Information & Ethics Committee on Nov. 4th, 2010

[Jacob Glick]

The short answer is, once we take it down, it's down.

But the longer answer to your question is.... What do people do when they don't have access to computers and therefore don't have the opportunity to take it down? Statistics show that sizeable numbers of Canadians are using this on a daily basis, not every Canadian obviously, but it's a very popular product, as I indicated in my opening statement. More Canadians use Street View than Japanese people, not per capita but in absolute numbers. It's an incredibly popular and useful product. Many of us who can't read maps can understand basic cartographic information. So it is a useful service in that regard. But obviously we're trying to balance the usefulness of it with the important privacy considerations that this committee, the Privacy Commissioner, and others have raised. And we think we've done that.

[The Chair, Liberal, Shawn Murphy]

Thank you very much, Mr. Easter.

We're now going to go to Monsieur Nadeau.

Mr. Nadeau, you have seven minutes.

[Richard Nadeau, Bloc, Gatineau, QC]

Thank you, Mr. Chair.

Welcome, Mr. Glick.

In view of the privacy commissioner's recommendation, I would like to know who is in charge of confidentiality for Google.

[Jacob Glick]

I apologize in advance. I don't speak French. The translation said in charge of confidentiality, but I presume you mean in charge of privacy.

[The Chair, Liberal, Shawn Murphy]

Monsieur Nadeau, do you want to repeat--

[Richard Nadeau, Bloc, Gatineau, QC]

In view of the privacy commissioner's recommendation, I would like to know who is now in charge of confidentiality for Google. Is there an individual, an employee or a vice-president who would be in charge of confidentiality?

[Jacob Glick]

The short answer is that Dr. Whitten has taken responsibility to be our director of privacy. That means not only is she going to be in charge of leading engineering teams working on privacy issues, as she has done already at Google, but she also will have heightened responsibility within Google to coordinate engineering teams and product teams at the highest levels of management. She reports now to the head of engineering and the head of our product division.

At a company such as Google, which is so innovation-driven, so engineering-driven, it's important to have somebody with a computer science background, somebody who has a doctorate in computer science, who can really speak the language of the product teams to really effect change. So part of that top-down change and part of that responsibility will be Dr. Whitten. Of course, we also have embedded people throughout the organization who have various kinds of accountabilities for privacy.

I can go into much more detail about this if you're interested.

[Richard Nadeau, Bloc, Gatineau, QC]

Yes, I will be interested.

You can give answers about this after other questions. You mentioned Dr. Whitten's main responsibilities.

What is Dr. Whitten's background? Has she been working in a similar company before or is she coming directly from the university? What is her training before she worked on this extremely important issue?

[Jacob Glick]

She's been at Google for a number of years. I don't have her biography in front of me, but we can use Microsoft Bing later to search for it and get it. But I can tell you that her doctorate is in the area of computer science and security and that she has published numerous papers in computer science, security, and privacy. She has been a thought leader in the area of privacy and security on a global basis for a number of years, and within Google. She has a deep understanding of these issues.

Another important thing to note, and I think this is an interesting bit of colour, is that she's based in London, England. She's not based in Mountain View, California. That's important because she doesn't bring a uniquely American perspective to bear on this; she brings a global perspective to bear. So to the extent that you think there are only American conceptions, for example, of privacy, I would respond that we're really talking about bringing global perspectives to bear in the design and implementation of privacy principles, practices, and standards that are already in Google, that have already contributed to the development of products that we have. She's been a leader in a number of initiatives already within Google, and that perspective will continue to be brought to bear at the highest levels.

[Richard Nadeau, Bloc, Gatineau, QC]

I would like to ask another question on a different subject.

Unless I misread something, Italy set rules before Google began street level imaging. For example, if I am not mistaken, it should be announced on your website at least three days ahead of time that you will be at such a place in Italy to make photos. This should also be advertised in two local newspapers.

Is that the way things are done in Italy?

[Jacob Glick]

I'm not familiar enough with the particular rules around collection in Italy. I can tell you that on the question of notice and collection in Canada, I personally was—

[Richard Nadeau, Bloc, Gatineau, QC]

I read that in the documentation we were handed. A radio station should also announce that Google will be in the area for its imaging operations. Another requirement is that cars should be clearly identified, and that stickers indicate that photos will be taken.

You said you are not familiar with this, but would you agree that this rule apply throughout Canada also?

[Jacob Glick]

We worked with the Privacy Commissioner to develop something that made sense under Canadian law and that she was comfortable with, and that we thought this committee and Canadians would be comfortable with, for notifying Canadians prior to collecting the data. As you rightly pointed out, all of our cars are clearly marked—and this is on a global basis—and they are visibly Google cars, and we have a website that we constantly update with information about where we're going to be collecting information.

In terms of the precise day and time and the precise neighbourhood, there is a level of complexity here that we have to acknowledge. These are moving vehicles that depend on certain weather conditions and certain other externalities, and it's hard to predict with precision where and when they will be. But, in general, we provide what we think is full and appropriate notice, both here in Canada and around the world, albeit the precise content of that notice may vary slightly.

But there's another important point I would like to emphasize on this issue in particular. Google is not the only company that is collecting street-level imaging in Canada. In order to create the GPS maps that are used in most of your cars and on websites where you access digital maps, the companies that create those maps, the companies that collect the digital information, follow a very similar process and take photographs of every street and every house. And they don't provide any notification, that I'm aware of, to anybody. They haven't received any scrutiny from a regulatory perspective on this, that I'm aware of, and they're not under the same obligations we are in terms of any kind of retention of that data.

So when comparing what our competitors are doing with what we're doing, it's important to put that into a broader perspective, that every digital map you use is created using a process of street-level photography. That's how maps are created today.

[The Chair, Liberal, Shawn Murphy]

Thank you, Mr. Nadeau.

Mr. Siksay, for seven minutes.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you, Chair.

Thank you for being here today, Mr. Glick. I agree that this is a very, very serious matter we've called you about.

I want to come back to the appointment of Dr. Whitten as Google's director of privacy. You said she's based in London and that she reports directly to the head of engineering and the head of production.

Where are those two folks based?

[Jacob Glick]

They're based in California.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Now, I know you're probably masters at communication across long distances, but London seems a bit removed from where the actual engineering and product development work are being engaged in.

How does Dr. Whitten engage with those folks who are doing that work?

[Jacob Glick]

There's a long answer. The short answer is that I think she's going to be a more frequent flyer than she is today. So if she's not super elite already, she will be.

But more to the point, Google has product development happening all over the world. Just 200 kilometres from here, in Montreal, we have some of the most talented engineers in the world working on products that aren't designed for Canada but for Google users globally. So it's not the case that all product and engineering decisions are happening in Mountain View, California; they're happening all over the world.

One of the interesting privacy-related products that Google released last year is the Google Dashboard, which—

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Okay, that's great. We'll hear about products another time.

[Jacob Glick]

Sure.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I want to get to the whole issue of privacy and who looks after that.

So you say there are product development people here in Canada. Who is their supervisor? Who do they work with on privacy considerations relating to the products they're developing specifically in Canada?

[Jacob Glick]

The product teams in Canada will have responsibility, in the same way that product teams throughout the world will have responsibility, for privacy. That is say, every single engineer, herself or himself, is responsible and accountable for the collection, use, and handling of data, and we're going to be deepening that.

In addition, their managers are responsible for maintaining accurate product plans that accurately describe how products work.

In addition to that, they have lawyers assigned to every single product that Google has, who review product designs, plans, and implementation for legal compliance reasons, including privacy.

In addition to that, we do regular compliance audits of all of Google's products, and we actually just completed an audit of 200 products recently. So there are—

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Was that system in place, though, when the Street View product was launched and the Wi-Fi hotspot component was missed? I gather that was developed in California. Is that system, with all of those people you've just mentioned, in place now, or is this a new system that's been put in place since the foul-up with that product?

[Jacob Glick]

What I described to you is a combination of both. So the answer is, we have always had privacy considerations be an important component of product design, and our products reflect them. This incident is an anomaly, but that's not to excuse it. I don't excuse it, and that's why we are building additional safeguards to try to make sure that something like this doesn't happen again.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Will there be a list of Canadian individuals who are designated to look at privacy issues for Google in Canada? That seems to be one of the recommendations of the Privacy Commissioner, that there be clearly designated and identified individuals actively involved in the process and accountable for compliance with Google's obligation under privacy laws. Is there now, or will there be, a list of folk who are responsible for that here in Canada for Google?