Evidence of meeting #55 for Access to Information, Privacy and Ethics in the 41st Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was nexopia.
A video is available from Parliament.
3:45 p.m.
Chief Executive Officer, Nexopia Inc.
For the totality of all of them, yes.
I don't know, Mark, if you want to come in on the interaction with the Privacy Commissioner.
3:45 p.m.
Managing Director, Heydary Hayes PC, Nexopia Inc.
Yes. We had a discussion with the Privacy Commissioner even before Mr. Bartus purchased the company. We came to an arrangement with respect to the timing. As you saw in the recommendations, they were done in two steps. These are going to be done in two steps. The first set have to be done by, I believe, January 31 and the rest of them by April 30. We've told the Privacy Commissioner's office that we expect to have these recommendations done, in many cases, before that time, and we've committed to the commissioner's office that we will give them a report on a regular basis. We actually were going to give the first report, I think, today or tomorrow, but our appearance here has perhaps delayed it by a couple of days.
Certainly we've had a very good working relationship with the commissioner's office. I can't speak for them, obviously, but it's worked out quite well, we think. Everybody's moving forward extremely positively. As Mr. Bartus said earlier, it's been something that has been a very useful thing in terms of the company turning around its practices and turning around its business.
3:45 p.m.
Conservative
Patricia Davidson Conservative Sarnia—Lambton, ON
Thank you.
Some of the people we've had give testimony here before this committee have stated that the Privacy Commissioner might need increased powers in order to compel companies to follow the privacy laws. Do you think that's necessary, or do you think that based on your experiences there are enough teeth in what the Privacy Commissioner is directing?
3:45 p.m.
Chief Executive Officer, Nexopia Inc.
I'll answer to the best of my ability, and then Mark probably has a better thought-out perspective on this.
The process that we've engaged in is working. I would not have purchased the company had we not been able to engage with the Privacy Commissioner prior to the transaction. It just would have been unknown what was going on.
In terms of having more teeth, again, the process works, and I don't know what other teeth there could have been. People have discussed penalties and there are all kinds of unintended consequences of any of that stuff happening. I mentioned in passing that I haven't dealt with another privacy commissioner, and I don't know in other countries what works and what doesn't work. This has worked. They've flagged the recommendations. We've set out a pattern of remedying those recommendations. It's not clear to me what else would work better.
3:45 p.m.
Managing Director, Heydary Hayes PC, Nexopia Inc.
The only comment I'd make is that the current federal Privacy Commissioner has a very interesting role as an ombudsman, as a privacy advocate, that she's able to do because she's not also judge and jury. She doesn't do any adjudication. Once you change that role, where now the Privacy Commissioner is also adjudicating, is also instituting penalties and so on, to some extent, then, it can affect the other role. So if the Privacy Commissioner were to have those kinds of powers, it's entirely possible that the balance that now exists in terms of the ability to be able to advocate, the ability to be able to work with privacy commissioners around the world, as this commissioner has done extremely well, may in fact be somewhat compromised. It just changes the nature of the balance.
So far we've had this law in place for well over a decade. It's worked reasonably well. It has allowed a certain flexibility and a certain ability to make recommendations without a heavy hand, with the backup of the Federal Court if in fact there is a problem that can't be resolved. I think most people in the industry think it's actually worked quite well.
I think you'd want to be very, very careful in upsetting the balance that now exists, in terms of giving powers when we don't know how exactly they're going to work.
3:50 p.m.
Conservative
Patricia Davidson Conservative Sarnia—Lambton, ON
One of the things we've heard over and over again is that privacy policies can't be understood by any users, that you need to be a lawyer to wade through the pages of the policy.
What would give users a better understanding of what those privacy policies are? Could they can be simplified, put in plainer language, shortened?
3:50 p.m.
Chief Executive Officer, Nexopia Inc.
The PIPEDA legislation and related legislation is complicated. In order to be comprehensive enough to respond to it, it has to be written by a lawyer. There are some companies that have taken shots at doing plain language versions. Getting a version written by a lawyer is costly, and then trying to transfer it to plain language is costly as well. Trying to, as some people have suggested, translate it to something a child can understand is unfathomable to me.
I think it's more important that the sites follow their own policies—that they don't keep information over a period of time and that they allow informed consent—than it is for the policy itself to be readable. The reality is that most people just click on the policy and accept it. Even my 11-year-old child has already learned that's how you navigate the Internet.
I think it's important that the policies be comprehensive and that they actually say what the site is going to do with the information. In all candour, I am completely unaware of any way in which you can make them more legible. I've tried, and it's a genuine talent.
The other thing is, things change. A new technology evolves or a new regulation evolves, and then you have to change it. A large company may have the resources to devote to writing a policy and then rewriting it in more easily readable language, but it's a high challenge, and I don't know how to tackle it.
3:50 p.m.
NDP
The Chair NDP Pierre-Luc Dusseault
Thank you.
Unfortunately, the time is up. However, Mr. Hayes, if you have anything to add, you have a few seconds to do so.
3:50 p.m.
Managing Director, Heydary Hayes PC, Nexopia Inc.
I've helped hundreds of companies deal with privacy policies, and you're stuck in the middle. If it's too detailed, then people complain because it's hard to understand. If it's not detailed enough—and this happened with some of the early decisions when PIPEDA first came in—then you're not giving enough information to allow informed consent. So you're caught in the middle.
It can't be too long and complicated, but sometimes it has to be. At the same time, it can't be too simple and too short because then you're leaving things out and you're not telling them enough to give informed consent. It's a very difficult balance to get. Clearly, if you're risk averse, you're going to say more rather than less, and that makes it more complicated. I don't think there's an easy answer. Some people have tried. I must say that the efforts that have been made are sometimes very amusing, but they're not particularly informative.
3:50 p.m.
NDP
The Chair NDP Pierre-Luc Dusseault
Thank you.
I now yield the floor to Mr. Andrews, who has seven minutes.
November 6th, 2012 / 3:50 p.m.
Liberal
Scott Andrews Liberal Avalon, NL
Mr. Hayes, what have they tried to do to make this simpler? We've heard this debate. I get exactly what you just said. You want to make sure it's neither complicated nor incomplete. But what have they tried?
3:50 p.m.
Managing Director, Heydary Hayes PC, Nexopia Inc.
I can't give you chapter and verse, but there are some sites in the U.S. that have privacy policies that are three lines long: “We won't use any of your information for anything. We promise.” It's that kind of thing. It's not particularly informative. It doesn't really tell you, as we're required to do under our law, who is the contact, who is the person, how you withdraw your information, how you withdraw consent, etc. We have a lot of requirements in our law that the U.S. companies don't address, because they don't have privacy laws like ours.
Some of them are quite amusing, but they're not useful in providing information to consumers. If there were an easy answer, I think people would be doing it. We've had 13 or 14 years of doing these policies. If there were an easy way to make them both really simple and also compliant with all the technical rules, I think we would have already done it. I think most of us are trying our best to explain the policies in language that is not overly technical but that also covers the waterfront.
3:55 p.m.
Liberal
Scott Andrews Liberal Avalon, NL
Would you give any other recommendations to the Privacy Commissioner's office? I'm pretty impressed by the way you guys have worked with that office. Is there anything you would recommend that she'd be able to streamline a little bit better, the whole process you went through? Or was it acceptable?
3:55 p.m.
Chief Executive Officer, Nexopia Inc.
I was very impressed with their willingness to discuss with us before the transaction what they would do if we did a transaction. I honestly think it was pretty good.
3:55 p.m.
Managing Director, Heydary Hayes PC, Nexopia Inc.
The federal commissioner's office is a very reasonable, very business-like sort of office. The problem the previous owners of this site had is they didn't engage with the commissioner's office, and if there's one piece of advice I would give to any Canadian business, it would be that if you have a privacy issue, engage with the commissioner's office. You may not like all the advice you get, but you're going to be able to work something out.
3:55 p.m.
Liberal
Scott Andrews Liberal Avalon, NL
One of the things we heard when we were in Washington was that they didn't want to stifle business. They didn't want to try to stifle this industry so that it can't develop.
Your perspective is interesting, sir. You came into this while you were purchasing a company and had to go through this. Where was this privacy issue on your radar when you were trying to purchase this company? Was it a challenge? Did you get cold feet and wonder what you were getting involved with?
3:55 p.m.
Chief Executive Officer, Nexopia Inc.
Is this an official question?
If you Google Nexopia, it's one of the first things that comes up. You'd have to be incompetent to not know this was an issue, and the previous owners brought it up as well. It's a pretty obvious issue.
I would not have bought it had I not, in all candour, found a privacy lawyer who understood the process and who to call. I wouldn't have known who to call or what to ask. I would not have bought it, but we were able to engage and they were able to provide direction, and then they stood by their word. They did what they said they were going to do. They certainly weren't on the hook to do it, but they have played the role we hoped they would play.
We haven't finished implementing all the recommendations, but like anything else, when you really engage in what it is, the true deletion thing that your colleague brought up earlier...once you're really engaged in what it is, it gets a little easier. You get them up closer and ask if you can do this or that and if you can get that done.
Again, I don't want to speak too much for the prior owners, but I think they froze up a bit at the enormity of it and they said they were done.
3:55 p.m.
Liberal
Scott Andrews Liberal Avalon, NL
I have a question on advertising. You talked about no targeted advertising, and this is something we've had a discussion on, how sophisticated targeted advertising can be. You mentioned that if you try to break it up, the samples get too small.
Just fill us in on your views on targeted advertising. Should we be concerned about targeted advertising?
3:55 p.m.
Chief Executive Officer, Nexopia Inc.
As you're aware, there are industry bodies. You had the CMA up. IAB Canada is also well versed in this, and they can probably better answer what concerns you should or shouldn't have about targeted advertising.
My point with scale is that targeted advertising only works at scale. If you're trying to reach mothers who have two kids who live in Ottawa, you're not going to reach them on any one particular site. There might be an Ottawa-based parenting site—I'm sure there is. Most of our advertisers are big advertisers. They have a lot of boxes of stuff, right, so they want to reach a lot of these people. You have to do it at scale, and the only way to do it is with targeting advertising using some sort of database of information. Nexopia is really too small to be much of a contributor to that database. Many data providers do that, and you've had people testify for you who are very adept at that sort of targeting.
As to whether you should be scared or looking at it for regulation—I forget if it was you, I'm sorry, but one of you mentioned that when you went down to the U.S., they said they didn't want to stifle innovation. There's a lot of innovation in advertising technology. It's not my area of expertise. It's not something we use particularly heavily. It doesn't work as well in Canada because the scale simply isn't there. When you're dealing with 300 million Internet users in the U.S., or whatever the number is exactly, it works better. Data providers in the U.S. are far more numerous. The technology is far more sophisticated. In Canada it has been a struggle.
It is coming along, but my own feeling in that area is that the data targeting stuff is not as useful as it is in the U.S.
4 p.m.
Managing Director, Heydary Hayes PC, Nexopia Inc.
Could I just add one little point? It is really important to distinguish between anonymous, targeted advertising where what you're trying to do is serve the ads to people who would be closest to their interests. So if they've been browsing auto sites, they are going to get auto ads. If they have been browsing skiing sites, they're going to get skiing ads. If that's done completely anonymously and is just based on their browsing habits, it's pretty benign. The only criticism I've ever heard, and you've probably heard it, is that some people find it creepy, which is not exactly a phrase I've seen in PIPEDA or any other legislation.
The thing you have to worry about is where those particular profiles are then matched with offline information and then brought into a profile that allows you to identify people. That can be a problem, and that is something that has to be closely looked at, but those are two very different problems. Sometimes you have to be careful not to mix the two.
4 p.m.
NDP
The Chair NDP Pierre-Luc Dusseault
Thank you.
Unfortunately, your time is up, Mr. Andrews.
I now yield the floor to Mr. Dreeshen.
4 p.m.
Conservative
Earl Dreeshen Conservative Red Deer, AB
Thank you very much, Mr. Chair.
Thank you, gentlemen, for being here today.
A number of the things you have mentioned in answers to other members, certainly on the concept of media companies.... You were talking in your presentation about how they are breaking away from advertising-driven online initiatives and that type of thing. Of course, one of the things we heard when we were in the States talking to different companies is that you end up stifling innovation. Is part of the concern that Canada seems to be a place where you or your companies don't feel it's worthwhile, that we may not end up being able to bring in different types of products from other places, or that they will ignore us? That's the first part.
As an extension of that, perhaps we could get a bit of an idea of what the business models actually are so that people realize—whenever we're talking about social media and data brokers—what is it they want from us. This isn't a free service because it has to be paid for. But I think a lot of people don't quite put those two things together.
So I wonder if you could give us a bit of a thumbnail sketch that you see in that regard, and then perhaps talk about some of the basics that are in your own business model.
4 p.m.
Chief Executive Officer, Nexopia Inc.
Sure. That's a fairly broad suite of questions. Tell me if I miss any of them.
4 p.m.
Chief Executive Officer, Nexopia Inc.
What consumers mostly want out of advertising is no advertising. If that's not available, then targeted advertising is the next best thing. Targeted advertising is, as Mark says, if you happen to ski and you see ads on skiing, presumably that's a more welcoming experience than seeing ads on diapers, if that's not what you do.
Most of our experience—I will talk now as an online person. The experience of watching television is largely one of irrelevant advertising. We have been sitting through ads and asking, “How did I sign up to be targeted with this ad? This doesn't make any sense to me.” Online, it's an extremely measurable media. So what advertisers do is they literally pay more for an ad to a relevant person. It is done through exchanges. I can list names of them, but they are much like the New York Stock Exchange. An impression goes up and everybody bids on that impression in microseconds. If somebody says, “That guy has been skiing and I want to sell ski equipment”, they will pay more. They may $2.50 CPM—cost per thousand impressions—rather than the 25¢ CPM. As you have had people testify to you, that's a more efficient market. That ski advertiser wants to reach somebody who is skiing, so they will pay for that data.
How they get that data is an interesting question. Typically, in the U.S., many publishers will sell them that data. They will say in the privacy policy that they are going to sell data. I may not be up-to-date with which sites, so I won't name the sites, but in the U.S. there are many car sites—places where you go to buy or price a car or that sort of stuff. They will sell their data to the big data brokers—Blue Kai Inc. and eXelate are both leaders in this in the U.S. The data guys will in turn sell it to the exchanges, so that when you buy an impression on a large site—Yahoo!, Microsoft, or whatever it is—you will pay a very low CPM if it's not targeted and a little more if there is some data behind it.
That's a very efficient marketplace. I mentioned that it's not as well developed in Canada because the scale is smaller. It seems like a lot of people to us; it's just not a lot in some of these larger countries. So the scale is smaller.
The other thing is that the publishers, by and large, don't sell their data as freely. I don't think that's a privacy law thing. I think to some degree it's an evolutionary thing, but they simply don't sell that data as freely.
If you are trying to target auto intenders—it's a term in our industry for somebody who is about to buy an auto—it's a lot easier in the U.S. than it is in Canada. There aren't as many sites that have auto data that will sell it.
To your point, is it scary, is it efficient—that's beyond me to say. It does make the advertising a lot more efficient if you are trying to serve up an ad to somebody who is relevant.
In terms of Nexopia's own business, it's just not at a scale where that is an interesting proposition. We have about 200,000 members. Let's say they are about half male and half female. If you want to target a young Canadian, particularly right now one who lives in the west coast—Alberta and B.C. as the primary audience—Nexopia is a great place to do it. But once you start cutting it down to people who live in Edmonton, people who are women, people who are a certain age, you're not going to have a lot of advertisers. You're only going to reach 10,000 people.
So that business works a lot better if you are a very large company. You guys all know the names of large companies.
Does that cover all or some of it?