Good morning Mr. Chairman and committee members.
Thank you for inviting our office to address you on the privacy implications of camera surveillance as used in commercial applications, such as Google Street View and Canpages, and on other issues related to surveillance and new technology.
I am joined today by Carman Baggaley, our senior strategic policy adviser, and Daniel Caron, legal counsel. Unfortunately, Commissioner Stoddart can't attend today. She has laryngitis. I think this is a first for her, not attending.
We very much appreciate the committee's interest in this issue. We also followed your hearing on June 17, 2009, at which representatives from Google and Canpages appeared. We welcome the opportunity to discuss this interesting development in technology.
The Personal Information Protection and Electronic Documents Act, PIPEDA, is a technology-neutral law that does not, in our view, thwart the innovation of new technologies. We've sought to ensure that PIPEDA is a dynamic, modern, and effective tool for strengthening the privacy rights of Canadians. And we believe that PIPEDA can cope with the commercial collection and use of personal information through street-level imaging technology.
We're very much aware that the many services that use street-level imaging are very popular with the public. Our ongoing concerns about the commercial use of this technology really centre on ensuring that it protects the privacy of Canadians by meeting the requirements of PIPEDA, such as knowledge, consent, safeguards, and limited retention.
I would like now to briefly recap our office's involvement in the issue.
The Office of the Privacy Commissioner of Canada has been closely following, for a few years, the development and use of online street-level imaging technology by companies operating in Canada and elsewhere. As I indicated, such technology has potential privacy concerns, and we wanted to know more about it and how it would be deployed in Canada.
Street-level imaging applications use various means of photographing the streetscape. A camera is typically mounted on a vehicle that's driven down a street. The images are then shown on the Internet as part of the company's mapping application. Although the company's interest is to capture a streetscape so that users can take a 360-degree or virtual tour of a particular neighbourhood, the companies are also capturing images of identifiable individuals and tying those individuals to specific locations.
We began to monitor the issue in 2007, when we learned that Google was photographing the streets of certain Canadian cities, for the eventual launch of its Street View application in Canada, without the apparent knowledge or consent of the individuals who appeared in the images.
The commissioner wrote an open letter to Google outlining her concerns about the Street View application. She took that opportunity to point out that if companies like Google wished to use this technology for commercial services in Canada, there was private sector privacy law that would have to be adhered to, and stronger privacy protections would have to be put into place.
I would like to address a common misconception that some companies have about photographing people in public places. If an organization takes a photograph of an individual in a public place for a commercial purpose--for example, when a company, in the course of photographing a streetscape, captures an identifiable image of a person and that image is uploaded onto the Internet for a commercial reason--Canadian privacy law still applies. One of the key protections is that people should know when their image is being taken for commercial reasons and what the image will be used for. Their consent is also needed. And while there are exceptions under the law for the requirement for consent, they are limited and specific, and they concern journalistic, artistic, and literary pursuits.
Street View has now been launched in Canada—it went live on October 7—as well as in other countries. The Canpages service, called Street Scene, was launched earlier this year in certain cities in British Columbia. Canpages is seeking to expand its service to other Canadian cities and has recently provided notice that it is photographing streets in Montreal and Toronto.
Our office and our provincial counterparts with substantially similar commercial privacy laws, Alberta, B.C., and Quebec, have been in contact with both companies about their street-level imaging and mapping applications. Early this year those provincial privacy commissioners and our commissioner issued a fact sheet, which I believe you have a copy of, for industry and the public on what we think needs to be in place for these commercial services that use the technology to be in compliance with Canada's privacy laws.
This fact sheet, called “Captured on Camera”, details the privacy protections that are particularly pertinent in the case of street-level imaging. Among these are that citizens should know in advance that street-level images are being taken, when, and why, and how they can have their image removed if they don't want it to appear online. This could include visible marking on vehicles--and if you've seen the Google car you'll see that it's well identified--notification that the streets are being photographed through a variety of media, outlining dates and locations, the purpose of filming, and how people can contact them with questions.
We also think that faces and licence plates need to be blurred, so that the individual is made anonymous or is at least not identifiable. Companies need an effective and quick take-down process whereby an individual can have their image removed. Unblurred images retained for legitimate business purposes should be protected with appropriate security measures and the raw data should not be retained indefinitely.
We've seen changes to how the technology is used that are more respectful of privacy, and we played an important role in encouraging these changes, not only in Canada, but worldwide. Images of people and licence plates are blurred, but the process of doing so needs to continue to improve and evolve. Take-down processes have been established. The need for clear retention periods has also been addressed by Google.
Companies have solicited the views of umbrella community organizations about any possible sensitivity to filming in certain locations, such as shelters or clinics.
Notifying the public is an ongoing concern. We believe the nature of the information collected is not especially sensitive and that companies can rely on implied consent, provided they give reasonable notification to the public in the form of outreach. Individuals need to know in advance when the organization will be photographing their neighbourhood so they can adjust their plans accordingly.
As you know, the purpose of PIPEDA is to balance the individual's right to privacy with the organization's need to collect user-disclosed personal information. PIPEDA applies to a wide range of businesses, from banks and telecommunications companies to car dealerships and to the local neighbourhood store. It also applies to social networking sites.
The law is not prescriptive; rather, it requires that organizations adhere to a set of fair information practices or a set of principles. Each organization, given its business model and other regulatory requirements, has to find ways to adhere to the principles and achieve the balance between its own legitimate needs and the rights of individuals to their privacy. The Office of the Privacy Commissioner works with organizations to help meet their business objectives and their obligations under PIPEDA. I'd be very pleased this morning to talk to you about Facebook as a good example of that.
As I indicated earlier, PIPEDA is a technology-neutral and principle-based law, and so far it appears to be flexible enough to guide commercial uses of new technology. As you're likely aware, over the summer we released findings in two significant complaints originally filed in 2008, in which technology and new business models featured prominently. One, as I say, involved Facebook, and the other the use of deep packet inspection, or DPI, by a telecommunications company. Under PIPEDA, we were able to strike a reasonable balance that serves as a road map to help us face new privacy challenges on the horizon. These findings will have a positive impact on the privacy rights of Canadians and indeed on 300 million people worldwide who are users of Facebook, while at the same time acknowledging business interests.
What we have learned in the past 18 months through our work in street-level imaging, social networking sites, and deep packet inspection will help us significantly, and we believe these examples have served to raise the profile of privacy for business and average Canadians.
As we note in the PIPEDA annual report for 2008, new technology, for all its indisputable benefits, continues to pose privacy challenges. Indeed, our office is planning to explore over the next year the privacy implications of three significant technologies: behavioural advertising, cloud computing, and geospatial technology. We will be seeking the views of business, academics, advocates, and regular Canadians in order to better understand how PIPEDA applies to these technologies and business practices and their impact on privacy.
Since we were asked to appear, we tabled our 2008 PIPEDA annual report—and I understand that you all have copies. The main themes of the report are really a shout-out to youth, a reminder that Canadians need to take control of their personal information on the Internet. We think youth are particularly vulnerable, because they're big users of technology and may not realize the risks. Therefore, as our report indicates, we really focused this year on public education activities to reach out and talk to that demographic.
We've passed out some stickers for you that say “Think Before You Click”. We distributed those during frosh week. We also have many other tools. We have a youth blog and videos produced by youth, so we have youth talking to youth. You can find all these tools on our website, youthprivacy.ca. The federal, provincial, and territorial commissioners passed a resolution in 2008 on youth privacy, advising what individuals and organizations need to do.
Lastly, the other main issue I would highlight in the annual report is the matter of data breaches and notification. As you know, this is a global issue. Governments, organizations, and data protection commissioners are really grappling with various models, including mandatory breach notification.
The report highlights a study we conducted on our current voluntary reporting regime. I'm happy to talk about it more, but what it confirmed is that we can't possibly be receiving reports from businesses about all significant privacy breaches in Canada; there's just no way, because the numbers are relatively low. It underscores also the ongoing need for training, because one-third of the breaches reported to us were not the result of hacking, of technology breaches, but really simple employee errors, such as dialing the wrong fax number.
In conclusion, I would like to thank the committee for inviting us today to discuss privacy, street-level imaging and other new technologies.
I'd like to thank the committee for inviting us today, and I welcome your questions.
