Information & Ethics Committee on June 17th, 2009

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Thanks again.

As stated earlier, on this side we're very excited about this technology, and I think you both acquitted yourselves very well.

There are four concerns that I sought to have addressed today. The one I want to focus on in my last questions is this issue of storage. Mr. Lister, your company is taking millions of images in Canada of Canadians and storing those images out of the reach of Canadian commercial privacy laws. You're also keeping those images in your possession for an unspecified period of time, and I would suggest to you that this gives your company a degree of power that was not provided for in our commercial privacy laws.

Respected journalist Greg Weston listed some of his concerns. He talked about, for example, biometrics. Right now we have technology that can identify people by their fingerprints, by their eye retinas. It's not unreasonable to expect that one day they could be identified technologically by the unique shape of their face. If you have millions of images of people, you have the time and place in which those images were shot, and you have the company in which people find themselves when those images are shot, you are going to have an enormous amount of personal information about millions of people, without their expressed consent. How do you see this complying with Canada's commercial privacy laws?

[Jonathan Lister]

I just want to remind the committee, I'm not a lawyer. I can't speak specifically to the laws in question. I can talk more about how we plan on using the product and Google's view on our consumer relationship.

Google believes very strongly in transparency and user choice, and I think it's fair to say that we believe in that more than many other organizations out there. So we offer many ways for consumers to find out how their data is being used, change their data, and take their data down if they're uncomfortable with how Google has used that data.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

I'm not focusing on that concern. I'm more concerned about the data that you have about people that they don't know you have, that you store at server farms outside of Canada, that is unblurred and is in your possession for an unspecified period of time. We want to find a way to make this work with you.

Would Google entertain the idea of putting a time limit on the unblurred images it keeps at its server farms?

[Jonathan Lister]

I think that's exactly what I said we were going to do. We will share this timeframe with the committee when we can appropriately articulate what it is, based on our technical needs balanced out with privacy interests. We'll share that with the committee as soon as we have a reasonable and accurate answer.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Can you guarantee to Canadians that you will not sell these unblurred images for commercial reasons to other enterprises?

[Jonathan Lister]

Google doesn't sell personal information.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Thank you.

How much time do we have?

[The Chair, Liberal, Paul Szabo]

Mr. Hiebert is up.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

Thank you, Mr. Chair.

I have a few questions, following up on my colleague. He talked about the data being stored outside of Canada. Does the U.S. Patriot Act apply to the Canadian photo data as a result of the fact that it's not being stored in Canada but is being stored in the United States, and could it be seized by the U.S. government without justification at any time?

[Jonathan Lister]

Yes, but if the data were stored in Canada, it could also be seized. I think it's under the mutual legal assistance treaty with the U.S. So there's no difference.

I think it's immaterial where the data is stored. It's a fact of the digital economy that as the economy grows and the global economy grows, putting up protectionist barriers around the flow of data is going to prove troublesome to countries like Canada. And in our opinion, in my opinion, we're far better off finding ways to help facilitate and ensure the safety of cross-border traffic in data, rather than trying to stop it and protect it. But as the Privacy Commissioner herself has indicated, I believe on a number of occasions, some cross-border data flow is not in and of itself a privacy concern.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

You also mentioned that there were photos taken prior to March 24 of this year. You said those photos would not be used. Can you confirm that those photos will be destroyed?

[Jonathan Lister]

Clearly, I haven't done a very good job of answering this question. There are non-blurred images that have been taken. When the photographs are originally taken they are non-blurred. There is a blurring process that Google does to blur those photos. Any images that are non-blurred....

Actually, let me step back. There are actually two copies--and I think this is important. There is a blurred copy and a non-blurred copy. And after this adequate but not excessive time, the non-blurred copy becomes blurred; therefore, all images are blurred.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

I understand that, and I did hear your answer earlier. But you've said you won't be using the photos taken prior to March 24, and it dawned on me that perhaps the appropriate thing to do would be to make Canadians rest assured that those photos will never be used. You could just simply state that they'll be destroyed. But I heard your additional answer.

The federal and provincial privacy commissioners have put out a statement. In that statement they indicated that they believe that companies that engage in this activity have to let citizens know, among other things, when these photos will be taken. That includes notification using a variety of media, local media outlets, outlining the dates and the locations for filming, and the purpose for the filming and so on.

Earlier I asked you about what steps you'd be taking to notify Canadians. Clearly, the privacy commissioners have raised an expectation that local media outlets should be informed of the dates and the locations when these pictures are going to be taken. Does Google have any intention of fulfilling that request from these privacy commissioners?

[Jonathan Lister]

We intend to meet our obligations and all the legal requirements before we launch the project. We're here today to gather concerns.

In addition to some of the things I've mentioned already, we have generated an incredible amount of national press. It's probably the most publicized collection of cartographic images, in addition to the website that indicates the cities we are currently driving through. The drivers of the cars have one-pagers, like Mr. Vincent's Canpages example.

People are welcome to come up to the Google cars. They are clearly identified as Google cars. The drivers have these one-pagers, and they have contacts at Google who people are able to talk to. We're trying to make this as transparent as possible while still balancing out the practical matter of not giving specific dates, for the reasons I mentioned.

[The Chair, Liberal, Paul Szabo]

Thank you.

Colleagues, we are going to end at 5:30. I have a quick question from Mr. Siksay and one from Madame Thi Lac. I've circulated a budget that I would like the committee to consider before we adjourn.

Mr. Siksay.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I would like to ask both of you if you've ever had to do a structured or formal privacy impact assessment process with a government agency or a privacy agency anywhere in the world.

[Jonathan Lister]

I'd have to check and get back to you.

[Olivier Vincent]

We're a Canadian organization. It's the first for us.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you, Chair.

[The Chair, Liberal, Paul Szabo]

Madame Thi Lac.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

In the past, we have heard about images that were scrambled and put on the Internet by criminals or pedophiles. We also know that the police were able to unscramble those images in order to identify criminals or specific individuals. Perhaps that was the work of amateurs.

Can you give us the assurance that computer whizzes will not succeed in unscrambling the images that you scramble using your own process?

[Olivier Vincent]

Yes, absolutely. It is an irreversible process, meaning that there is no going back afterwards. Several years ago, available technology made it possible to swirl the face, but people did find a way to unswirl it and identify the individual. Now, however, we use a technology that completely erases the image and which is totally irreversible.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Thank you.

[The Chair, Liberal, Paul Szabo]

Thank you.

There was a question earlier about the Japan experience and reshooting. The researchers advise that the cameras were high enough to see over people's fences into their backyards, so they were asked to reshoot 40 centimetres lower so there was privacy.

There are rules in every jurisdiction, and it shows that if you don't do your homework sometimes it costs a little extra money.

In any event, this matter is probably going to carry over with us.

Mr. Dreeshen, go ahead.

[Earl Dreeshen, Conservative, Red Deer, AB]

Thank you very much for coming here today.

I know that you have to make money doing this, and one of Mr. Siksay's questions kind of alluded to that. When the public accesses your site online in order to have their concerns addressed for the removal request, does an advertisement pop up that they have to look at?

Second, what happens to all the computer IP addresses when people give you that type of information? You guys are computer geniuses. I'm just wondering if that address is removed from your system after that takes place.