Information & Ethics Committee on Nov. 6th, 2012

[Earl Dreeshen, Conservative, Red Deer, AB]

I think so. Part of it, though, was whether other companies are coming into Canada. Are we going to see them just sort of ignore us because we don't have the size? I think you more or less covered that.

We were talking about privacy policies. You do have a lawyer with you who is aware of how these things are written. I think you did touch on it a bit, but you are at the stage where you are going to be presenting sort of a new state-of-the-art policy because of the model you now have. I'm just wondering whether you have put any extra thought into that, or even if you have a bit of an addendum beside it so that you can say what the last five pages meant, and then the same thing for the other, just so that you have a balance. Maybe instead of one or the other you have something that shows a bit of a balance and that you are at least trying to help out those who actually try to read through the policies.

[Kevin Bartus]

Do you want to take that, Mark?

[Mark Hayes]

We haven't got to that stage yet. As Mr. Bartus said, he has just closed, and we've been essentially running around getting all of these arrangements made. We're going to look at the privacy policy over the next couple of weeks. Certainly, we're going to do our best to make sure that it explains to Nexopia's users what Nexopia does with its information, what options they've got, what alternatives there are. We're quite confident that we'll satisfy the Privacy Commissioner's recommendations and make it a place that's good for Canadian youth.

[Earl Dreeshen, Conservative, Red Deer, AB]

People have concerns about personal information being deleted, so I'm wondering if you would run us through what that process is, as far as a business is concerned. How do you guarantee that you are no longer keeping that on file? How would that happen?

[Kevin Bartus]

We've talked about this a bit. We believe there is a period of time—we think reasonably six months—during which you ought to be able to contact a previous user and say “Are you sure you want to leave?” That seems to be common practice, and that seems like a good business idea.

After about two years, they're gone; they're not coming back. At that point, I think it's reasonable to completely delete the data. From a business standpoint.... That's audited by checking and making sure that the person isn't actually there any more and making sure the data is truly gone.

I guess that's been mostly our approach, the six months, and the two-year window as far as permanent deletion.

[Mark Hayes]

Don't forget that the previous set-up was such that you deleted your profile, you went away for a day, you came back, and it was still there. So there wasn't a true delete. There wasn't a false delete; there wasn't any delete. That's certainly going to be fixed. That's a commitment the company has made.

[Kevin Bartus]

One clarification—

[The Chair, NDP, Pierre-Luc Dusseault]

Very quickly, please.

[Kevin Bartus]

One clarification I should make is that, as you've probably heard in the past, search engines—Google, Yahoo!—are cache things. They store them locally so that they can be called on more quickly. I don't know what their caching policy is or how long it lasts, but you can delete something and still have it being Googled for a period of several days or weeks. That's out of anybody's control but theirs. So that won't be covered in our policy. As long as a search engine caches, we can't do anything about it.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

I now yield the floor to Mr. Boulerice for five minutes.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you very much, Mr. Chair.

I want to thank our guests for joining us.

Your being here is very appreciated. I am also happy to hear you say that you are working with the Privacy Commissioner and that you mean to have a game plan for implementing the four recommendations that have not yet been carried out.

However, one issue piques my curiosity. It seems to me that certain things could be done more quickly. I understand that personal information can normally be deleted by clicking on the button “delete my account”, but I don't understand why I have to wait until April 31, 2013, for my account, personal information and profile to really be deleted.

[Kevin Bartus]

Again, I'm trying to be careful not to speak too much for the prior owners, but when that first communication happened in 2010, there was a serious list of problems and they had to be addressed. Any business owner goes through an analysis of whether to continue to invest or not to invest, or whatever they're going to do. By and large, the company completely stopped development at that point.

The code, I should mention—not that anybody cares but me—is in a language called Ruby, but it's not the Rails framework. It's basically custom code. So getting anybody to dig in and do anything is a challenge. What's happening right now is that two of the guys who originally coded and developed it are helping me out as I bring in new staff, but getting new people to understand this stuff is a genuine challenge. I think with anything in business, and I've done technology businesses for a while, you've got to pick your battles and you have to focus on something, so we've chosen to focus on the wording changes, the privacy policy. That seems like an easy place to start.

The deletion thing...look, if that had been easy to do, the previous owners would have done it; they wouldn't have sold the company. It's genuinely challenging to do.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

It is not only because having that information is practical. That information has value, even from a business perspective. So the idea was to keep the information as long as possible. When the commissioner said that you were breaking the law, one of the issues pointed out was the lack of valid consent for communicating personal information to advertisers. That is worth something. So it pays off to keep the information as long as possible. I hope you have resolved that issue.

[Kevin Bartus]

I am unaware of any business reason for keeping the data for a long period of time.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Earlier, you said that your website targeted young people from 16 to 21 years of age. However, according to our information, 34% of your users are between 13 and 18 years of age. So they are young people and minors who are exposed to a huge amount of advertisement.

I visited your website today. I saw that there was a great deal of advertisement, and that reminded me that, in Quebec, the Office de la protection du consommateur has worked with Club Penguin to reduce the exposure of our young people to reams and reams of advertisements.

Do you feel comfortable with exposing a bunch of minors to a huge amount of advertisement on your website?

[Kevin Bartus]

They're not exposed to more or less advertising than anybody else. As I think somebody mentioned before, the site has real costs and they need to be paid for.

You may have mentioned Club Penguin. I'm not sure if that's the Penguin you meant. If that's the one you meant, it's a paid service. We're not a paid service; we're a free service. Free services have to be paid for somehow.

We have the same age requirement that Facebook and many social networks have, which is to be 13 years old. It's self-reported, so you can't really verify some of that stuff. We could, I suppose, show less advertising based on your age, but I'm not sure that we want to go down that road.

Do you have anything to add?

[Mark Hayes]

No.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

That's okay. Thank you very much.

[The Chair, NDP, Pierre-Luc Dusseault]

Mr. Carmichael, you have the floor for five minutes.

[John Carmichael, Conservative, Don Valley West, ON]

That's not a lot of time. Thank you Chair.

Gentlemen, as I read through the profile of the company and listen to your testimony today, I'm curious about how long you had been negotiating for this company before your September 30 close?

[Kevin Bartus]

The detailed findings came out on March 30, so it's the period roughly from that date.

[John Carmichael, Conservative, Don Valley West, ON]

So it's from March 30 on.

[Kevin Bartus]

I would say since April.

[John Carmichael, Conservative, Don Valley West, ON]

Prior to that, or at about that time, the previous owners had been given the series of recommendations, some 13 of them, with a June 30 completion date.

I think, Mr. Bartus, you said that they became overwhelmed with the scale of what they had to accomplish with these recommendations. Am I correct on that?

[Kevin Bartus]

It's very difficult for me to speak for the previous owners. I have only met one of them.