Thank you, Mr. Chair.
Thank you very much for the invitation.
The clerk was kind enough to circulate a brief, but in the interest of time I will just leave it with you and take that brief as more of a departure point.
I would say that main point that our written submission presents is disturbing. People say that they care about privacy, but they are not really prepared to take individual action when you make the tools available to them. To that extent, some companies have taken positive steps by allowing users, whether it's Facebook or Google, to see what's available to them individually, but we see the same kind of disturbing pattern.
At the same time, the disturbing pattern is, I believe, a call to regulatory action. I don't see any reason why I should discount people's deep interest and respect for the rights of privacy and favour that less than perhaps their desire to take or not take action.
So we have valid concerns around privacy and we have individual action that is not at the same level. What does that all require? In my opinion, it requires some kind of action.
Now, when I thought about that proposed course of action would be, my thoughts were these. You've heard very eloquently from Professor Kerr and others about how PIPEDA should be reformed, about the amendments and how they have so far failed to be on schedule, etc. In my opinion, the regular amendments won't actually help that much when it comes to privacy in social media.
I think it's because—if you'll allow me a short segue—we have larger problems regarding social media and privacy than the ones that just come through with the online advertising and the monetizing of personal information, which is a significant problem, no doubt. There is a notion that is very relevant to social privacy, and it's the notion of network or contextual privacy, which I want to talk very briefly about.
This makes us aware of another puzzle. We all know that people say they care about privacy, yet they post a lot of information about themselves on social media. It's always difficult for people to square that. How is that possible? Why don't people realize what they're doing? Don't they understand that it's public, etc.?
The key to understanding that is to understand that people, when they share information or they post information, don't actually think about how many people potentially have access to the information; they are really focused on who has access to that information at that point in time.
That is the way that people actually behave in the real world. That is not unique to online. That is how we behave in our daily lives.
I'm here to you presenting in my role as an academic, but I also have other aspects to my life that you may or may not be aware of. For some of it, you can perhaps Google me. If I were on Facebook, you could probably get a lot of information about me there. But in regular life, you may not know, for example, that I have two daughters. You many not know anything about my family status, and you may not know, for example, about my religion, that I'm Jewish.
We in our regular life have the ability to keep our identity and our information directed at particular audiences as we see fit. What happens with social media is that it takes away that power from us to do that.
That is the basic issue we need to confront. We have real boundaries in the real world, and the boundaries are being blurred in the online environment. It harms our privacy, and more fundamentally it harms I guess our sense of identity, especially with young individuals and how that identity is developed, their potential career paths, and many other issues that relate to the ability to keep information segregated.
I want to point out to members of the committee, although perhaps you're aware already, that under the Privacy Commissioner's interpretation of PIPEDA, all of this problem is not commercial information-related, and therefore not to be addressed under PIPEDA. When the Privacy Commissioner did her Facebook findings in 2009, this kind of use of information that crosses perhaps from one user to another was not deemed to be commercial.
There's a question you have to ask yourself, then, when you think about Facebook and other social media; that is, what is it? Is it a social network for people to socialize on, or is it a database in which information is collected? I would say that in this day and age it's probably both, and what the committee needs to remember is that you cannot focus on one and forget the other. You need to worry about both of them.
How do you do that? I would say that you probably have to do some fairly radical changes to the privacy legislation model that we have now and that has been in existence for 30 years in other countries and, in one form or another, since the mid-nineties in Canada.
I would say that it probably would be a mistake to sort of.... Or perhaps we have to accept as inevitable that the collection of personal information and the disclosure of personal information are pretty much a fact of life and are here to stay in the current social media environment. What we need to focus on, I suggest, is how that information is used, what forms of use are permissible, and what forms of use should not be permissible.
The analogy I would present to you would be the analogy of the prohibited grounds for discrimination you are familiar with from the charter and right down to the provincial and Canadian human rights codes. If you remember, there's information there that is readily available to people when they want to make an employment or housing decision—for example, information such as a person's colour, age, sex, and disability or not—but we have laws that do not permit action on such information. We have to come to grips with the notion that online information may be available and how we then are going to allow or not allow the information to be used.
I would say, of course, that not all the information that originates online or in social media should be prohibited. I can give you, for example, a suggestion that if the information indicates some kind of criminal conduct, perhaps we would want that use to be permitted. But I would suggest to you that if the information that is coming online has to do with somebody's private life, for example, such as their religion, their family, their disability, or anything else, we should not allow people to use that information. When I say “people”, I mean that advertisers should not be allowed to use that information, potential employers should not be allowed to use that information, app developers should not be allowed to use that information, and so on and so forth.
My suggestion to the committee is to really consider—because of the situation Canada is in, where there hasn't been a major substantive amendment to PIPEDA over the last few years—that the problems social media present are much more serious, I will say, for privacy and people's sense of identity than just the focus on the collection of information. We really have to think and be forward-looking in order to create some legislation that would withstand the test of time, for at least the beginning of the 21st century, let's say, and to focus on what permissible use of that information would look like and what are the rules and constraints that we want to do around that. That would be a suggestion I would make to the committee, and I would welcome any questions or further discussion on it, if we have time for questions.
Thank you very much.