Information & Ethics Committee on June 5th, 2012

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

Mrs. Davidson now has the floor for five minutes.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thanks very much, Mr. Chair.

Thank you very much to our witnesses for being with us this afternoon. As you can see, this is a subject that the committee is finding extremely interesting. It's certainly more involved the more people we hear from, so it's great to hear from the experts and those who certainly understand it a lot better than I do.

There have been a lot of different comments made here today, and I think I would like to ask Ms. Pettit the first question.

I know we talk about social media as being one of the greatest tools there is for researchers, and that it will become more important as we move forward and social media becomes much more the norm in many more circles than it is today. I agree with that, and I think we need to move forward, but I think we need to move forward in a way that is responsible and that is safe. I think that's the crux of what we're trying to determine.

I understand that you certainly do market research and that you don't sell articles, but as has been stated, the people you sell your research to do sell articles. We need to make sure the public is protected.

Now, one of the statements that I thought you made was that you weren't interested in seeing stricter rules that would hamper your collecting information in an “ethical” way, as you describe it, that what you're doing now you're doing in an ethical way, and that because of the rules that are in place, you're able to do that.

If the rules are changed, I think you indicated—or intimated, at any rate—that it would force you to collect information in another way that may not be quite as ethical. Could you...?

By the look on your face, I guess you didn't quite say that. Please elaborate on that and straighten me out on this issue.

[Annie Pettit]

Sure.

My intention, by my earlier remark, was to say that if I can't do it ethically, then I personally, in market research in Canada, won't be able to do the work.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

So nobody will be able to do—

[Annie Pettit]

In Canada—

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Okay.

[Annie Pettit]

But what will happen is that for other countries where they don't have the kinds of ethical standards that we do, off they go, they can do whatever they want, and their work will potentially harm, will be unethical, and will not be in the best service of Canadians, as it would have been if the work had been done by Canadians for Canadians.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Are there comparable rules now that are making it an even playing field, or are there still some discrepancies?

[Annie Pettit]

Well, there's ESOMAR in Europe, and there are CASRO and MRA in the U.S. I was on the committees for all of those social media research committees. We're all on board and all in the same place—which is that this kind of work needs to be done ethically—and we're all in the same place on what that ethical standard is and should be. A lot of other countries are looking towards those standards in terms of developing their own country-specific standards.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

So do you think we're continuing to be a leader, then, and not falling behind when it comes to the protection of personal privacy?

[Annie Pettit]

Currently I think we can do that. We just need to make sure that PIPEDA allows us to continue doing that, so that the work can stay in Canada and we can do it in an ethical way.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

So what are some of the things, then, that you would not want to see? What are some of the things that would prohibit you from continuing in your ethical practices?

[Annie Pettit]

Well, there are some definitions in terms of what public data is. If what people write on Twitter or on some social forums is determined to be private data, then basically this work cannot take place in Canada, and social media research will be moved to other countries.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Okay. Thank you.

Mr. Everson, in one of your replies, I believe, or one of your explanations, you talked about privacy safeguards for young people. I forget what kind of site you said it was, but you said that if somebody comes on who's a stranger to that site, it will shut down if they don't identify properly. What do you mean by “identify properly”? Who determines that? Also, how can you be assured that what someone is saying when they're identifying themselves is in fact anywhere near the truth? Can they not just make up anything they want and self-identify?

[Warren Everson]

In that particular case, I was citing a service called Hangout, which I think Google offers, which is actually a video conferencing facility. The users themselves determine who's in the club, and they hang out together. When someone else enters, the machine tells them that someone else has entered. If they can't verify who the new entrant is, the service shuts down. I mention it only as an illustration of the ingenuity of people who are trying to provide the service and also provide the protection.

I guess you'll hear from witnesses from all of these companies. I don't think anybody can deny that they have a high sensitivity to their names being tossed about in the context of carelessness about people's privacy, so my concern is not that the best operators do not want to do what's right and do what they can for their consumers. That's why I say that it's quite difficult to invent user rules that are one-size-fits-all rules.

One of the reasons why I've appreciated PIPEDA is that it causes the officers of Canada to examine every situation sort of uniquely against a measure of reasonableness, as opposed to saying that they have a defined lockdown and everybody has to fit this picture even though the technology is rendering it moot.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you. Unfortunately, your time is up, Mrs. Davidson.

Ms. Borg now has the floor for five minutes.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

I would like to go back to a couple of things. I wrote these questions down while you were answering others.

You said that your organization collects data. Do you subsequently destroy it? How do you do that?

[Annie Pettit]

It often happens like it does with traditional market research. It might be a tracking study that takes place every week or every month for the next year, two years, or three years, so we can track trends over time. In that case, the research data is held until that particular project is finished. If it's finished next year or the year after, then that project is closed and we no longer require that data.

In the meantime, another client may have picked up on that same type of project. I mentioned Nike earlier. Let's say that one client is using Nike data and they finish on one date. Another client may start using the Nike data and continue on. For a popular brand, that stretch of data may be continually closed and opened, closed and opened—it might be ongoing.

For a smaller research project, a one-time project, we use the data, and if nobody else is going to use it, then we no longer require it and we can get rid of it.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Everson, you mentioned the “do not track” service that has just started up in the United States. It is really quite recent.

I find it interesting because the initiative comes from the companies. I know that the Federal Trade Commission plays a role in it too. Could you tell us more about it? Is it a model that we should encourage in Canada?

[Warren Everson]

I think the committee is going to want people who are more technically profound than I am to answer this question. “Do not track” is a service that would be in a browser, which would prevent the lodging of cookies in your computer. Currently, when you identify yourself and you indicate your language of choice, and other things that you want the service to know, it will register that and lodge a cookie in your computer so that every time it comes to you, it says, “Oh yes, this is algorithm such-and-such, and these are the preferences.”

There can be a whole series of things that are pre-approved. “Do not track” would block the registering of cookies, so you would be a fresh face every time the website was opened or the service came to you, if it was a social service.

The different offerings are looking at that differently. I believe that one of the biggest recently announced that they would register that as a default setting, and a consumer would have to disable it in order to receive cookies that might facilitate transactions. Another big operator is currently indicating that they're not certain they want to do that, because they think the consumer prefers to have more facilitated service. So it's a really interesting debate.

To your point, there's a reason these companies are doing it and states are not ordering them to do it, and that has to do with the sensitivities around privacy. It's a healthy discussion to be having, and it's nice that they can invent a technology like this.

I'm not necessarily as concerned about it. I read the consent provisions carefully, so that's my defence.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Some experts have told us that the technology sometimes does not make sure that information is completely destroyed. In fact, the technology sometimes gathers data without the company knowing. Are there any members of your organization who are concerned about that or who have had the problem?

[Warren Everson]

I haven't heard of any of those concerns.

I can well imagine how that would occur, but if they're inadvertently collecting, then they're probably not turning around and abusing anybody's privacy by reselling or using that data. I haven't had that one.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

My next question goes to Ms. Pettit and Mr. Wycks.

We understand that you just observe. Do you observe people's online habits? Because of the cookies, do you know the websites that people go to when they buy shoes, for example? How about a 16-year-old looking for clothes? Do you observe that sort of thing too?

[Annie Pettit]

I don't have enough information to comment on that. I don't know.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Are you going to monitor online behaviour?