Information & Ethics Committee on June 5th, 2012

[Warren Everson]

Thank you for the question. It's pretty sweeping.

I guess the first thing I would urge the committee to do is to exactly understand how PIPEDA currently works, because some of what you're describing could be illegal in the existing act. I know you're going to hear from various carriers about specific high-profile incidents, such as ones you described.

I don't know of a more challenging issue for the committee than addressing the expectation of privacy in an online environment. I don't want to patronize anyone, but when I was growing up in Lancaster, Ontario, we had a general store. When you went into the general store, the vendor knew you and knew your buying habits. If you dramatically changed your buying habits, they would notice that, or perhaps they would say, “Oh, you're here, and I know you like this kind of stuff, so I got a new one. Do you want to have a look at it?”

We didn't consider that an unwarranted intrusion into our privacy. But when a company now contacts me and says, “I know you're interested in canoeing”, I would say, “Oh, how did you know that?” They know it because they have access to a lot of vendor sites in canoeing.

I think you've identified correctly the challenges. One is of consumer confidence. Consumer confidence goes both ways. We want to trust that we have enough privacy to do business online. We also want to trust that the company is using the information we have to prevent exactly the opposite side of your equation, which is the data breach.

I got a call last year asking, did I buy $12,000 worth of drywall on my credit card yesterday. No, I did not. I was very glad that they had my personal information and were able to contact me abruptly and stop that. So fraud protection is a very significant part of the online world as well. I don't know that you're going to find an exactly easy balance between those two pressures.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Wycks, I'm interested in this issue of—

[The Chair, NDP, Pierre-Luc Dusseault]

You can ask a quick question.

[Charlie Angus, NDP, Timmins—James Bay, ON]

—self-regulation and the support for administrative monetary penalties. Industry needs to be able to regulate itself if it's going to succeed, but there are going to be a few bad actors out there, and bad actors will damage your business model. So you support the idea of saying, for those few bad actors, that you support the Information and Privacy Commissioner's being able to hold them to account so that the rest of the industry can continue to develop. Is that your position?

[Brendan Wycks]

Yes, for those who violate PIPEDA.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Okay. Thank you.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you very much, Mr. Angus.

It is now Mr. Dreeshen's turn.

[Earl Dreeshen, Conservative, Red Deer, AB]

Thank you very much, Mr. Chair.

Thanks to you folks for being here today.

First of all, Mr. Everson, I want to commend the chambers of commerce, because they do some amazing work. You're able to get out and talk to businesses throughout the country and bring in information. Many of us depend on the information that you're able to present.

One of the things you mentioned when you were talking about PIPEDA was that the Canadian rules work and they're still relevant. Of course, this is what we're trying to do, and we're trying to take a look at some of the other things. We know there are critics out there, of course, and people who would like to see some significant changes, but in your commentary you talked about us not putting in excessive regulations for fear of losing jobs.

I'm just wondering if you could expand upon that. Also, of course, as this discussion is on social media, I'd hate to be accused of just having a time-killing question, so if you could answer that quickly, I do have a couple of others.

[Warren Everson]

I'll try not to be too long. I thank you for your comments about the chamber.

I think it's very apparent that PIPEDA was designed by people who understood that they didn't understand, and that they would not know where the technologies were going to go and where the offerings in the marketplace were going to go. They were wise enough to say that they couldn't be extremely doctrinaire as to how the law would apply and that they were going to have to see....

One of the important functions there was to establish the commissioner as an ombudsperson and not a police force. I'm always a little uncomfortable with people who want to make the officers of Parliament into regulators. They're not. It's a unique role they have.

If you want to install more police powers, you have to take it out of the parliamentary officers and into one of the departments of government, and I do think that you already have recourse in the law for a lot of the concerns that are expressed.

[Earl Dreeshen, Conservative, Red Deer, AB]

Thank you.

Ms. Pettit, you were talking about how you, in your organization and research, are not selling information, but is that evident to respondents upon your first contact? When you are talking to different groups or when you are going into different sites, it is evident to everyone that this is your role?

[Annie Pettit]

We do not enter sites for the purposes of engaging or communicating with people. We strictly observe—nothing more. That is what the essence of social media research is all about: listening only. There's no engagement.

[Earl Dreeshen, Conservative, Red Deer, AB]

Okay, but when you're researching information, then, from various companies, if you believe they're not acting appropriately or clearly, do you have any associative ability to interact with those companies to encourage them to change their practices? When you observe what is happening online and you see something that you have some concern about, do you have any clout that you can use in order to make them aware that they're off...?

[Annie Pettit]

In most cases they're actually very eager to know if something is happening that they should be made aware of. So when that does happen, they're on top of it, because they don't like it either, whatever that issue may be.

[Earl Dreeshen, Conservative, Red Deer, AB]

Okay. Thanks.

Again, with this particular study, do you have any suggestions about some specific aspects of privacy and social media that we should be looking at?

[Annie Pettit]

A lot of it comes down to respecting the different ways of communicating that people have. You were mentioning engagement. There's a lot of discussion on what is or isn't appropriate.

In terms of social media research, where we are simply listening, we don't engage. There needs to be some understanding that not everyone wants to engage, and that if they do, it needs to be up front, with permission. As we normally would do with traditional market research standards, there needs to be permission before you pursue anything any further.

[Earl Dreeshen, Conservative, Red Deer, AB]

Mr. Everson, on the same point, is there anything specific that you would like to see us studying when it comes to privacy and social media?

[Warren Everson]

I tend to be on the booster side. I think it's a fascinating industry, and I think Canada is doing extremely well. The kinds of services that are available to me now are tremendous, even just in the last few years.

I tend to think the committee's approach should be this: prove to me there's something wrong with our current form before I make any changes. I often hear comments about complexity and clarity for consumers. I believe the whole system is based on an informed consent. Around those questions I think you're in a very important area. It's not obvious what the simple solutions are. I think consent in all of the different constituencies of the public is extremely critical. That is the place you're going to end up spending much of your time.

[The Chair, NDP, Pierre-Luc Dusseault]

Your time is up, Mr. Dreeshen.

Mr. Boulerice, you have five minutes.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you, Mr. Chair.

My thanks to witnesses for sharing with us their opinions and practices and for giving us their vision of the issues involved in protecting people's privacy.

I was really struck by your presentations. I noticed that the level of concern was quite different from what we heard from witnesses last week. We had university researchers here to see us and we asked them questions. They were more concerned than you seem to be about the protection of privacy. We got the impression that Canada was dragging its heels little and was falling behind in terms of legislation protecting the privacy and the personal information of Canadians and Quebeckers.

Do you feel that the existing legislation is sufficient? Does it guarantee a balance between economic development, the protection of jobs and the protection of privacy? Is our country in a good position in that regard or are we behind others?

[Warren Everson]

So far, I would say Canada is doing very well. I mentioned the resolution of the chambers of commerce of Canada last year, which I will table with the committee, that said exactly that: there's a balance, but thus far PIPEDA seems to be meeting the needs of society.

I would say that in your position you should have people prove to you that there's a very serious problem that needs to be addressed before making dramatic changes. That's not in any way to say that the population doesn't need to be reminded constantly, especially as services evolve and change. It's their responsibility to watch out for their privacy, and they should take privacy seriously since this information is going to last for a long, long time.

[Brendan Wycks]

Our association is on the official record, through the most recent PIPEDA review, as supporting some greater powers for the Office of the Privacy Commissioner: mandatory breach notification and greater enforcement powers. We think PIPEDA, which is over a decade old now, has served the country well. It has put Canada in a good position. It just needs a few tweaks to bring it into the modern age.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you.

Don't get me wrong; I'm a big fan of social media. I use them; I'm not an addict, but it's close. For a politician these days, social media are an indispensable tool for reaching people and making them aware of various issues.

But still, social media's business model is based on the ability to gather information. Information is power, as they say. Some large organizations have a ton of information and data on millions of people. If information is power, couldn't some private organizations and large companies become too powerful at some point? Could that be a danger? Are people right to be concerned?

[Warren Everson]

I guess my perception is that the large companies have demonstrated quite a bit of sensitivity to concerns. They are aware that consumer concern about privacy is one of their most significant business issues.

You're going to see, over the next few months, an interesting discussion about a technology called “do not track”, which is a service that you can install. The different providers are all approaching this in a different way. One provider is going to make it the default; one provider is not; one hasn't decided yet. They're struggling with how to meet customer demand for privacy while simultaneously knowing that you and I and everyone else appreciate, without thinking about, a lot of the services we are provided.

I'm very glad that the credit card company was able to spot that it was unusual for me to buy $12,000 worth of drywall on a given afternoon. It didn't occur to me that it was a breach of my privacy, though I guess you could make that case.

I would address, instead, that the committee should not be preoccupied always with the monster companies at the top of the food chain. First of all, they won't always be at the top of the food chain. The next major innovation in the business might be fermenting away in the lower basement of someone's apartment right now.

Also, it's very difficult to make regulations in the environment of saying, “Well, this is a huge company and they can afford all this. They can afford notification and constant checking.” That can be a considerable constraint on smaller companies that are trying to evolve in the marketplace and cannot do that.

So it's very challenging for the committee to say that there's a solution that fits all.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you. Unfortunately, your time is up, Mr. Boulerice.

Do the other witnesses want to answer?

[Brendan Wycks]

As to whether the size of some of these large social media companies gives them too much power, I would just respond that, yes, data is power, and they are quite powerful, but that power is somewhat tenuous. They are vulnerable, because the power is rooted in consumers' confidence in them. If there were a major breach or some kind of thing that caused harm to a group of citizens, or even down to a single individual, and they suffered a lot of negative publicity and damage to their corporate reputation, I think they would be dramatically diminished quite quickly.