Information & Ethics Committee on Nov. 25th, 2010

[François Ramsay]

The answer is yes. In the future, we would rather use services such as those offered by Google or Microsoft. They are firms that people are familiar with.

[The Chair, Liberal, Shawn Murphy]

Thank you, Ms. Davidson.

Mr. Laframboise, you have five minutes.

[Mario Laframboise, Bloc, Argenteuil—Papineau—Mirabel, QC]

Thank you very much.

Mr. Glick, my question is for you. A little earlier, you perhaps misunderstood my colleague's question. I am going to read you a report in a Daily Mail article from last Friday:

“After having admitted “accidentally“ gathering much more than information on Wi-Fi networks with its Street View cars last month, Google has just agreed to erase the private information gathered in Great Britain,” Christopher Graham, the UK Information Commissioner, announced today. “I applaud the fact that the data captured from Wi-Fi networks can finally be destroyed,” he said.

This means that, in Great Britain, Google agreed to destroy the data it collected. If I understand you correctly, you have not done so in Canada because the Privacy Commissioner asked you to keep the data. Is that correct?

[Jacob Glick]

Well, let me take a step back. First of all, I understand that we have agreed with the report from the Privacy Commissioner's equivalent in the United Kingdom, who has accepted our desire to delete the data in the U.K. I don't know that we've actually deleted the data yet. That's the question that's open in my mind and I just don't know the answer to that.

But the same is true in the Canadian context, which is that we also want to, desire to, delete the data in the Canada context. The only question is whether we are allowed to under the law and we have to do the analysis to determine whether we can or not.

What I was saying earlier with respect to the Privacy Commissioner was that initially, in May, when I contacted her office, she asked that we retain the data so that they could review it as part of an investigation, which they did undertake and which they did complete. Now, having concluded that investigation, they are saying that we are free to delete the data. We accept that, and we want to delete it, but we have to conduct the proper legal due diligence.

[Mario Laframboise, Bloc, Argenteuil—Papineau—Mirabel, QC]

You say that you want to check whether the law allows it. Which law are you talking about, Canadian law or American law? Your data are kept in the United States, if I am not mistaken.

[Jacob Glick]

Again, we're doing the analysis just as the Privacy Commissioner envisioned it in her report, which is that U.S. and Canadian law are applicable here--potentially.

[Mario Laframboise, Bloc, Argenteuil—Papineau—Mirabel, QC]

My next question is for Mr. Aubut. You understand how complex the Google case is. A little earlier, you said that you do not know the technology that your subcontractor uses.

What guarantees do you have that he is complying with the law, with Canadian law, if you have no control over the technology? How can you reassure us, Mr. Aubut?

[Martin Aubut]

I can tell you that we have specifically asked MapJack, the third party, if they gathered any other information. They told us that they did not, because it was not their basic task. That was to take pictures.

We do not believe that they have the technology to gather data. Anyway, I have to wonder why they would, I cannot give you an ironclad guarantee that they—

[Mario Laframboise, Bloc, Argenteuil—Papineau—Mirabel, QC]

You do not know, because, as you said earlier, you are not familiar with their technology.

[Martin Aubut]

We know one thing at the moment. I am familiar with images and image gathering. The service we provide to our users is the images. I cannot tell you about other information that MapJack may have gathered in the same way as Google.

[Mario Laframboise, Bloc, Argenteuil—Papineau—Mirabel, QC]

That does not reassure us. You are not aware of the information you are transmitting and you are not aware of the technology that was used.

[Martin Aubut]

I know the technology that we use for our service. For us, MapJack is not about looking for information. MapJack lets you see a specific address, because you can see a picture of it. That is all we use it for.

[Mario Laframboise, Bloc, Argenteuil—Papineau—Mirabel, QC]

But MapJack still works for you. You gave them a contract to get images for you.

[Martin Aubut]

They give us images, and that's it.

[Mario Laframboise, Bloc, Argenteuil—Papineau—Mirabel, QC]

You give them the work. If they contravene the Access to Information Act when they capture the images, you know that you are also legally responsible.

Mr. Ramsay, you are a lawyer, I understand. Are you aware that you are responsible because you employed a subcontractor who could use the data for which you signed a contract?

[François Ramsay]

We are aware of that, of course. Just this morning, I asked one of Martin's colleagues to tell me a little about MapJack's technology and to compare it with Google's. He told me today that the technology was much less sophisticated, much less specialized than Google's or Microsoft's.

It is actually a “no frills” technology. That is perhaps an appropriate term to describe the kind of product that MapJack has developed. We got permission to use MapJack's technological know-how, if I may put it like that.

You are right. Like any of Yellow Pages Group's suppliers, they do things with us. We trust them when we have no reason to believe that they are telling us anything but the truth. Very sincerely, we have been very clear about the matter. We really did not believe that there had already been a problem like this. It was never brought to our attention when we were dealing with MapJack.

However, given the committee's work and given the questions that Google has been asked, we were proactive and we asked MapJack to provide us with the confirmation. They did so with no hesitation.

[The Chair, Liberal, Shawn Murphy]

Your time is up, Mr. Laframboise.

Mr. Albrecht, you have five minutes.

[Harold Albrecht, Conservative, Kitchener—Conestoga, ON]

Thank you, Mr. Chair.

I want to thank our guests for being here today and also our online guests for joining us.

I think it's important to take a step back and remember what got us into this study in the first place. It was the concern relating to Street View and the collection of images. But I think from my understanding of where we are at this point, we agree that it's a very useful tool and a worthwhile project. The privacy concerns that were initially at the forefront I think have largely been addressed, with the blurring of faces and licence plates and also the rapid removal of images upon the request of the users. I'm happy about that part.

As it relates to inadvertent data collection, I think all of us still have some concerns that this issue shouldn't have arisen, but I think Google has handled it in a very responsible way. We have legitimate concerns around this table, and I think all Canadians are concerned about the protection of their private information, but Google has, as I've said, taken positive steps to correct the mistake that was made. I, for one, appreciate that.

You've apologized for the error. You're taking concrete steps to ensure that this sort of situation doesn't reoccur. Also, as I understand it, you're working in close partnership with the Privacy Commissioner to be sure that you are in fact in compliance with Canadian law.

My question is to Dr. Whitten. It relates to the international aspect of privacy. Does Google have a privacy expert for each country? Or do the efforts of the privacy commissioners from the various countries, as they meet in their international conferences and work out some types of agreements across international boundaries, help you enough to create a level playing field so that there's not a need for an expert for each and every country?

[Dr. Alma Whitten]

Thank you for that question.

I would say it is really a combination of both. We do have local expertise on the ground in as many countries as possible--in fact, in most countries. I spoke to the earlier question from the member about the need to bring in all of these different kinds of expertise across legal and engineering functions.

We're also very conscious of that cross-culturally, and of the need for our privacy review to bring in perspectives from all of the different parts of the world where our products are going to be seen, used, and experienced. That's part of the reason why I am now based in Europe: to make sure that even in my own person I can bring in a little bit of extra balancing, having started out in the United States and then bringing that over there.

Canada is certainly one of the countries where we pay very, very close attention to the work of your Privacy Commissioner and to her voice on the international stage. We rely very heavily on Jacob's relationship and close communications with her office. We do similar things in all of the countries where we're present.

[Harold Albrecht, Conservative, Kitchener—Conestoga, ON]

Thank you for the response to that question.

Just to follow up with a very brief question, do you find that as the international privacy commissioners get together and discuss these issues, it is helpful for you as the overall director of Google's privacy concerns?

[Dr. Alma Whitten]

Very, very much so, and thank you for returning to that point. For us as an international company operating on a global scale, it's certainly tremendously helpful when the world state-of-protection authorities come together and attempt to work out a consensus on how to approach these matters. Because, of course, if we can do the right thing across all of our products and all of our services globally and have it be the same right thing, that obviously is tremendously helpful to innovation and also to our users.

[Harold Albrecht, Conservative, Kitchener—Conestoga, ON]

I do think that the proactive approach of preventing problems before they occur is certainly very worthwhile.

If I have another minute, I'd just like to ask Mr. Ramsay a question.

You indicated earlier that at this point you don't have specific privacy training. Do you, though, have any connection or regular contact with the Privacy Commissioner in terms of consulting with her and in terms of moving ahead with addressing the privacy concerns that affect us?

[François Ramsay]

Historically, we've not had these relationships. I have to tell you, though, that I've determined with some of my colleagues that this is something we'd be interested in exploring and being proactive about. We understand that as the world becomes more digital, obviously, many of these issues will come to the forefront. It's important for us to be on top of these matters and to be responsive and proactive on legitimate privacy concerns that Canadian institutions have.

[Harold Albrecht, Conservative, Kitchener—Conestoga, ON]

Okay. But to this point you don't have direct contact with the Privacy Commissioner?

[François Ramsay]

No.