Information & Ethics Committee on Oct. 19th, 2010

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

All right. Thank you once again for the good work you are doing on that file.

On the subject of Google, Wi-Fi, and Facebook, you mentioned that you released your preliminary findings in an investigation of Google's collection of Wi-Fi data by camera cars shooting images for the company's Street View mapping application. You indicate that while collecting these signals, Google has captured personal information of a highly sensitive nature.

Can you be more specific about that? I understand that it might be in your report, but for those who haven't read it, what can you tell us about those signals?

[Jennifer Stoddart]

Well, basically these are Wi-Fi signals by which, increasingly, telecommunications or the Internet are passing. A previous member asked what Google knew about it and what we knew about it. I think what is surprising about this file is that this is not something that was done intentionally. This is something that was done without Google itself being aware of the fact that they were scooping up the personal information. A program to take this up was written into the code unbeknownst to those in charge of the Street View photographing program.

This then scooped up data only--before everybody gets too worried--if your Wi-Fi transmission was unencrypted and not password-protected. I think there's a story here for individual Canadians about making sure that they use the strongest privacy protection possible.

Google had been totally unaware that it was getting all this information, but this is not the first time Google has been deficient in adhering to privacy standards, either in Canada or in the European Union, or in other countries that have similar standards.

I think it's a tale of what can happen to your personal information through big technology companies that don't take privacy as seriously as they should.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Do you acknowledge that Google has taken some important steps? The reason I raise that is that I was originally called in this committee to investigate Street View, because it was a brand-new application with which there had been no experience anywhere in the world. This was a revolutionary product.

My experience with it since that time has been that the company seems to have taken some very responsible actions to protect the privacy of citizens. I had one constituent who was in a very awkward position when the Street View vehicle drove by; he reported that to me. I have since had a chance to go to his home on Google Street View and confirm in fact that the technology did work, and his windows were obscured, and therefore it would appear that no offence either was endured by him or committed by Google.

So my sense is that there has been a lot of effort taken. Can you tell me specifically what the deficiencies are?

[Jennifer Stoddart]

Certainly since early 2007 when Google first started photographing streets outside the United States, they have made great efforts to comply. You talked about the blurring technology for faces, your license plate, and so on. You can have your house taken down or have part of it blurred. That's fine for the Street View photo-imaging product.

But the thing that concerns me is that then we had the Google Buzz fiasco, in which people's identities were revealed one to another without their consent in an attempt to create a kind of social networking within your Gmail correspondence. Your Gmail correspondent could have been, one, your mother, two, your doctor, or three, somebody you had an intimate relationship with. All of a sudden, these people who perhaps didn't even know that the others existed in your life found themselves in an instant social network. That was something that caused us concern. It was almost instantly withdrawn because there was a huge outcry.

Then there was this third thing, which is that, unbeknownst to Google, it was collecting personal information. So it's not that once something is brought to Google's attention they don't clean it up; the question is, why aren't they starting with privacy principles at the beginning? And why are Canadian taxpayers or Spanish taxpayers and so on spending a lot of time and effort when these companies should get it right from the beginning before they launch their products?

[The Chair, Liberal, Shawn Murphy]

Thank you, Mr. Poilievre.

Now we'll go to the second round of five minutes.

Mr. Easter.

[Wayne Easter, Liberal, Malpeque, PE]

Thank you, Mr. Chair.

I was sure when I was looking at Google Sreet View one night that I saw the Parliamentary Secretary to the Prime Minister standing on the sidewalk and waving.

I'm sure it was you, Pierre. It looked like you--

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Whoever it was, he must have been a handsome guy.

[Voices]

Oh, oh!

[Wayne Easter, Liberal, Malpeque, PE]

Anyway, I do have a notice of motion, Mr. Chair, that I want to find time to do a little later.

Coming back to the Veterans Affairs issue, in listening to the parliamentary secretary, there seems to be a move by the government to try to lay the blame for what happened--and it has become public here--on the public servants. So I need to ask you how long it will be before your investigation can really be up and running? When will it end? Will your investigation go right up to and include the ministers' offices, both past and current? If this happened in 2004, it shouldn't have happened. Will that investigation go right up to the ministers, including the ministers' offices?

[Jennifer Stoddart]

Honourable member, as I've said, we're planning the audit right now. We're looking at what the scope of it should be. But given the allegations we have heard and what we have found in our own investigation, I think we have to look at all levels of the department to know where personal information is being appropriately sent and not appropriately sent. As I mentioned to another honourable member, we should try to see if this is a traditional practice or a new practice, if we can.

[Wayne Easter, Liberal, Malpeque, PE]

By “all levels of the department”, do you mean the deputy minister's office and the minister's office?

[Jennifer Stoddart]

I think it would include at least the deputy minister's office. As you know, there may be some legal issues about ministers being bound by the Privacy Act and Access to Information Act, but that is before the Supreme Court of Canada. Perhaps we'll get guidance at that point.

[Wayne Easter, Liberal, Malpeque, PE]

This government seems to have a penchant for secrecy and a desire to attack anybody who challenges them. We've seen that with independent officers of Parliament, right from Linda Keen on down. We certainly believe that any such investigation should go right to the minister's desk and not stop at the deputy minister. We'll put that on the record.

The second area of questions is related to a Globe and Mail story on August 20 about voters lists being made available to others. It was reported that a Brian Patterson made some comments about providing voters lists beyond where they really should be provided now. Brian Patterson--here's just a little bit of background--chaired Tony Clement's federal and provincial leadership campaigns and was the manager for election day for Mr. Clement when he was minister, so he's well connected.

He was asked by a municipal candidate about how to obtain federal voters lists, which the Conservatives manage with a program called CIMS, or constituency information management system. He said:

But if someone gives you a copy of CIMS in your local campaign, we can't stop you from calling up your local guys that you work [with] on the executives of [riding associations] if you can get it off them. You know, “Hear no evil, see no evil, speak no evil”. “...you never heard me say this--and I'll deny it in a room full of lawyers--that if you can somehow get it, you know, we don't care”.

The Canada Elections Act specifically states that it prohibits sharing voters lists with anyone other than MPs, registered political parties, and federal candidates. Do those kinds of comments from Mr. Patterson concern you--that he may have found a way of...? You know, the lists should just get out there, and they're given to others--other than who they should be.

[Jennifer Stoddart]

This is the first time I've heard...or if indeed it was picked up and our press clippings noticed this particular article. I can't really comment on it because this is honestly the first time I've heard about it. We comment on things where we have some personal institutional knowledge of the facts of the case.

I will remind the honourable member of our concern, though, with the potential sharing of the voters lists. A couple of years ago, I believe it was, we did an audit of Elections Canada and were concerned about some of the security issues around the multiplication of voters lists and the distribution of the lists.

As I didn't see this article, I haven't thought about this for a while, but as I remember, there was not a system to get them back at the end of elections, so some could go astray. There were things like that, but I'm not aware of the facts of this article.

[Wayne Easter, Liberal, Malpeque, PE]

We'll provide you with a copy.

[The Chair, Liberal, Shawn Murphy]

Okay. That's it.

Go ahead, Mrs. Davidson. You have five minutes.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thanks very much.

Thanks very much for appearing before us again this afternoon. It's nice to see you again. I want to add my congratulations to the other voices around the table for the great work that you've been doing. We appreciate what you've been doing.

Certainly, as my colleague said, we look forward to your audit with Veterans Affairs. Certainly, an inappropriate action has occurred, and we all look forward to getting to the bottom of this issue. We'll all be watching the timeframe of that investigation.

What I really wanted to direct my comments to were the Facebook and Google issues. You certainly are well aware that we have done the Google study here--we've started it, but have not completed it--and are looking forward to hearing from Google again, hopefully in the near future. I must admit that I have not read the report you released today; I haven't seen that report yet, but I will be looking for it in the very near future with anticipation.

I realize that you've been addressing a lot of issues with both Facebook and Google. Can you give us any more of an update about this, on what's been resolved, what's still outstanding, and what might be happening as you continue to work with them?

Can you also talk a little bit about the comment you made in your opening remarks in which you said that later this month you would be at an international conference “co-sponsoring a resolution that would see privacy considerations become embedded into the design, operation, and management of information technologies”? Will this impact Facebook and Google? Is this going to be in conjunction with EU countries? Who will be impacted?

[Jennifer Stoddart]

I'll start with the last part of your question, if I may. Every year there is an annual meeting sponsored by privacy commissioners, mostly from the European Union--they have that European-defined level of privacy, which Canada has exceeded--as well as Australia, New Zealand, Hong Kong, and, more recently, some of the Latin American countries. Mexico, I believe, has just adopted legislation; it hasn't been approved as adequate. Uruguay's was. This is a growing movement of countries that have come up to the more stringent privacy standards of the European Union.

Every year at that conference, resolutions are brought forward. They're only resolutions. We try to use them as a way to put forth important ideas and to get public attention focused on the issue of privacy. This year, my colleague Dr. Ann Cavoukian, the commissioner for privacy and information in Ontario, is co-sponsoring this resolution with the host, the Israeli data protection commissioner. I'm very happy to be one of the sponsors.

This speaks to the whole issue of privacy by design. As I was saying in response to a previous question, our problem is not with the product once it's fixed; it's why the privacy wasn't built in at the beginning.

It's very interesting that this concept, which Commissioner Cavoukian has been instrumental in pushing as long as I've known her, I think, has international take-up now. I believe the European Union is considering this issue of privacy by design to be incorporated in their new directive. I guess that's an example of how we try to work together to have some leverage with these enormously powerful international companies.

In terms of ongoing relations, both with Google and with Facebook, I'd say they're positive. Google has very able representation here in Ottawa, and Facebook has great Canadian representation too. The issue is that we're always following after the fact, and it's how to get that message across to them in a way where they really pay attention. Once they're found out and we say, sorry, but this is Canadians' personal information and this is how you have to do it, that's fine, but that process is very arduous for our employees. You can imagine the number of engineers and inventors they have at Google and Facebook, and we have to try to keep up with what they're doing, so--

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

What happens when you do find that there has been an issue? Is there any way of measuring the impact? How are individuals made aware that there could be sensitive information out there? What's the process?

[Jennifer Stoddart]

The process in dealing with these two companies, particularly given the take-up on their products, has been to make our reports public, to issue press communiqués, and to try to do public education about this.

I do have that option to make reports public when it's in the public interest. That's a way of cautioning people as soon as we can, by saying: “Be very careful when you're on Facebook”, or “If you want to have your house removed from Google Street View, here's what you do”. Occasionally people will say, “Well, I tried to get in touch with Google, but I couldn't get my house erased, so can you help us?” In fact, there's some kind of mix-up, and yes, Google will blur--not erase but blur--their car licence numbers and things like that.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you.

[The Chair, Liberal, Shawn Murphy]

Ms. Thi Lac, you have five minutes.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Good day, Commissioner. I have a number of questions to ask you.

First, I want to continue along the same lines as my colleagues who asked you about Google Street View and Facebook. I want to know, given the current context of globalization, what legal means can be used to apply Canadian laws to international companies or multinationals.

[Jennifer Stoddart]

In our case, the legal means are the Personal Information Protection and Electronic Documents Act. In fact, I do not believe that the Canadian legislation is a disincentive within the private sector, and it might perhaps be appropriate to consider the issue in coming years, if not immediately. As soon as we see that companies are breaking Canadian legislation, we ask them to change their practices. In some cases, they do so, but there are no fines as is the case, for example, in America, England, France and Spain.

At the most, we could say that there are not many incentives for these companies to incorporate privacy protection within their projects from the start. They know that if they are caught breaking the law, that same law allows them the possibility of remedying that before I can take them before the Federal Court of Canada, and then I have to start all over again.

I think that this issue will be raised a lot over the coming year, during the PIPEDA review.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

You are saying that, at present, the legislation does not include fines. Do you believe that fines should also be set out in the act so as to give it more teeth?