Information & Ethics Committee on June 12th, 2012

[Blaine Calkins, Conservative, Wetaskiwin, AB]

No, no, I'm not a former employee of Oracle. I want to be clear: I was an Oracle database administrator.

[Prof. Ian Kerr]

I see.

In any event, you will be sensitive to the famous saying by Larry Ellison, the CEO of Oracle, in the early 2000s, shortly after 9/11, that you don't have to give up any privacy; all you have to do is give up your illusions of privacy.

[Voices]

Oh, oh!

[Prof. Ian Kerr]

He was trying to sell to the United States a database so that they could implement a national identification card using biometrics, which he would then manage.

So in that context alone, and in others, I'm very sympathetic to the concerns you raise. You draw correctly an important distinction between deactivation and deletion. We in Canada will have to think more carefully about even data retention policies, because the soft version of the right to be forgotten, the right to delete—

[Blaine Calkins, Conservative, Wetaskiwin, AB]

It used to be a matter of our not having the storage space to keep track of information, but now we're—

[Prof. Ian Kerr]

That's right. Storage is infinitely cheap. So it makes more sense, from a business proposition, to.... I take the same approach with my computer—

[The Chair, NDP, Pierre-Luc Dusseault]

I ask that you each provide a 30-second answer.

[Dr. Vincent Gautrais]

The issue when it comes to the right to forget and its application is that we face two principles recognized by the Constitution. We have to strike some sort of a balance between the two. Unfortunately, given this tendency to objectify the right to forget principle in a provision, we have more interpretation-related issues than solutions to contribute.

Once again, Europeans pounced on that principle. It cannot be applied in legal decisions. A judge could not objectify that.

[Prof. Avner Levin]

I don't think it's possible. Technologically, I think it's not possible to delete the information. We saw that just recently with that horrific video of the killing.

That's why my point in my submission was that you have to focus on how you're going to be able to use that information down the line. I think a lot of the concerns--not all of them, but a lot of them--could be addressed if you actually focused on regulating the proper use or the permissible use of that information.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

I will give the last question and answer period to Mr. Andrews.

[Scott Andrews, Liberal, Avalon, NL]

Thank you.

We have three great witnesses and only seven minutes each, in a committee that started late.

I think I'll try something a little different, Mr. Kerr, so let me ask you this. We've decided for this study to bring in the Googles, the Facebooks, and the Twitters at the end of our meetings, to listen to what we've heard. If you were sitting here, what questions would you ask of them?

[Prof. Ian Kerr]

It's difficult to be put on the spot to answer that question, but I speak with some of the people who work with them all the time. I think one of the questions you would do well to ask is the one Madame Borg asked me previously to try to get a better sense of what exactly happens with that information once it is in their possession. I think it's really important to understand the back end of the transactions that are taking place.

I think it's also useful and important to see if we can get a sense of where these major players see things going from their perspective. I'm not clear on how much of what kinds of things they'll want to disclose if they relate too closely to their business efforts, but let me give you a quick example. Facebook in the past year or so has put forward two applications, one called Open Graph and the other called Instant Personalization. In my mind, what Facebook is trying to do is create a social graph. By that I mean the same thing as Google Street View except with each of us. So in the same way that Google Street View can take individual snapshots of each car and each house and then have this amazing technology that can seamlessly weave them together, so too Facebook wants to do that with Timeline and some of its newer applications to stitch together the fabric of our lives in order to better understand us.

So it's not just points of data on a profile, but a seamlessly integrated digital version of ourselves. I would be very interested in hearing where they are trying to go with Instant Personalization, Open Graph, and the general goal of seeking to build a social graph around us.

So that's one question for Google and one for Facebook.

[Scott Andrews, Liberal, Avalon, NL]

Getting into that—because I know you did allude to it, and you wanted to come back to it when we talked about Facebook—they're going to come in and tell us everything is rosy. They are probably going to wine us and dine us with the graphs and the displays. But how do we get to the question of privacy settings? I know you mentioned you wanted to explain it, because I'm one of those Facebook users, and I remember seeing something about privacy come up at some point, but I'm too busy surfing Facebook and doing other things to go in and change those settings.

[Prof. Ian Kerr]

Let me tell you that you shouldn't feel too bad about yourself in that way. I recently was trying to articulate exactly how the defaults work on Facebook. I have talked about this for two years straight. I have students who live and breathe and consume the sugar of Facebook every moment, as do I, and I could not do that for you.

In order to articulate the current defaults for Facebook, we actually had to sign up a new identity and go through it from scratch, because in the past two years since I started talking about this issue, they have changed so many times which things default to friends only, which things are to friends and friends of friends, and which things are to the public. Those things are changing so frequently that I'm not surprised you haven't been able to do it. I haven't been able to do it either.

This is why I think we need some kind of a benchmark or an anchor. I think you should ask them exactly how they go about deciding whether to roll out these changes to the defaults and really what is going on there. I think you'll find what's going on there, if they answer honestly, is they want to collect more information, rather than less information. If the defaults stack towards giving them more information, they will do that. That's how they've engineered this whole thing. It just did an end run around everything our Privacy Commissioner had tried to do with them.

[Scott Andrews, Liberal, Avalon, NL]

I remember even when you sign up for Facebook it is pretty limited. It's just your name, and your birthday is actually important—and I need to ask you why that is—and then the more you get into it the more you divulge.

It gets back to your comments regarding the contracts and the “I agree”. I scroll down and I click “I agree”.

[Prof. Ian Kerr]

But you don't do that because you are irresponsible. You do that because you know it's on a take-it-or-leave-it basis, and if you're using Facebook you're clicking “I agree”. If you're not using Facebook and you're a university student at a law school, you no longer have access to everything that is going on in your world; you are an outcast.

[Scott Andrews, Liberal, Avalon, NL]

How do we get these agreements to be shorter and simpler and to require the onus to be on us as individuals to tick more of the things as “this is important” and “this is important”? And what number...? Instead of 100, is it five? Is it 50?

[Dr. Vincent Gautrais]

What is interesting is that the Facebook community has managed to get the Facebook contract changed, not regarding the confidentiality policy, but regarding the terms of use. Two years ago, Facebook changed the copyright clause, and several hundred thousand users said that we should be careful because that was bad. Facebook, which is very bright when it comes to marketing, said there was a problem and created this site that is still here today. I am talking about the “governance site”, and the elements it deals with include rights and obligations. That website was changed. The users were asked what they wanted Facebook to change in the contract, and an agreement was concluded between Facebook and the users, thus improving things.

Right now, it is impossible to influence Facebook when it comes to privacy issues. In fact, as my colleagues have pointed out, that is its fuel; it needs data to survive. It is impossible to get Facebook to change things when it comes to a contract that would.... A privacy policy, like the one Facebook has, could be written in half a page. That can be done, but they refuse to do it because they deliberately want to drown information in a lengthy policy, knowing that no one reads the damn contract.

Unfortunately, I don't think a Canadian piece of legislation will change that. I have more faith in some kind of international pressure. When I talked about informal standards, I was thinking about users themselves joining forces with international groups of all privacy commissions. Over the past two or three years, much stronger groups have been formed—and the Office of the Privacy Commissioner of Canada is part of them—which may try to influence a policy through negotiation in order to achieve a contract that is legible, reasonable, and half a page in length at the most.

[The Chair, NDP, Pierre-Luc Dusseault]

Unfortunately, the time is up, and I must interrupt you. I know that it is already 1 p.m. and we will have to adjourn the meeting very soon.

Just before we go, I would like to mention that, next Thursday, there will be no meeting, since we will likely be voting. If I have the permission, we will summon the witnesses who were supposed to appear on the 14th to come on June 21. Therefore, they will come on Thursday, June 21, instead of Thursday, June 14, since we will be voting. I think that this will work for everyone. We had nothing planned on Thursday, June 21. So that works for everyone.

On that note, I want to thank the witnesses for joining us today, although we did not have as much time as we would have liked. We may see each other again eventually. Thank you.

The meeting is adjourned.