Information & Ethics Committee on Nov. 25th, 2010

[Jacob Glick]

Again, that's my understanding of the facts, yes.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

And the reason that the data mistakenly acquired in Canada has not been deleted is because of ongoing discussions with the Canadian authorities on how best to proceed with that deletion. Is that correct?

[Jacob Glick]

Thank you for that question.

To clarify what I said, when I called the Privacy Commissioner in May to advise her of this unfortunate circumstance, I asked her what she wanted done with the data then. She asked that we preserve the data because perhaps she wanted to launch an investigation or review it in some manner. In fact, her office did launch an investigation and did review the data. We held on to the data at that time.

At the same time, conversations like this were happening in other places in the world. A level of analysis was done at that time in those other places. Where it was deemed appropriate by the local data privacy authority, and where it was deemed appropriate under the various legal systems, data was deleted.

We are now x number of months down the road, and we need to do that analysis given the circumstances of today, not the circumstances of May.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Perhaps I missed something, but did you say that some of the Canadian data has been deleted?

[Jacob Glick]

No, I didn't say that.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

I may have misheard you. The data were originally retained, then, on the instruction of the Canadian Privacy Commissioner. Is that your testimony?

[Jacob Glick]

Yes.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Have you received any subsequent instructions to the contrary?

[Jacob Glick]

We received the Privacy Commissioner's interim letter of finding, which the committee has in its possession, and which she released to the press and to the committee in October. It asked that we delete the data as soon as we had assured ourselves that we are able to do so under Canadian and U.S. law.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

You are in the process of securing those assurances through an analysis of the aforementioned laws?

[Jacob Glick]

That's correct.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Feel free to refrain from answering this if it requires unwarranted speculation: is there anything in either nation's statutes that might cause you to hold onto the data for an extended period of time?

[Jacob Glick]

I wouldn't want to speculate on that. Ultimately, our objective is to delete all the data. We didn't want it in the first place, and we don't want it now, but we don't want to delete it prematurely and cause more headaches.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

I don't want to taint any legal proceedings that may materialize through class action suits, but with respect to the possibility of litigation from people whose information was inadvertently acquired by Google, could the data in your possession be required as part of an evaluation of what data existed and what damages were incurred?

[Jacob Glick]

I won't speculate on the outcome of any particular litigation.

I can tell you that it's something we would object to producing in a court proceeding, precisely to protect the privacy of the people whose data were mistakenly collected. There would be an irony to class action litigants demanding the production of data that they allege contains private data, but I can't speculate on what tactics any person, litigant, or regulatory authority might take.

The point is that we would certainly object to the production of any of this in court, I can tell you that.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

All right. Thank you very much.

I think my time has expired.

[The Chair, Liberal, Shawn Murphy]

Pretty well, Mr. Poilievre. Thank you.

We're now going to start the second round of five minutes each.

Dr. Bennett, you have five minutes.

[Carolyn Bennett, Liberal, St. Paul's, ON]

Thanks very much.

I'm still a little bit concerned about the actual process for making sure this never happens again. I was a bit surprised to learn that the engineer who made this assumption about whether it was a significant privacy breach is still employed by Google.

As we try to push responsibility for making decisions in organizations down as far as we possibly can, I'd like you to outline what special privacy training will actually look like. Will the offending engineer be the person delivering this as some sort of equivalent to community service? I don't understand how this person can excuse what they did. I don't understand why they're actually still working for Google.

In every sort of training I've ever done, whether it was with family practice residents or new candidates, the basics are: know what you know, know what you don't know, and know to whom and when to go for help. If people are making this gross kind of assumption about what is or isn't a privacy problem, I'd like to know what kind of curriculum you're going to deliver. What does “intense training” mean when somebody at that level has been able to pull off this rather massive breach with whatever previous training there was?

[Dr. Alma Whitten]

Thank you. That's an excellent question. I'm very glad to have a chance to answer it in more detail.

What the member said about making sure that you know what you don't know and that you know who to ask is very key to the training and the process improvements we're putting in place. It's very important for us to educate all of our engineers and product managers, but we're not going to be able to make them international experts in all aspects of privacy. If we were to aim to do that, it would not be setting up to succeed.

Above all, we want to educate them to not try to figure this out for themselves. Privacy is a complex topic, and addressing it properly within Google--or anywhere, really--requires a wide variety of expertise. It requires expertise in law, obviously and most certainly. It requires technical expertise to make sure there's a clear understanding of what exactly the technology is doing, what the systems are doing, and what the potential of that technology is. It requires expertise in the psychology of user understanding: of how the people who are going to interact with products will understand the options available to them. And it requires expertise in policy and communications in all of these things.

A very important point we will be making over and over again in our training is that individual engineers should never be making these judgment calls by themselves. We want to educate them on the privacy landscape and privacy concerns.

We want to very much educate them on Google's own articulated privacy principles of transparency, control, and responsible stewardship above all, but we also want to educate them very, very strongly and reinforce that education in many ways on the improved processes we are putting in place, to make sure that those fail-safes are there, that the thoughtful review is in place, and that individual engineers don't try to “lawyer” questions by themselves.

[Carolyn Bennett, Liberal, St. Paul's, ON]

How much time would a newly hired engineer be given in privacy training now? What are you doing in service for the people who are already working for you? Would there be scenario planning and problem-based learning, which are usually viewed as modern ways of going about this?

[Dr. Alma Whitten]

For newly hired engineers, we expect to give them a significant session of privacy training within their first two weeks at the company, before they would be writing any code, before they would be starting on any product development. With that initial training, we expect to lay a lot of the seeds in place in putting the framework in place for them to know who they are supposed to talk to and when, to know where the resources are internally to help them understand privacy and to understand our privacy processes, and where those are quickly and easily found--all of those aspects of who they should talk to.

For engineers going forward, for the people who aren't going to be hired next week or the week after that to come in through this initial training, we will be doing follow-up training. But above all, I think, the process, which we are enhancing and optimizing now, and the training have to really be two halves of the same coin that will reinforce each other and work closely together.

The process will force engineers to engage with the training at various parts of their project's life cycle. As they are expected to engage with the process, then the training is there to tell them how to do so and to provide them help to enable them to do so. The goal is very, very much for those two aspects to strongly reinforce each other to make this as effective as possible.

[The Chair, Liberal, Shawn Murphy]

Thank you, Dr. Bennett.

Ms. Davidson, you have five minutes.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thanks very much, Mr. Chair.

Thanks to our witnesses here today, both by video conference and in person. This is an issue that we're all taking very seriously, and certainly we have a lot of questions about it still.

My first question is for Mr. Glick, please. It's in regard to the letter we received, which the chair read out. I'll simply read the clause that I'm not clear about: “With respect to your question regarding any impediments under U.S. law to the deletion of the Canadian data, Google is working on analyzing the information and Jacob will give the committee an update on Thursday”.

What I would like an explanation of is “working on analyzing the information”. I don't know what you mean by “analyzing”, and when you're referring to “information”, are you referring to the data?

[Jacob Glick]

Thank you for asking for that clarification. No, we are not talking about analyzing the data. Google has no interest in trolling through the data, as we've said from the beginning, so thank you for allowing me the opportunity to clarify.

I think this is just a poorly worded sentence, and you should take it at face value, which is that we're doing the analysis that the Privacy Commissioner and our own due diligence require of us, which is to ensure that we're in a legal position to be able to delete the data, as I've described to a number of members of the committee.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you very much, Mr. Glick. I appreciate that information.

I'd now like to ask Mr. Ramsay a question.

How many employees do you have in your group?