Information & Ethics Committee on Nov. 20th, 2012

[John Carmichael, Conservative, Don Valley West, ON]

Thank you, Chair.

Mr. Gupta, obviously we are into short timeframes now, so I'll try to be as tight as possible.

Canada's data protection legislation encourages companies to work with regulators to resolve consumer complaints as well as regulators' questions. In your view, would this change if the commission were given more power, more authority to regulate, to play hard ball given a transgression by a social media company?

[Karna Gupta]

When you ask for more power, we need to understand what that is.

[John Carmichael, Conservative, Don Valley West, ON]

It could be financial. It could be just expanding the suite of powers the commissioner has available to regulate the industry.

[Karna Gupta]

At this stage, most of our membership's comments about dealing with the Privacy Commissioner have been that they feel it is actually working well, because they are engaged. The Office of the Privacy Commissioner is quite engaged with the industry in regular conversation and dialogue as to what needs to happen.

[John Carmichael, Conservative, Don Valley West, ON]

Actually, we've heard contrary to that, that she doesn't have that cooperation necessarily from across the industry. It's one thing to respond to a complaint, but there doesn't seem to be a lot of cooperation to have that complaint resolved and enact a penalty. The concern is whether we need to provide her, as one avenue, with a bit more power in order to ensure that the envelope isn't so continually pushed. Then they apologize that we have to have a way the commissioner can in fact exact some degree of response from the companies.

[Karna Gupta]

It is possible. My suggestion and my response would be that it would probably be useful to have that dialogue with the actors around the table. Most of the credible organizations that are our members would be happy to sit down with the Privacy Commissioner to have the conversation, and if it's non-compliance, look for the ways that it may need to be resolved. If that includes disclosure, if that includes some other powers, that I'm sure will get accomplished.

[John Carmichael, Conservative, Don Valley West, ON]

There could be any number of resolutions to that. We're also conscious of not stifling growth and stifling industry, and the business opportunity as well.

I'm sorry, but in the interest of time I'd like to ask Mr. Landry a question. We've heard a lot about privacy issues relevant to social media companies and you've talked about it today, about multiple privacy policies within one company's site. I wonder whether you would support an automatic deletion or withdrawal from a site of one's information. Or do you believe that once an individual has provided their personal information to a social media environment, that's it, they're there ad infinitum?

[Dr. Normand Landry]

I'm not sure I understand the question clearly.

[John Carmichael, Conservative, Don Valley West, ON]

We talked to one major social media site which said that they are building in an automatic deletion. If you want out of that site and you want to recover your privacy, your personal information, you can push a button and over whatever period of time—I don't think it's that simple—that information will be deleted and you'll recover your information. To whatever degree it hasn't been distributed, you get to pull back what information you may feel is creating vulnerability for you.

[Dr. Normand Landry]

Currently, that is not entirely possible. The information shared on that platform also ends up in thousands of different accounts. It is very difficult to establish traceability. For instance, if someone posts a photograph online, and it is downloaded by 15 of their friends, it will be downloaded by other friends because of the network. That cannot be controlled.

However, there is a very clear database that contains the vast majority of our personal information. I think that database should be erasable upon every user's request. That is a matter of basic human dignity, especially when someone dies. That kind of an issue becomes very sensitive when a person is living with an incurable disease and no longer has control over the personal information shared online.

So I feel that the very existence of that possibility, that power given to the user, is a matter of basic human dignity.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you, Mr. Carmichael. Unfortunately, to ensure fairness, I have to interrupt you after five minutes.

[John Carmichael, Conservative, Don Valley West, ON]

I just got started.

[The Chair, NDP, Pierre-Luc Dusseault]

This may appear a bit sudden, but I now yield the floor to Mr. Boulerice, who has five minutes.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Your sense of fairness contributes to your great reputation, Mr. Chair.

I want to thank our two witnesses for their presentations and for being here. That's greatly appreciated.

Mr. Landry, I would like to understand your statements better. You said earlier that you ask companies to implement measures they should test to improve their privacy and consent policies.

Moreover, you are calling for a charter to which they would adhere. Are you telling us you want companies to self-regulate under a non-binding charter?

[Dr. Normand Landry]

I mostly wanted to say that I think corners should not be cut.

Notwithstanding the discourse of the industry—which has a very clear problem in terms of privacy protection—currently, our main concern in Canada is the lack of a national standards framework within which businesses would operate. We suggest establishing a set of very clear standards—with very clear parameters—which companies would have to meet.

In addition, companies would be asked to adopt effective measures. Those measures could be evaluated occasionally by Canadian public authorities, for instance, to determine whether those standards are being met. I don't see private stakeholders telling private companies how to organize the way they want to interact with their clients. A broad framework is required.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Mr. Gupta, we have some concerns about privacy and personal information protection in the social media world. Many witnesses have told us this area is problematic. On last May 29, for instance, Commissioner Stoddart told us that she had started worrying about the obvious contempt certain social media companies have shown for Canadian privacy laws.

Your comments lead me to believe that you think—and correct me if I am wrong—that this is simply the way things work in that sector and that, if we want to play the game, we cannot really change its rules.

Is that your position?

[Karna Gupta]

No, that's not what I'm saying. What I'm saying is that, first of all, this is an industry at a very early, nascent stage, and things that are unfolding and innovations that are taking place are happening very rapidly. Often we don't know what's going to happen tomorrow or in two weeks' time.

The best thing we should do is make sure the actors are engaged in the conversation to figure out what makes the most sense.

Based on what you know today, if you impose a set of very prescriptive regulations and restrictions, it will do more harm than good. It is important. I'm talking about mainstream, credible, organized business organizations. I'm not talking about a bell curve that includes the fringes on both sides. I'm talking about the organizations that are doing a respectful, good business with innovation in this area.

You need to engage them in collaboration. With the Privacy Commissioner, several rulings have come out, and in all of them the industries were part of it. They applauded them, and by and large they followed them.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you for clarifying.

Mr. Landry, are you suggesting a type of piecemeal confidentiality policy that would enable clients, consumers and citizens to select the information they authorize to be shared? For instance, if I am a fan of poutine, I may not want that information to be disclosed in order to avoid advertisements from poutine-serving restaurants appearing my Facebook page.

Could that type of selection be made?

[Dr. Normand Landry]

I will respond by saying I should not be answering that question—users should. In my presentation, I stressed the importance of giving users more of a voice so that we can hear them better. If that suggestion is clearly expressed by users, Canadian regulatory authorities will at least take note of it.

Currently, the issue is that many experts and people who have invested a lot in this sector are discussing privacy. The silent voices, those we do not hear, often belong to individual users. We need structures that help us hear their concerns and not the concerns of third parties who have an interest in the process.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Citizen Boulerice thanks you.

[The Chair, NDP, Pierre-Luc Dusseault]

I would also like to ask a question, really quickly. I don't often have an opportunity to do so. However, I will ask my question after Mr. Dreeshen is finished.

Mr. Dreeshen, you have five minutes.

[Earl Dreeshen, Conservative, Red Deer, AB]

Thank you very much, Mr. Chair.

Welcome to our guests.

We stated earlier how significant and important privacy is. Of course, there had been some discussion that consumers need to know there is a place where they can be protected and that their privacy can be protected.

Of course, we also talk about digital literacy. I happen to come from an era when phones had party lines, and I knew the ring for ours was two longs and a short, which wasn't really too far removed from Morse code. Nevertheless, we're looking at that type of generation gap.

You also made suggestions about the schools and how they are able to deal with these things. Until we come up with standards.... All the schools are doing it. It isn't a case of suggesting it doesn't occur now, but they're not really focused on any one particular area. I think it's important that we look at that, but also we should be able to use the commissioner's role as far as education is concerned to expand that.

I would hope that all the industry actors would get involved in that, as well as the academics, to give her the sort of information that would be important.

One of the other things that was mentioned is that we want Canada to be a destination for this particular type of industry. I believe it was mentioned that if the conditions are right, people are going to come here, so we have to make sure we get it right.

A discussion also took place on the digital strategy. I assume that industry and all people who are interested in this will be looking at a digital strategy that's going to promote innovation. We also have to look at this from a worldwide focus as well, the cultural citizen. We're a cultural citizen of where? Is it simply our own province, our own region, our country, or is it global? I think that's significant as well.

I was wondering if you could comment on the digital strategies that would promote innovation while still protecting the privacy as we see it and where we can get people working in this direction.

[Karna Gupta]

Thank you for your question.

I think a comprehensive digital society is probably at the very core of a lot of these issues. It's not only the social media; you're talking about e-commerce and you're talking about mobile technology. By and large, we are dealing in a global arena and fighting for resources to be successful. If I am building an industry or a company, I'm looking for a resource that can best deliver the product regardless of whether they're from Ontario, Quebec, or Hong Kong.

On the global scale, we want to make sure that we have the conditions right to attract the top talent from everywhere in the world, so that they look to Canada as a destination place. We need to be the country where these innovations are spurred. We need to be the country where these industries are built if we want to build a knowledge-based economy.

To create those conditions, we need to have the framework that supports all of the pieces. Privacy and the social media is only one aspect of it. The other aspects are equally important. We need to have the appropriate intellectual property regime. We need to have appropriate taxation policies. We need to have proper education standards. All of these dots need to be connected. When we look at a digital strategy, these are all part of the conditions. We cannot just optimize on one. All of them need to be dealt with, and that's what industry is looking for.

One of the things we need to understand as we build in this world is that, fundamentally, the biggest part is the education. We all need to understand that if we put something online it is not always private. All communication is not always private. There is a separation of data that, as the professor mentioned, certain things are completely private offline, but anything you put online in terms of communication is not always private. It's online and it has a longevity much beyond what we're looking at.

[Earl Dreeshen, Conservative, Red Deer, AB]

May I have your comments, Mr. Landry?