Information & Ethics Committee on Nov. 25th, 2010

[Wayne Easter, Liberal, Malpeque, PE]

I have one other question that I think it is something that committee members have pushed to other witnesses, and that is with regard to the controls in place in various companies to ensure there are procedures in place to protect privacy. The second part of that is really about what your company, Yellow Pages and its various subsidiaries, or the ones you've taken over, does to ensure compliance by your staff now and in the future as things change.

[François Ramsay]

We have put in place privacy policies that are posted on our websites and that users can access and review. We are currently reviewing these privacy policies to make them more uniform throughout the company, as the company has grown through acquisitions over the course of the past few years. We are satisfied that we are complying with privacy legislation as it exists.

As for the policies and the systems we have in place to ensure privacy—and maybe this is where, if the conversation becomes slightly more technical, I will have to pass the mike over to Martin--my understanding is that our IS/IT department has put in place systems that would be the accepted industry standards relative to protecting privacy. As far as receiving and dealing with privacy complaints is concerned, they all come through my office. To be very candid and very transparent in front of the committee, there are very limited instances where privacy concerns have been raised and have reached my office and we have had to deal with them.

[Wayne Easter, Liberal, Malpeque, PE]

Thank you, Mr. Ramsay.

My last question is to Ms. Whitten.

You talked fairly extensively about what I think you called the dashboard. You indicated that it's not strictly a privacy tool and that when it was designed you didn't want it to be strictly a privacy tool. I listened to your explanation, but could you explain to me, maybe in more detail, how this dashboard is in fact a privacy tool, how it protects privacy?

[Dr. Alma Whitten]

Certainly. I would be happy to.

Let me first clarify a bit about what I was getting at in saying that we didn't want it to be only a privacy tool. As my privacy team works to build privacy tools and to build transparency and control into all of Google's products, one of the things we're very aware of is that there's very often a valid critique that these settings and options for users are buried underneath a privacy link or a privacy option where nobody ever actually goes.

We wanted to be ambitious about addressing that problem by making the dashboard as much as possible a place where people would simply go to see all the information in their account for all kinds of reasons: because they're looking for something or because it's useful to them in other ways. By doing that, it would keep them informed about the information, about the data that was in all the different Google services they might have used over time.

It would keep them informed about which services they might have used at one time, then forgotten about and never gone back to again, but that still have some of their data. They would be informed in this way even if they never had that moment of thinking that they should check on their privacy. We felt that was a way for us to reach, to protect, and to better serve more of our users, even if they weren't necessarily people who were already very conscious of privacy as a question.

[The Chair, Liberal, Shawn Murphy]

Thank you, Mr. Easter.

Thank you, Dr. Whitten.

We're now going to move to Madame Thi Lac.

Madame Thi Lac, vous disposez de sept minutes.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Good afternoon, Ms. Whitten, Mr. Ramsay and Mr. Aubut. Good afternoon, Mr. Glick, giving your testimony today by videoconference.

My first question goes to Canpages.

You told my Liberal colleague that you had subcontracted your MapJack service, but the only guarantee you got was the one that your subcontractor was prepared to give you. As the one responsible for the service, how confident do you feel about that? Were you just given verbal assurances, or guarantees that really let you declare to the committee today that the service is secure?

[François Ramsay]

That is an excellent question and I hope that I will be able to put the committee at ease by providing it with some assurances.

I can tell you that Canpages, actually Yellow Pages Group Co., is not a highly developed technology company. Neither Canpages nor Yellow Pages Group Co. have the technology inside the company to produce a service like Street Scene or Street View.

When Olivier Vincent came to address the committee in June 2009, he explained, if I am not mistaken, that we were right at the start of services like Street Scene.

Against that background, Canpages still had the foresight to require confidentiality assurances from its supplier. If I am not mistaken, Mr. Vincent told the committee that the company had committed to destroy and discard any image in which things like vehicle licence plates and faces, I believe, had not been blurred.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Mr. Ramsay, when you say that you required assurances, they are the ones we have already received as a committee, they do not give additional information that have already been provided to—

[François Ramsay]

Since we were invited to be part of the committee's work, and when we became aware of Google's testimony last November, we got in touch with the supplier and asked for clarification on the incidents that happened when Google was taking pictures. We then looked into whether comparable situations had arisen. Our supplier assured us that Wi-Fi zones had not been detected and that no data transmitted from those zones had been intercepted either. Basically, they did not have the technology to identify Wi-Fi zones in the street as the pictures were being taken.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Thank you. I have a final question, but could you answer quickly because I'd like to have time to ask the people from Google some questions.

Can you tell us what technology MapJack uses to gather its information?

[Martin Aubut, Senior Manager, Social Commerce, Yellow Pages Group Co.]

Good afternoon. I do not have information about exactly which technology our supplier uses. What I want to add, as a follow-up to your first question, is that we just use the images; MapJack uses nothing else that could be considered other data. For us, it really is all about the image, a specific interaction at a specific point.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Thank you very much.

Now I am going to talk to Ms. Whitten. You said that you are engaged in training your 23,000 employees on the protection of personal data and privacy. Can you tell us what that training consists of?

[Dr. Alma Whitten]

Certainly. The improved training that we are putting in place has a number of aspects.

First, we are going to have broad security and privacy compliance training and code of conduct compliance training across the entire company--both of those things for all of the employees.

Second, there is going to be a more focused and deeper training specific to different kinds of job roles. We are currently in the process of putting together a much more focused and in-depth training for engineers and product managers that will be specific to their jobs. We will also be looking at other functions within the company, such as legal functions and customer service and sales, to offer appropriate and more in-depth training for each of those roles.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

At the moment, you cannot state that the information and data gathered by accident on Google Street has all been deleted. But I see that Google has erased the data that was gathered accidentally in Great Britain. I have an article about that, dated last November 19, which is quite recently.

I would like to know why it was possible to destroy the information in Great Britain, but it has not been possible to do the same in Canada. My question goes to Mr. Glick.

[Dr. Alma Whitten]

I will answer in part, but then I will also invite Mr. Glick to answer specifically to Canada.

Everywhere, in every country where we have any of this data, it has always been Google's desire, since we discovered that we had mistakenly collected this data, to delete it as quickly as possible. In each country, we have been cooperating very closely with the appropriate data protection authorities as they investigate how this data came to be collected, and in each country when we have been able to establish that there is no legal requirement for us to keep the data, we have immediately moved to delete it.

I will ask Mr. Glick to also chime in to answer your question, because he is the specialist for Canada.

[Jacob Glick]

Thank you very much.

First, I think I said in my remarks to the committee on November 4 that we had deleted the U.K. data. I actually am not sure that this is the case. I misspoke when I said that, because I thought that the investigation had been concluded. In fact, it concluded subsequent to my appearance.

I'm not certain that the data has been deleted. I just don't know the answer to that. But the analysis that's being undertaken in the U.K. will be similar to what's happening in Canada and elsewhere in the world. We want to confirm all of the obligations we have under relevant law to preserve data so as to ensure that in the process of deleting it we don't inadvertently do something else that's bad.

Again, this is what I mentioned in response to the committee's question and to the point Mr. Siksay raised, which is that we only get one chance to delete the data. The analysis has to be incredibly thorough to ensure that we get it right.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Thank you very much.

[The Chair, Liberal, Shawn Murphy]

Merci.

Mr. Siksay, you have seven minutes.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you, Mr. Chair.

I want to thank the gentlemen from Canpages and the Yellow Pages Group for being here today, as well as Mr. Glick and Dr. Whitten.

Dr. Whitten, thank you for staying up late and working late to be with us today.

My questions are probably for Mr. Glick and Dr. Whitten.

Mr. Glick, can you tell us exactly where the payload data that was captured in Canada is currently being stored?

[Jacob Glick]

It's being stored in a secure facility in California, the same place it's been stored in since the Privacy Commissioner's investigators reviewed it.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

You can confirm that the data is actually held in California? Because I think the Privacy Commissioner's folks weren't sure that it was actually at the Google headquarters in California or that it may have been held somewhere else. Your information is that it is held in California.

[Jacob Glick]

As far as I know, it's in a secure facility there. I don't know that it's on the Google campus. I think it's being held by a third party, but I'm not 100% certain about that. Dr. Whitten may have some additional information.

Wherever it was being stored at the time that the Privacy Commissioner's investigators came to review it is the same place it's being stored today, in a secure manner. It is segregated from the Google corporate network and segregated from any other data, and there is limited access to it. All of the security restrictions in place that were around the data when her investigators came to review it are in place today.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

You can confirm that it's not being stored in Canada. The information has left Canada and is being stored in the United States?

[Jacob Glick]

Well, it left Canada when it was collected in the cars. So it's not like it left Canada during the process of this investigation.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Right. I understand that. So my question--and maybe, Mr. Glick, you can help me with this--is what the legal issues are that require analysis in this case. Is this about conforming with U.S. law? Since this Canadian data, this information that relates to Canadians, is being held offshore, in the United States, is the analysis about what American law we have to comply with?

I ask that question especially given that the Privacy Commissioner of Canada has recommended the immediate destruction of this data. Are there legal issues that Google is currently analyzing? Can you tell me what those are? Also, do they relate to the fact that information about Canadians is being held in the United States?