Very good. Thank you, Mr. Chair.
My name is Jason Zushman and I am a lawyer practising law in Winnipeg, Manitoba.
Good afternoon, Mr. Chair and honourable members. I am humbled to be asked to speak with you this afternoon with regard to privacy and social media. I look forward to our discussion which will touch upon these important issues that affect the lives of so many Canadians.
It's become cool to share information about ourselves, and it's become cool to share a lot of information. On a daily basis Canadians share an overwhelming amount about their daily lives. By way of example, there are over 18.5 million Canadians on Facebook, around 55% of our population. That is a shocking number in comparison to what Facebook was even just a few years ago. Because of this broad reach, adequate legal protections are necessary for the benefit of all Canadians.
The technological world and the Internet have changed many aspects of our societal interaction. The sharing of information is immediate. There are many benefits from our ability to share information in such a broad fashion, but there are also dangers that are found in this rapid evolution where technological advent can outpace the ability of Parliament and the applicable law to keep up.
As we analyze the issues related to online privacy, we should note that threats to the privacy of information shared by Canadians are found not solely on what are commonly thought of as conventional social networking sites. Threats to personal information can be found in quasi-networking sites such as online gaming communities. Many of these sites are pay-for services that contain sensitive information. If these sites suffer a successful hack or breach, they can reveal critically confidential user information such as home addresses and credit card numbers to rogue individuals.
As the online presence of many users can be correlated with their names, phone numbers, emails, and passwords that are found on their profiles in the conventional social networking sphere, identity theft can become that much easier. Many users have identical passwords or other means of access that are duplicated throughout the existence of their online presence. A breach of one of these services can lead to a breach of all services that are used by these Canadians.
Specifically, I would like to comment with a view to privacy and social media aspects. I wish to share the following observations.
First, the provision of informed consent by the user is a necessity. That means when a user gives their consent to utilize the service, they must be asked to give consent throughout the entire process and for any subsequent evolution of that service or its terms of use. Users shouldn't be asked merely to provide their initial grant of consent to terms that could then be unilaterally modified by the service provider.
At times when a user submits information to a social networking service, they do so with the intent of limiting the release of their submitted information to a trusted circle. It can cause great harm and unexpected consequences when the information that those users share is subsequently treated in a different fashion than what that user had originally intended. When the terms of use are changed or subsequently modified by the service provider, that modification must require the fresh consent of the user prior to the change and the implementation of the new terms.
Many times the user is placed in a position where the modification of the terms is simply displayed in a pop-up window which may be given only a cursory inspection by the user and can be overshadowed by the user's desire to return to their social media experience. Users may not always be given a means by which they can continue to use their service ostensibly without their agreement to the newly modified terms.
All changes should be clearly communicated to the user, and users should be made aware of any substantial impact to their rights. It is paramount that users always be made aware of how the information they provide is used and retained and how steps can be taken that allow for its removal from the social media site. Further, users should be told exactly how their online habits are being tracked and how that collection of information that determines their psychographic, or we have seen recently with facial recognition software, their biometric makeup is harvested for purposes such as ad placement or other such uses.
Users should also be told to what degree this information is shared not only within the organization but also with the public and also how it is shared with any third parties for which certain uses of that information are not necessarily foreseen by the initial contract that the user enters into with the social media provider.
Second, I think we require more robust privacy laws. If breaches to personal information do occur, there should be laws that effect meaningful and substantive remedies. Powerful consequence-oriented law will deter an organization from engaging in an unauthorized practice in the first place. Further, such laws provide incentive for organizations to take preventive measures prior to the occurrence of a privacy breach, or any modification of terms that result in the unauthorized use or release of user information.
Any use, unilateral change, or subsequent modification of the terms that grant access to that user information, for which consent has not been provided, should have meaningful consequences. Misuse of information that is provided in good faith by users should not simply be calculated as a cost of doing business. It may be of benefit to consider laws that provide for quantification of damages that are in direct relation to the profit, or to multiples of profit, that the misuse of this user information has provided to the companies that are in play. To my mind, robust parliamentary solutions that enhance and shore up our privacy laws will go a long way to ensuring that the privacy of Canadians is truly acknowledged and respected.
There is a third point I'd like to discuss. I noticed that Mr. PĂ©ladeau spoke to rules regarding a contest, I believe, that was offered by Sleemans, and how it exported some of the potential legal protections that were available to, perhaps, law that was not applicable within the Canadian sphere.
Finally, I'd like to speak to the use of form selection clauses. As I previously discussed, most of the terms of service to which the consumer agrees to be bound are boilerplate or standard form contracts, and those contracts are crafted in the language of the issuer or the social media site. There is no real bargaining power on the part of the consumer to change or to modify the terms of these agreements.
As we engage in a lively debate about the potential change of law and the grant of powers to those who would be able to enforce consequences against those in the social media sphere that may not respect the privacy rights of Canadians, I would like to say to the committee that contained within many of the contracts of service offered by these social media sites are what we refer to in law as choice of law or form selection clauses. These clauses aren't necessarily easily understood by the consumer, but they are engineered to have a very practical and beneficial consequence by the draftsperson.
It is all fine and good to have a body of tort law and statutory codifications that place privacy in high regard and that protect Canadians, but this is all in vain when a dispute arises and Canadians are potentially told that the agreements they have entered into don't allow for the application of that same Canadian law. Instead, Canadians are told that their social media use or breaches of privacy that arise pursuant to that use, is instead governed by the laws of California or the laws of New York.
Pursuant to a form selection clause, our domestic law may be displaced and any available remedies are to be made subsequent to foreign law, a law that doesn't necessarily reflect the values and protections that we hold dear as Canadians. It is essential when organizations target Canadians and use their personal information with a view to profit, that meaningful consequences can be brought to bear if that same information is abused. It is essential that Canadians are protected by the laws that are enacted by Parliament so they can be assured that the societal legal norms that we have established are respected and enforced.
Many social media companies explicitly cater toward Canadians for their profit. They accept and they run local advertisements. They have head offices that are set up in Canada. They offer promotions and services that are tailored to our national experience. When these companies make the choice to conduct their business in Canada by catering to our local trades, they should be willing to similarly acknowledge and conform to the laws and consequence that exist within our jurisdiction.
I would like to recap the three primary points I'd like to stress from my observation for the committee's consideration.
The first would be informed consent for the user. That informed consent must be required not only for a user's initial grant of use, as related to their personal information, but also for the subsequent modification of terms that will affect the user's experience or the social media company's use of that personal information.
Second, I believe that privacy laws should become more robust. Effective consequences should be brought to bear in relation to damages in tort, common law, or other breaches of statute. Consequences should be strictly enforced to effect deterrence and to protect the privacy rights of all Canadians.
The third thing I'd like to stress is the jurisdictional aspect. An essential component of any parliamentary response to privacy law should displace the need for the legal test known as real and substantial connection, to establish a jurisdiction simpliciter, and to have jurisdiction over the subject matter to which Canadian law can be applied.
It should be made clear and unambiguous that companies choosing to do business in Canada will be bound by Canadian law. I believe this should be explicitly codified.
Thank you very much for the opportunity to appear before you today. I look forward to answering any questions you might have this afternoon.