Evidence of meeting #30 for Access to Information, Privacy and Ethics in the 40th Parliament, 3rd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was product.
A recording is available from Parliament.
Conservative
Pierre Poilievre Conservative Nepean—Carleton, ON
Okay. So that is a good, practical suggestion.
You said you had a second one.
Canada Policy Counsel, Google Inc.
This is where the market comes in. Canadians should choose services that have encryption built into them. There are, for example, a number of different web mail products. To my knowledge, Google's Gmail is the only major web mail service that has encrypted connections built into it. So if you use Gmail, every time you connect, by default your connection is encrypted. Even if you're connecting over an unsecured network, your connection via Gmail is secure. Google has invested the time and the money into building encryption into its products. This is where the market can be helpful, because Canadians should choose products and services that have encryption built into them.
Liberal
The Chair Liberal Shawn Murphy
Thank you very much, Mr. Poilievre.
Thank you, Mr. Glick.
That concludes the first round, colleagues. Now we'll start the second round, for five minutes each.
Ms. Bennett, we'll start with you for five minutes.
Liberal
Carolyn Bennett Liberal St. Paul's, ON
Thank you.
To follow up on my colleague's question, if you do Google “payload.data”, the first item that comes up is the Wikipedia definition; the second is the Whatis.com, and the third is the Google apology “Says Failed Badly” from May 18, 2010.
When we look at what you've said is obviously an inadvertent collection, and that this was back to some code that was written in 2006, and the code was written only to collect where the Wi-Fi signals were coming from, my concern is that this engineer who wrote the code....
My first question is, is that engineer still working at Google?
Canada Policy Counsel, Google Inc.
I cannot, unfortunately, comment on a personnel matter.
Liberal
Carolyn Bennett Liberal St. Paul's, ON
Okay.
The fact that this engineer took upon himself or herself to say that they didn't think it was a substantial privacy concern makes it sound as though you're now putting in place privacy training, as the Privacy Commissioner has asked, and to put somebody in charge who is the person...in most organizations to know what you know, know what you don't know, know who and when to ask for help. This person would, if any other engineer wasn't sure if there was a substantial privacy concern, immediately know who to ask.
Canada Policy Counsel, Google Inc.
That's right. Thank you for the question. You've got it exactly, which is that we want engineers themselves to be knowledgeable and accountable for the products they create.
In addition to that, though--and this is important--we are building additional checks and balances into the system, so that even if somebody makes a mistake or an error in judgment, that doesn't percolate all the way through to launch.
There were opportunities for this to be caught, but we want to build more opportunities, deeper opportunities. Included in the changes that we've announced, for example, are compliance audits, where there will be teams at Google whose job it is to audit the products that teams create to ensure that the actual thing that's happening is what's in the product design documents.
Liberal
Carolyn Bennett Liberal St. Paul's, ON
Is that a spot check, or is it in the process for developing a product that there is an automatic compliance audit for the new product?
The other piece of this is that the Privacy Commissioner has said that she will only consider the matter resolved upon receiving the evidence by February 1, 2011. It seems that the training issue is huge, so would the report that you send to her--so that she will be able to determine that her report is complete and so that she can make her final report and conclusions--include privacy training manuals and the kinds of protocols that will be put in place?
I don't necessarily expect you to share the Google training manual with this committee, but I am interested as to whether the training for engineers, and for all of the employees at Google, would be shared with the commissioner at that time.
Canada Policy Counsel, Google Inc.
The answer is that I don't know what the communication to the commissioner is going to be at that time, but I can tell you that we're working hard to have a full answer so that she can consider this matter resolved.
I should say that I've talked directly to Dr. Whitten precisely on this issue in the last week, and she's working flat out to try to implement the changes we've announced so that we can come back to the commissioner with not just announcements but real, substantive changes.
Liberal
Carolyn Bennett Liberal St. Paul's, ON
If someone is caught designing something or writing code for something that is not in compliance with the code or the interpretation of what is and is not a substantial privacy concern, which was the basis for this error, would there be, including in the manual, some consequences for somebody deeming something inconsequential without asking the new person in charge? Would you be able to share with the commissioner the consequences for not having asked and then for having written code that clearly is in violation of anybody's interpretation of privacy?
Canada Policy Counsel, Google Inc.
I think the key here is not the kinds of punitive measures that get put into place from an HR perspective, but rather the total system of compliance and checks and balances that gets created. At the end of the day, it's about Canadians. Resolving this matter is about the commissioner, but at the end of the day, it's about Canadians. It's so that Canadians can rest assured that their personal information is private and secure. It's ultimately our users who rely on trusting us with their data, because we know that our services are one click away from our competitors' services.
Liberal
Liberal
The Chair Liberal Shawn Murphy
Ms. Bennett, your time is up.
Mr. Glick, I want to follow up with something, just to clarify.
Ms. Bennett asked whether the engineer who designed this program is still with Google. You have no reason to deny that information to a parliamentary committee. Maybe you don't know it, and you'll have to get back to us, but I'm directing you to answer that question.
Canada Policy Counsel, Google Inc.
I don't feel comfortable answering a personnel question. Can I take it under advisement?
Liberal
The Chair Liberal Shawn Murphy
She didn't ask for his name; she just asked if he's still working for Google. It's a legitimate question for a parliamentary committee.
November 4th, 2010 / 4:15 p.m.
Conservative
Harold Albrecht Conservative Kitchener—Conestoga, ON
Mr. Chair, I have a point of order.
I do think that personnel issues, generally speaking, even in parliamentary committees, are considered to be subject to being taken in camera. With due respect, I disagree with your statement.
Liberal
The Chair Liberal Shawn Murphy
If you want to challenge the ruling of the chair, you can do it if you wish.
Conservative
Harold Albrecht Conservative Kitchener—Conestoga, ON
Mr. Chair, I just said that I disagree with your statement that a public witness would be mandated to divulge private information about company matters in a public session.
Liberal
The Chair Liberal Shawn Murphy
Well, the chair has ruled. If you want to challenge the chair, that's certainly within your rights. This is an issue that caused a worldwide problem in Italy, in Germany, in the United States, and in Canada. I think it was a legitimate question.
You may not know the answer. We'll give you time to get back to us, but you certainly have no legal right to withhold that information from a parliamentary committee.
Canada Policy Counsel, Google Inc.
The answer is that I actually don't know the answer.
Liberal
The Chair Liberal Shawn Murphy
That's fine. You can get back to us.
We're not looking for his name or where he works; we just want to know if he's still with Google. That was the question.