Evidence of meeting #53 for Access to Information, Privacy and Ethics in the 41st Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A video is available from Parliament.
4:10 p.m.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Very well. Thank you.
The term “personal information” is defined in a variety of ways. I would like to know which definition Google uses.
4:10 p.m.
Policy Manager, Google Canada, Google Inc.
We use the definition of our primary regulator, which is the FTC.
4:10 p.m.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Fine. Thank you.
So you can now make changes to information—and I think that's an excellent tool—if, for instance, you want to correct your age, as in the example you mentioned.
But if a Google user doesn't change the default settings, will that person's information end up being destroyed or kept forever? I am referring to search engine optimization data or previously visited sites and so forth.
4:10 p.m.
Policy Manager, Google Canada, Google Inc.
It could be destroyed forever. If, in the case of websites, you've allowed us to record your web search history, and then you decide to turn that off, then that's gone.
4:10 p.m.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Let's assume I'm a first-time Google user, and I don't change the default settings. Will that information be destroyed at some point if I don't change or delete it on my own initiative?
4:10 p.m.
Policy Manager, Google Canada, Google Inc.
It's a difficult question to answer because it's an evolutionary process. As you're using the web search, we're not trying to serve results to you that deal with your needs in the past. We're trying to serve results to you that deal with what you're looking for right now. However, we can get insight over time into what you're interested in, what you're looking for, and which results you did not find useful.
There are elements of all of that data that don't necessarily pertain to you as an individual, but that we find useful in developing new products and new tools. The distinction you made originally between personal information and other data that could be associated with your activities, but isn't associated with you, is a useful one for us.
I would say that at some point we do not retain all the data that we collect, simply because it's not useful to us. At the point where it no longer becomes useful, we delete it. We're not in the business of creating a very large bucket of information about you. We're in the business of providing very useful services and products to you as an individual.
4:15 p.m.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Clearly, that data is less pertinent 10 years later. Is there some kind of mechanism in place that destroys that data? Is it done systematically?
4:15 p.m.
Policy Manager, Google Canada, Google Inc.
Yes, there is. It's just.... It's not one simple answer. The reason I'm pausing is simply because, depending on how valuable that log information is—for example, in fighting malware—we may keep it for x period of time. For web search history, it may be a different period of time. But it's certainly not a case of 10 years, and it's not a case of multiple years.
4:15 p.m.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Thank you.
My next question is on a different topic.
Companies and social media sites commonly change their terms of use and privacy policies quickly, in order to adapt to the equally fast-changing technological landscape.
In that environment, how can we be certain that user consent is ongoing and informed?
4:15 p.m.
Policy Manager, Google Canada, Google Inc.
Thank you for that question.
You're right: there's a constant evolution. When we look at the marketplace right now, not just at our product but at any company's products, you can see this in your daily experience. The screens and the notices that you're given when you sign up to use new products, to download apps, and to use new hand-held devices are constantly changing, because they're reacting to consumer needs. They're reacting to the input of privacy and technological advisers.
We're arriving at a place where we're starting to see notices that are more complex—sorry, not more complex, but that give you more information about the decisions you're making at that moment and that give you the opportunity to make an immediate decision about whether this service is actually useful to you. In fact, what we're seeing in one of our products on the android phone is that people are making decisions not to download an app, based on the information that's provided to them in the sign-on process. The sign-on process has gotten to a point where it's clear enough, in that they've arrived at a piece of information and have said that the usefulness of the app is not valuable enough for them to make that trade-off.
4:15 p.m.
NDP
The Chair NDP Pierre-Luc Dusseault
Unfortunately, your time is up, Ms. Borg.
It is now Mr. Butt's turn for five minutes.
4:15 p.m.
Conservative
Brad Butt Conservative Mississauga—Streetsville, ON
Thank you, Mr. Chair.
Thank you very much, Mr. McKay, for being here today. Again, on behalf of the committee members who did go to Washington, thank you again for the opportunity to visit your location in Washington and, certainly, to learn more about what the organization is doing.
When we visited and learned about what the challenges are around privacy in the U.S. as well, I think what we took back is that there isn't as robust a regime in the United States currently as there is in Canada, even though part of what we're doing here as a committee is reviewing our privacy protection, .obviously, and making sure that we're up to date with how fast the world is evolving over the Internet and through social media.
I know that at Google Canada in particular you've had I believe a fairly positive working relationship with our Privacy Commissioner. I know that we've been wrestling with her role and the role of her office in overseeing these issues and obviously in dealing with complaints if they emanate through to her office, and also with what roles and responsibilities, beyond what she currently has, that we should be looking at.
I think it's helpful to get advice from the organizations with which her office is interacting. Obviously, financial penalties have been raised, and also some other increase in her adjudication role. There have been different schools of thought on that, as to whether that is better, worse, or fairer. Some people have said that it would make her the judge, the jury, and the sentencer all in one. Others have said that maybe the Privacy Commissioner does need those additional roles.
Have you folks looked at that in any more significant way? Have you compared and contrasted the regulations by the Federal Trade Commission in the United States—under which you're operating, to some degree—versus being under the auspices of our Privacy Commissioner here? Are there any specific things that you folks have learned from it that might be helpful to our committee in looking at some recommendations?
4:20 p.m.
Policy Manager, Google Canada, Google Inc.
I'll leave my comments to the Canadian situation. As you know, I have plenty of American colleagues who deal with the FTC and the other agencies on a daily basis.
In Canada we have the advantage that we have a national private sector privacy legislation, and we actually have national private sector privacy legislation that is comparable to, and is in fact complementary to, legislation in some particular provinces. What that has meant operationally for our company is that we have a consistent set of standards across the country, across all our product lines, that we know we have to meet. And we meet them on a daily basis.
We also know that we have a relationship with the privacy commissioner at the federal level and the provincial levels where we can speak to them if we have questions about the application of that legislation, and we can speak to them about what may be developing in terms of technology, even long before there's an actual product, so we can arrive at an understanding of what compromises and what sort of tools have to be made available to users in order to reflect the privacy legislation in Canada and the needs for data protection and security of the users. We've seen that this works.
You mentioned financial penalties. In my experience, we've seen companies, particularly in the online space, be the subject of investigations and reports by the Privacy Commissioner and then react very strongly and very quickly to resolve the concerns of the commissioner as identified.
There are many more cases where there are complaints and those issues are resolved in dialogue with the commissioner's office. The difficulty we would face moving to a regime such as is available in some countries in Europe is that the relationship becomes more cautious. If you are dealing with a data protection authority that has the ability to levy financial fines, there's a caution in how you engage in dialogue with that authority, both in terms of making sure that you've set limits very clearly and that you're very aware of the implications of that engagement.
I would say that we really have an advantage here in Canada, certainly compared with the United States, in having that consistent legislation across the country. We've seen 10 years of it being applied fairly well, with very few instances where companies have not responded to the reports delivered by the commissioner.
4:20 p.m.
Conservative
Brad Butt Conservative Mississauga—Streetsville, ON
I have a daughter who is turning 13 on Thursday, and she is very social media-savvy. She doesn't get it from me; she must get it from her mother. I'm always concerned about children and their use of social media.
I don't want to stifle their ability to participate and be creative and interact with their friends and all that. I think it's good. I mean, that certainly wasn't around when I was 13, right? I think it's wonderful that they can do that. They can share things and get access to information worldwide, instantaneously. It's neat stuff. But as a parent, I still question how to make sure her privacy, her personal life, isn't somehow invaded.
Do you see, as an organization...? In answering some of Mr. Carmichael's questions, I think you provided some very good evidence to show how strong a privacy policy you have, that people can take their stuff and run, if they feel there is an issue, they can go and it's done and their privacy has been protected.
But do you see a different role for underage users versus adult users? Have you developed anything to monitor that within the organizations, that we're making sure that, you know, the Sarah Butts of the world are protected versus the Brad Butts of the world—who's probably old enough to know better?
4:20 p.m.
NDP
4:20 p.m.
Conservative
4:20 p.m.
Policy Manager, Google Canada, Google Inc.
To be brief, as the chair has asked, I have three children over the age of 12, and in many ways it's the same debate we've had as parents for eternity: how do you learn to control people who are becoming young adults, whether it's online or offline?
But you're right, there's a clear need to provide tools both for young people as well as their parents, to understand the tools they are using, the environment in which they are using, and the benefits and the costs of how to use them.
I mentioned in my notes that Google+ was built specifically with this conundrum in mind, trying to provide a tool for young adults that allows them to communicate but within an environment that reflects that they may not necessarily fully understand the impact of what they're about to do, and also trying to isolate them a bit from those larger societal impacts of their engagement online.
4:20 p.m.
Conservative
4:25 p.m.
NDP
Alexandre Boulerice NDP Rosemont—La Petite-Patrie, QC
Thank you, Mr. Chair.
Thank you very much, Mr. McKay, for being here today. We quite appreciate it. You were obviously indispensable to our study.
From what I gather, when we surf using Google, you keep data on the footprints we leave all over the Web, information on what our interests are, which sites we visit and so on. You then use that information to seek out advertisers looking for specific profiles. That's the word you used earlier. You build profiles. Is that right?
4:25 p.m.
Policy Manager, Google Canada, Google Inc.
Yes. I wouldn't specifically say “profiles”, because that implies a level of personal engagement that doesn't exist. It's more buckets of information about demographic groups and specific interests rather than actual profiles.
4:25 p.m.
NDP
Alexandre Boulerice NDP Rosemont—La Petite-Patrie, QC
Earlier, Charmaine and I were talking about skiing. If I'm someone who reads ski magazines or goes on skiing sites or sites that sell sports equipment, it is highly likely that the name of an advertiser who sells skis will pop up. You also said that there is now an “incognito” option.
4:25 p.m.
NDP
Alexandre Boulerice NDP Rosemont—La Petite-Patrie, QC
So all of my interests and surfing activity are rendered invisible or non-existent on your end.