioned in your presentation was limiting the use of the data that is collected. Do you have any suggestions on how one would regulate that? How do we limit one's use of the data that these companies collect?

The second question is this. You've talked about investigations, and you mentioned one. How many investigations have you undertaken, and have they been of the social media companies? I believe the one you referenced wasn't of the social media company but of an outside party that used the information.You can correct me if I was wrong in stating that.

In part of that you said you issued some guidelines to this outside group. I wonder if you could provide those guidelines to the committee. How extensive were those guidelines? Could you just clarify those few points.?

[Elizabeth Denham]

Absolutely.

In terms of ideas for limiting use by social media companies, obviously, people are voluntarily putting information online on their profiles. The company should only use that data for the purposes that are clearly stated, and that's the whole principle of transparency.

If the company then wants to use the information for a new purpose, then it has to go back to the users and explain the new purpose and get their consent. A really good example is that if you're a Facebook user and then all of a sudden Facebook rolls out its facial recognition technology software. That's a new use of the data. It's a more precise use of the data. It can lead to all kinds of function creep. I think in that case the company needs to go back and explain the new uses, the shiny new toys that are available to users, and get their consent.

That's really important. If they have new partners, if there are more third-party applications that are using the data, again, let users know and make it easy for them to say no or to control the use of their data.

The second question you asked me is about the number of investigations we have done of social media sites versus investigations that involve social media. I gave you the example of our investigating, really, the employment situation and how employers or third parties are making use of social media. I wanted to draw that investigation to the attention of this committee because I think it's really important to look at how social media is used by litigants, by law enforcement, by employers, by post-secondary institutions, because I think that's part of your study as well.

We've done several of those investigations, and I will share our social media background check guidance with you. I'll send them to the clerk of the committee for your review.

[Scott Andrews, Liberal, Avalon, NL]

Thank you very much.

Ms. Cavoukian, I have a question on privacy by design. Has there been any discussion with the social media companies, Facebook and Google, on this very concept? Have they issued any opinions on this particular concept of privacy by design?

[Dr. Ann Cavoukian]

I've met with people and spoken at both Facebook's headquarters and Google's, and there is considerable interest in privacy by design. With regard to Facebook, if I had to guess their position, I would say they view privacy by design as being incompatible with their business model. That view is essentially, use as much information for as many purposes as you can, and then if you go too far—as they did with the news feed—then you can pull it back in terms of people's privacy preferences.

I have the greatest respect for Mark Zuckerberg. I've spoken to him. He totally gets that privacy is all about control, and I would suggest that he certainly values his privacy and controls it. But in terms of the business model, I think they would not be interested in it.

Google, on the other hand, is interested. If you look at Google+, which is their online social media, they have tried to incorporate privacy by design features. They invited me to speak to their head engineers, who were designing it, about privacy by design and how you incorporate this in terms of data minimization and making privacy the default. That was the concept behind “circles” and trying to minimize data collections.

I'm not going to oversell this. I think businesses will come to this gradually, if the business model is predicated on reaching as many people as possible.

Having said that, there is a way you can have online social media and privacy, and that's the Google+ experience in circles. I know many people who are on it. I don't know what the numbers are right now. I think they've exceeded 50 to 60 million, but we'd have to confirm that. It has an ability to restrict the information you share to the narrow audience that you want to share or speak with.

If I may, sir, I want to add one comment relating to your first question. With regard to the notion of minimizing data and collections and how you restrict it to the primary purpose, one example we did in my jurisdiction involved the creation of an enhanced driver's licence that could be used across the border instead of a passport.

They, of course, have to collect information. We put directly into the regulation what information, what personal identifiers, could be collected: the name, one's address. We said they should identify the fields specifically, as opposed to leaving it open-ended. We were able to do that. One way of trying to restrict the collection of personal information is by identifying specifically, very narrowly, that which you are permitting.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

Your time is unfortunately up, Mr. Andrews.

I am going to give Mr. Butt the last seven minutes. Time is passing, and the committee will proceed with its business afterwards.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

Thank you very much, Mr. Chair.

Thank you very much, to both the Ontario and British Columbia commissioners for joining us today.

Maybe I'll start by asking each of you, are there specific things you are doing through your provincial legislation that we are not doing at the federal level that would improve our protection of privacy? Can you give me one or two specific things you are doing in your provinces that we could learn from and do a better job of?

As you know, there is a bill before the House right now that is looking at PIPEDA. I'm sure it eventually will get to a committee like this, where there will be some vetting to make it a stronger piece of legislation.

I'll ask each of you—we'll start with B.C and then go Ontario—if there's anything specific you can offer the committee that would be helpful around our federal laws and that would emulate what you are doing in your provinces?

[Elizabeth Denham]

In our discussion today we've been talking about how we need to get the law right. We also need to get the policy right. There needs to be incentives to get the private sector players on board. We also need public education to teach, especially, young Canadians how to properly protect their privacy online.

If social media companies won't play ball with Canadian law, then we really need strong enforcement because at the end of the day it's the essential tool to compel compliance. We can give all the guidelines we want, we can meet with companies, and we can give them great concepts of building privacy into their products, but at the end of the day we do have to have some teeth. We do have to investigate, and we do have to enforce.

In my view, order-making powers are the best starting point. I also think the mandatory breach notification increases the investment in protection of personal information and security and awareness.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

Dr. Cavoukian.

[Dr. Ann Cavoukian]

Thank you.

I concur with my colleague, Commissioner Denham.

We have order-making power in Ontario, and I'm telling you it would not be the same without it. But let me be clear—it is a last resort. The order-making power, which gives you the teeth, is the stick. We rely on it infrequently.

I'll give you the example of PHIPA, the Personal Health Information Protection Act, which applies to both public and private sector health organizations in Ontario, of which there are many. That was introduced in 2004. I've only issued 11 orders under that—so in something like eight years, 11 orders—because there is enormous incentive on the part of organizations to work collaboratively with us early on, and we always try to do that. We work very collaboratively. We strive to reach informal resolutions to investigations and problems, and we've had hundreds, thousands of them. It works very well. The carrot is a much better inducement when they know the stick is there.

On occasion we've had to issue an order and we do it not gladly but certainly willingly, if necessary. Often the order serves the purpose of an educative tool. It sends out a very clear message to everyone of what the standard of practice is now, and what our expectations are in this area. So order-making power is absolutely essential.

We have mandatory breach notification under PHIPA. That is also very important because that informs the population involved in the breach. It gives them the openness and transparency of knowing what is taking place.

We've also had, through the Regulatory Modernization Act in this province, a policy-led hook, if you will, in terms of looking closely at how you embed privacy-types of solutions into regulatory activities. So it's very important to have that cooperation.

I should also tell you, though, that my staff and all of us are out there regularly meeting with organizations. So not only is public education very important, but you have to meet with the organizations that fall under your jurisdiction so that they gain a better understanding of what your expectations are and how they embed privacy by design into their practices, into their technologies, and into their day-to-day activities.

They need to learn that from us, and we do this regularly. I think that allows us to minimize the number of orders we issue, but everyone knows the order-making power is there. It's a very powerful tool.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

As my last question, I'll ask you to comment on this. Commissioner Stoddart gave evidence in regard to the work product information that the national commission looks at, each matter on a case-by-case basis, as opposed to a specific definition. Can you talk about the specific definition versus what the federal government is doing, looking at matters on a case-by-case basis?

I'm not sure who wants to start, but it's up to you if both want to answer that.

[Elizabeth Denham]

For clarity, are you talking about the definition of work product information within PIPEDA?

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

Yes, I believe so.

[Elizabeth Denham]

I think it's important to have a work product definition, because it takes out of the definition of personal information what might be actually just the product of somebody's workplace—an opinion that they write as a lawyer, a report they write as an engineer. To me, that's not personal information, that's work product information and should not be regulated under the act.

I think that's the question you're asking.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

Thank you.

Dr. Cavoukian.

[Dr. Ann Cavoukian]

I agree with Commissioner Denham that sometimes you're producing work at the workplace that has your personal information on it. It has your name and position, as it should, but it is not personal information as it is defined under our statutes, because it doesn't relate to you personally. It relates to your work and what you are required to do at your workplace. So properly, it should not only be identified but should be made publicly available.

I use myself as an example. Obviously I issue orders, and my name is on the order. I also issue many decisions, and my name is attached to them. It would be silly to say that it is my personal information. Obviously it has my personal identifier on it, but it's linked to the work I do and rightly belongs in the public sphere. Just because it has my personal identifier on it doesn't mean that it shouldn't be publicly available, if that's what you mean. It depends on how it's defined in the context.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you. Your speaking time is up.

I want to thank the two commissioners who agreed to appear and who gave us very informative presentations.

Ms. Borg, you had a point of order?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

In fact, as we are communicating with two very interesting witnesses, perhaps we could postpone committee business until the next meeting, next Tuesday, so that we can spend a little more time with these ladies.

[The Chair, NDP, Pierre-Luc Dusseault]

Is there unanimous consent on this matter?

There does not appear to be a consensus.

[Chris Warkentin, Conservative, Peace River, AB]

Was there a desire for a little bit of time? I know that Mr. Andrews wanted to make a statement at the end of the committee meeting. I don't know if that's something he wants to have reserved or if he would like to maybe do that in the House.

[The Chair, NDP, Pierre-Luc Dusseault]

That is his choice. We could continue for a few minutes and set aside five minutes at the end to discuss this matter again.

So we will reserve five minutes at the end of the meeting. According to the agenda, a five-minute question and answer period will be reserved for the commissioners.

In short, since you are very interesting, we are going to keep you with us a little longer.

Ms. Borg, you have five minutes.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

I am very pleased to be able to ask you some questions. You have a lot of information very relevant to our study. We will also be able to elaborate on issues such as how to protect our personal information in the database and in accordance with default parameters conducive to the protection of privacy.

Ms. Cavoukian, I would like to ask you a question on new technologies.

You said you were in the process of consulting a number of engineers, to whom you are explaining how to use the privacy models and to integrate them into the new technologies. Other witnesses have said that certain technologies accidentally collected information and did not make it possible to destroy data.

This is a bit new, but I would like to know how, at the national level, new technologies that are developed could include this integrated privacy protection model.