Information & Ethics Committee on Oct. 22nd, 2009

[Greg Rickford, Conservative, Kenora, ON]

Just very briefly, these two cases deal in general terms with videotaping on private and quasi-private premises. In the case of Milner, the complaint the plaintiff had was that there was a vehicle outside their house taping the activities that were going on in and around the house for the purposes of understanding whether there was a bogus disability insurance claim. In Heckert, the plaintiff's complaint was that there was a camera at the end of her hallway in her apartment building that could obviously tape her entering and exiting her apartment.

In the case of Milner, it was found that there was a lawful interest with respect to the defendant insurance company's ability to be able to monitor the activities to establish a fraudulent claim. I think it's quite interesting in obiter that the judge, as he or she was then, mentioned that in the process of taping, the daughter of the plaintiff was seen semi-dressed, and had she advanced a claim, it would have been problematic for the defendant. It raises issues that my colleague talked about earlier about whether what they do with this information is secure.

In the Heckert decision, the most recent one, it was found that there was a reasonable right to privacy in entering and exiting one's home. Those activities were captured, and that judgment falls within violation of the law as it stood in 2008.

These are interesting because they deal with the fuzzy line between the private and public domain. In Milner it was found untenable that the private domain could be analogous to a public place—at least, this is what the critics were saying. It's obviously not what the judge felt. In both cases the factual matrix is clear. Video surveillance by a defendant with a legitimate interest in information that might be secured from it has to be balanced with the plaintiff's interest in what information is being recorded and how that's stored, and how the person performing the surveillance might be dealt with.

I'm not sure the Privacy Act provides a bright line here. This is relevant to our discussion today and certainly builds on my colleagues, because Google Street View and other groups like that don't have a nexus like these cases. There's no direct-connection test here with respect to their rights to privacy, whether it's a lady who's concerned about the tidiness of her garage or other activities, directly or unintended, by consequence of surveillance.

I have a couple of questions. Since counsel may not be familiar with the cases, I'll broaden my question. Has PIPEDA been affected by these and/or other court rulings in preparation for this kind of technology? If so, how will you be adapting in light of these kinds of cases from the common law, whether they flow directly from the decisions or as they may be raised as issues in obiter?

[Elizabeth Denham]

Under PIPEDA we have had complaints in the insurance realm about covert video surveillance, surveillance without the knowledge or consent of the individual. The purpose of the surveillance is to really look at potentially bogus insurance claims.

One of the issues there was the capture of third parties in that covert video surveillance. If someone is out in their yard with their children, playing soccer, should it be acceptable to survey all of the children as well as the subject of the surveillance? We've looked at that.

And we've also issued some guidelines for the insurance field on covert video surveillance. We're suggesting that it be very limited and that it only be undertaken after other less privacy-invasive measures have been taken, such as sending someone off for an independent medical exam.

[Greg Rickford, Conservative, Kenora, ON]

Just to interrupt you, my concern with respect to that is that when we get to things like Google Street View and other surveillance, if you will, or some kind of monitoring, there very quickly could be parties interested in that information, as well, for the purposes of beginning an investigation, for example. The ability to go online and monitor these kinds of activities or to have access to them poses serious problems.

I'd be happy to hear from Mr. Caron.

[Daniel Caron]

Certainly the issues you mentioned regarding videotaping and using a camera in an apartment are issues to the extent that these would happen in a province over which PIPEDA applies and they happen in the course of a commercial activity. These are issues that would fall under PIPEDA. And certainly as the assistant commissioner mentioned, we have issued guidance on the question of the use of video surveillance in commercial activities.

I'm not exactly sure what else to add, but the greater point is the fact that PIPEDA is a principle-based act that obviously covers questions of videotaping by private entities for commercial purposes.

I don't think I'm answering your question here.

[Greg Rickford, Conservative, Kenora, ON]

That may not be dealing with some of the issues that we're raising here today.

Sorry, Mr. Chair. That was out of line.

[The Chair, Liberal, Paul Szabo]

Well, the last comment. But we'll have another round, if you want to work people more.

[Elizabeth Denham]

Just as a last comment, I agree that the jurisprudence is far from clear and is developing on these issues, so we'll be watching that.

But the other issue goes to your point about the nexus, because the capture of individuals is incidental to what the street-level imaging is after. As you say, it's not about capturing individuals. They'd rather photograph at five in the morning and capture as few individuals as possible. But as you say, once they capture the data, then there can be an interest in that data because it ties an individual to a location, arguably at a point in time.

[The Chair, Liberal, Paul Szabo]

Thank you.

Madam Simson, please; you have five minutes.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

Thank you.

With respect to the report, there was the issue of youth privacy and the educational component that you started in 2008. My question is twofold. How much, in terms of financial resources, was dedicated to that? And do you have a sense of how successful you feel that campaign was in 2008?

[Elizabeth Denham]

Youth privacy was one of our objectives. It was a priority in 2008.

As to how much we have spent on building the youth blog and the video contest and our outreach, I can certainly provide you with that information. But it really was limited, so it was well under $100,000 for that campaign.

We also gave a grant under our contributions program to the Media Awareness Network, which is an organization that prepared curriculum materials for the schools on privacy issues for youth. But they were limited amounts of funding.

Was it successful? What's the reach? That's pretty hard to measure. I can tell you how many presentations we gave to how many students. I can tell you how many hits we have on our blog and our website. I can certainly provide you with all that information.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

With respect to the website, there are about 3,400 hits a month. In the scheme of things, that didn't seem like a lot. You're right, it's hard to measure success. But is there anything that you intend to change? I agree that some uses of Facebook could come back to haunt some young people in the future.

[Elizabeth Denham]

We've talked about having a youth counsel. The youth don't want to hear from someone like me. They want to hear from young people who know how to communicate with them. We have talked about that. It's going to be our priority in the next few years. We think it is youth who are most vulnerable to the new technologies, and we know that their view of privacy is different from our generation's.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

Thank you.

[Borys Wrzesnewskyj, Liberal, Etobicoke Centre, ON]

Ms. Denham, Madam Simson mentioned her concerns about how real estate companies treat the identification information they have on Canadian citizens. PIPEDA covers how they should go about this, but it doesn't actually get into the necessary mechanisms. When you think of real estate offices, you think of the agents and the receptionist. There is tremendous accessibility to that information.

Have you considered looking into this and making recommendations that there should be a formal method of securing this private information? It shouldn't just be in files in an office to which pretty much anyone has access. If someone with ill intent were to get hired as a clerk in one of these larger offices, the information such a person could garner and put out onto the street could be quite valuable. Have you considered putting together recommendations that would formalize what they should be doing and how they should go about preventing this information from falling into the wrong hands?

[Elizabeth Denham]

We have a tool under development. The audience for the tool is small businesses. It's an information security check list, but it is not geared to real estate agents or brokers. Still, we have a tool in development that will be ready by the end of the year. There are also other guidance documents on our website that deal with ways of protecting personal information.

[Borys Wrzesnewskyj, Liberal, Etobicoke Centre, ON]

Over to Google Street View, we have been led to understand there is going to be a time lag with regard to when they put the information up. Are they also going to scramble that information? Say we know it's a one-month time lag. They have said they won't show schoolyards and facilities of that sort. Let's say that someone knows that children go along certain streets. Even if there's a time lag, there are patterns that could be followed. Will they be scrambling that information so that it's impossible to find patterns such as the time of day or the day of the week?

[Elizabeth Denham]

There isn't a time lag as such. They take the photos and they blur the images of individuals before the images are posted on the Internet. So before it goes live, faces are blurred. Licence plates are blurred. Actually, I'm not sure what you mean by a time lag.

Google has not blurred schools. They've talked to umbrella organizations to ask if they wanted images removed. But if you go on Google Street View and you search for a local Ottawa school, I think you will see the building there. You may see children walking by that are captured at a moment in time. Their faces should be blurred, but the blurring is not 100% effective and we've found many instances in which individual's faces are not blurred. Moreover, there are false positives. The face of Colonel Sanders, of Kentucky Fried Chicken, is blurred out in signage and faces on billboards are blurred out. It is not a perfect technology.

[Borys Wrzesnewskyj, Liberal, Etobicoke Centre, ON]

Thank you.

[The Chair, Liberal, Paul Szabo]

Ms. Davidson, please.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you very much, Mr. Chair.

Thanks very much for coming this morning and presenting this to us. It's certainly been very interesting. I'm new on the committee, so it's all new information to me. I'm finding it quite intriguing. I think all of us value our privacy and most of us guard it very well, although there are some instances when that doesn't happen.

In your report you mention that PIPEDA came into full force in January 2004. That wasn't that long ago, but we still didn't have things like Facebook and Google Street View. A lot of the techniques that people are using now to collect information through the Internet weren't available or weren't widely known at that time. Do you think the legislation is still relevant and pertinent to the new changing technologies of today, or do you think we need updates to it?

[Elizabeth Denham]

I think the fact that it's a technology-neutral law is very positive. I think the fact that it's principle-based and not prescriptive works, as well. If you can imagine changing a law or creating a law every time a new technology is developed, we'd never keep up with it.

I think the outcome with Facebook was very positive, because, as you say, it's a whole new business model and a new technology that didn't exist. The architects of the law couldn't have foreseen SocialMedia and Web 2.0; they couldn't have seen that. Yet I think our investigation of Facebook showed that the law was flexible, and it confirmed the commissioner's reach into the U.S. The data on Facebook is all stored in California, but one in three Canadians has personal information on Facebook. So Canadian law had a huge impact globally on a business model where individuals are posting their own personal information on the web when there's a commercial engine operating in the background. So it's a mixed personal and business use.

Our jurisdiction was accepted with a California-based company and global data flows. I think that demonstrates that our law is pretty good. Does it need to be adjusted? I think there are all kinds of problems. I think the street imaging technology is a good example where the law was built on the basis of a one-to-one consent regime, you and your bank. Now, if you take Goggle Street View, it's one-to-many. So you've got one company collecting information from many people. Does the implied consent regime work? I think it's problematic. But is there a better law out there right now? I don't see it. I think our law is working as well as any other data protection law at present.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you.

In your presentation this morning, it says:

The purpose of PIPEDA is to balance the individual's right of privacy with an organization's need to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

Who defines reasonable, and how do you define it?

[Elizabeth Denham]

Most of the time the commissioner is a reasonable person.

[Voices]

Oh, oh!

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Okay, so it's left to the discretion of the commissioner?