Information & Ethics Committee on Oct. 22nd, 2009

[Elizabeth Denham]

I don't really want to speculate. Nobody has complained to date. Canadians obviously enjoy the service. But I expect we will receive a complaint. I think there's a lot of dialogue out there, and we could receive a complaint from an advocacy group.

There are people who are concerned about it. I was speaking at a conference last week on street-level imaging and I certainly heard comments from privacy advocates.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Do you have an estimation of how many images are up on Street View right now?

[Elizabeth Denham]

I don't.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

How many cities are there?

[Elizabeth Denham]

I think there are nine Canadian cities, and I think 14 countries.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Out of nine Canadian cities, we must be talking about—I'm just going to guess, but I imagine.... Let's put it this way. We're talking about millions of people represented by the cities that have been photographed. And It's been up now for—how long: three weeks, four weeks?

[Elizabeth Denham]

It is since October 7.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

So it is almost three weeks, and we've had no complaints. I think that's a very interesting fact.

Do you believe that the blurring policy of Google lives up to the standards of the commercial privacy laws in this country?

[Elizabeth Denham]

No, I think they could do a better job in the blurring technology. We were told by Google that their blurring technology was 98% effective; that was before the images went live. But we've seen for ourselves that there are many instances in which individual faces are not blurred. Google is committed to continuing to improve the blurring, which is one of the reasons they want to retain the images for one year. They're working on improving their blurring technology.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Are you satisfied with that one-year timeframe?

[Elizabeth Denham]

I am satisfied with the one-year timeframe. I think it's a reasonable retention period.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

You mentioned earlier, Mr. Baggaley, that you believe someone who is on a street should have a reasonable expectation of being witnessed by other people who are also on that street, but that he might not have a reasonable expectation that he will be witnessed by people all around the world. Is that correct?

[Carman Baggaley]

Yes, that was the way I put it.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Okay. Do you believe that as this technology becomes more popular and well known, when it becomes a household tool that people use on a regular basis, reasonable expectations will change and people will start to realize that their photos could be taken and sent worldwide?

[Carmen Baggaley]

I think it's possible that our expectations of privacy will change, and I think they have changed. At the same time, however, I think we all have a certain comfort level.

Let's use this example. Yes, I expect to be observed, if I'm walking down the street. However, I would be troubled by, and I think most of the people here would be troubled by, someone following me wherever I went in the course of a 24-hour day. It's not simply a case of expecting to be observed; it's really the degree to which you're observed, and how that information is being used, and how you might expect it to be used.

Yes, expectations of privacy will change. In fact, that's one of the problems with using them as a kind of legal test: that expectations of privacy do change and are not necessarily the same for every person. I might be more troubled than someone else is. One of the difficulties with using that concept in the law is that everyone's expectation is not exactly the same.

[The Chair, Liberal, Paul Szabo]

Thank you.

Madame Freeman.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

The Personal Information Protection and Electronic Documents Act, which we're discussing today, doesn't cover British Columbia, Alberta or Quebec. The provincial acts take precedence over the federal act in those provinces. Consequently, Quebec is not covered by this act.

We know that the problem is currently global in scope. We can't all work in isolation. How do you interact with those three independent jurisdictions, which are not subject to the federal act?

[Elizabeth Denham]

It's a very good question, and my answer is yes indeed.

You'll see that all of the provinces signed on to our “captured on camera” fact sheet. So it was issued by our office, the Quebec commissioner, the B.C. commissioner, and the Alberta commissioner. We have a memorandum of understanding among all of us about our joint work.

We have conducted joint and parallel investigations, because the jurisdiction of various companies is shared. We have a very good working relationship with all of the commissioners. We have many examples of joint guidance and a very good working relationship. We even have a formal meeting with the commissioners every six weeks. We've issued joint statements, etc.

The point of all this work is precisely as you said. We want harmony as much as possible and consistency in our rulings. We want consistent guidance for businesses, so if they operate in four provinces they know what the fix to the problem will be and there won't be contradictory advice and rulings.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

I congratulate you on your harmony, your ability to speak with three independent jurisdictions that have separate acts. Your cooperation is very edifying.

I'd like to ask a question that was raised earlier. I would like some clarification. A number of servers are installed in the United States. The data is captured and retained in the United States. This was raised earlier, but it's not clear in my mind. There is some question of American security laws, such as the US Patriot Act.

What are the consequences with respect to all the data, the information that is stored? There are data bases and all kinds of things in which data that has flowed are stored. It's there. Once it's in the jurisdiction, people are very vigilant: does the data transmitted no longer belong to us. Does the US Patriot Act intervene at that point?

This was raised earlier, but I didn't get an answer that was clear for me. Could you clarify it further?

[Daniel Caron]

I'll try.

Yes, in certain circumstances, when the data, the personal information of Canadians, winds up, for example, on a server in the United States, the government may have access to that information through the US Patriot Act, for example.

Canadian organizations that make these kinds of information transfers to American servers still have an obligation under the act to ensure the protection of that information and to inform the individuals concerned. The organization therefore has a responsibility or obligation to inform the individuals that, if they consent to the collection of their personal information, that information may wind up in the United States. It therefore has a duty to tell individuals that they must be informed of that fact so that they can make an informed decision.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

Let's go back to Google Street View: everything was kept in the United States. In view of that fact, there's an enormous amount of private information that can be stored. No one has given any informed consent for it to be transmitted to the United States and for it to be the American act—the US Patriot Act, among others—that applies. There hasn't been any consent, and Big Brother is there.

[Daniel Caron]

The same situation is also arising with Facebook: there's a lot of personal information.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

I could cite a litany of all the—

[Daniel Caron]

Exactly.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

I'm talking about the problem, not the scope.