Information & Ethics Committee on Nov. 20th, 2012

[The Chair, NDP, Pierre-Luc Dusseault]

I will now give the floor to Mr. Andrews. You also have seven minutes.

[Scott Andrews, Liberal, Avalon, NL]

Thank you, Mr. Chair.

Thank you to our witnesses for coming in today.

I have two questions for Mr. Gupta and one for Mr. Landry.

Mr. Gupta, when you talked about innovation, you talked about the spinoff benefits. Could you elaborate on that and give us some Canadian examples of the spinoff benefits? Do you have a dollar value for what you think these spinoff benefits are? Do you have any research in that area?

I'd like you to elaborate on these spinoff benefits when it comes to innovation.

[Karna Gupta]

There was a tradition, probably about three years ago, when a lot of the software development work went to India, Malaysia, and Indonesia, for labour reasons and other reasons. Nowadays, as the investors start looking at solving some of the problems, they often use what is known as crowd sourcing. They put it in the open world in terms of somebody telling them how to solve this problem. That becomes part of the innovation cycle for most of these young start-up companies in Canada. Pretty much in any sector in Canada, they use what is known as crowd sourcing to solve their problems.

I'll take it one step further. This really started in earnest probably in Massachusetts and California. It's called crowd funding. It's now come north and to the rest of the world.

You know about the issues with VC funding in Canada. Most of the start-ups in any of your constituencies are crying for venture capital funding to survive. A lot of the time they are surviving because individual investors come in with smaller amounts of money. I sit on some of the boards of these small companies, and they are raising funding from individuals. It is done with a crowd-funding model. They go out and indicate that this is the type of problem they are trying to solve for society or the business or in general in the market and ask if anybody is willing to invest money in this and come with them on this journey. The investment amounts could be somewhere between $100 to $10,000, depending on where you fall.

Today these two are the lifeblood of Canadian business in the start-up community. Just in Ontario, there are 14 regional innovation centres. If you go to any of the regional innovation centres, whether it be MaRS, ventureLAB, or Communitech,crowd sourcing and crowd funding are the topics that come up all the time. This is a true input into our economy in terms of creating jobs, starting new innovation, and starting new companies. One of these days, these companies will grow into bigger companies. This has a real, measurable impact.

Your second question was whether we know by dollar amount what this open-market model, using social media and reaching out to the market may look like. I don't know. It could be massive. The size of the worldwide market just for the data analytics, all of the research and that side of the business, is a very large number. It is approaching, as I mentioned in my opening comments, somewhere between $15 billion and $20 billion over three to four years. That's the size.

If we want to play in the digital world, and if we want to be a knowledge-based economy rather than just a natural resources based economy, we need to play in that world and have all of the tools available to support that. I cannot give you a number as to how big the impact of social media or open platforms like that would be on the economy.

[Scott Andrews, Liberal, Avalon, NL]

My second question for you is about smart regulations. It's something that we've talked about at this committee.

Do we regulate? What do we regulate? How much do we regulate? If you were to advise us to do any regulation, what would be the number one priority for you for a regulation when it comes to this?

[Karna Gupta]

On this specific topic, I believe, from a regulatory point of view, what we have is probably sufficient. The tools are needed for the Privacy Commissioner at this point to go out and establish the framework with the industry, the academics, and the community at large, as to how it works. I'm kind of afraid to say what should be the regulation because it becomes too quickly a prescriptive model when we're at a very early stage of a new economy unfolding in front of our eyes.

Any kind of pre-emptive regulatory process could make it actually hard for a business to grow. I'm just coming from a business point of view, how they'll react. It would be very hard to deal with it. Smart regulation in this sense is really to deal with it as things unfold, establishing the right framework to deal with it on an ongoing basis.

[Scott Andrews, Liberal, Avalon, NL]

As long as the commissioner has the tools to do that.

Would you put any enforcement in with her tools? Currently there are no real fines or those types of enforcements.

[Karna Gupta]

I think the tools that are there are pretty reasonable. If I was a credible business and the Privacy Commissioner went out to the market and said that I did not comply—and I think we as an association were on paper committing during a peer period discussion that we wanted disclosures to be done. If I was a company, and I was disclosed to be non-compliant, that's a tremendous penalty to the company, in terms of economics, loss of customers, market share, reputation, goodwill, you name it. It all goes down. There is a tremendous amount of impact to the companies for non-compliance.

At the same time, you want the companies to be engaged in a conversation with the Privacy Commissioner on an ongoing basis to build what is needed, given that the technology and innovation is moving very, very fast. That conversation needs to be always ongoing on a regular basis.

That's the input we have from our members. I think it kind of works well at this stage.

[Scott Andrews, Liberal, Avalon, NL]

Mr. Landry, in your conversation with Mr. Mayes, you talked about a dialogue for conflict resolution between the individual and the owners. It's nice to be able to have that kind of conflict resolution, but how do we ensure that this actually happens? Is there any way that we can demand, regulate, or have that conflict resolution? I'm not confident I follow exactly how that conflict resolution would actually occur.

[The Chair, NDP, Pierre-Luc Dusseault]

I'll give you about 30 seconds to answer the question.

[Dr. Normand Landry]

The first point would be to have very clear incentives from Canadian public authorities so that the large operators of social media sites who do business in Canada develop this mechanism on their own. You let sites and the businesses that operate these sites determine the mechanisms they want to put in place based on their experiences, their products and their business culture in order to have the best input possible.

The idea of this type of mechanism will be a trial and error process. We don't have a choice. It will probably be a trial and error process. If it works well, it will lighten things up for the courts and will enable a more constructive dialogue. If it doesn't work, we will see that, meaning, that the complaints and concerns we have currently will continue.

I would also like to raise a very important point. Canadians are currently very concerned about their right to privacy. That's a fact. In survey after survey, Canadians are telling us that they are particularly concerned about the current trend in the digital world. They are also indicating that they have very little trust in the confidentiality policies of the major social media sites.

The rules do not currently work adequately. What we are seeing when there are solutions that go before the courts is that a very heavy burden rests on the shoulders of a few individuals who have the skills, resources or desire to set a precedent. That's not how you manage a large-scale problem. Our solution, which is to create a privacy charter that all big operators of social media sites should comply with, would include a formal commitment on the part of the big operators of social media sites to develop and put in place such procedures. They would have to determine how they would do it. The idea would be that there would at least be an initial step so that we would move away from a dynamic of confrontation and opposition to one that involves productive dialogue.

I don't know if that answers your question.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you. Unfortunately, time is up, but we will be able to come back to that.

Ms. Davidson, you have the floor for seven minutes.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you very much, Mr. Chair, and my thanks to our presenters this afternoon. Both your perspectives on this are interesting.

Mr. Gupta, you talked about digital literacy and its importance. You talked about the generation gap, and there definitely is one. I'm not sure how we overcome that in a timely fashion. I think it's something that will evolve, but there will be some concerns and perhaps some damage done in the meantime.

One thing you said was that our Privacy Commissioner has a good education program for companies, but you thought that ITAC could be leveraged to assist in this. Is that happening now? Is ITAC being leveraged?

[Karna Gupta]

No, not today. The way we see it, it is a big part of the broader ecosystem. We believe that the message and the education needs to be pretty deep in all parts of the country and in every sector. We're going to be talking to the Privacy Commissioner's office. We are proposing a very broad-based membership. We do events and meet with businesses in all parts of the country. If ITAC can be leveraged as an association organization, we would be more than happy to be the portal to get the information and education out. If you want a broad-based approach, one of the ways would be to use ITAC as a portal, whether it's in a digital world or a real world part of the process, to get the message out.

For example, we're working with EDC, a very credible organization that helps a lot of the young companies. Their services are still not reaching the small companies that need support. We approached EDC about using ITAC as a portal to get their message out, and we're in the process of negotiating how to do that. As an association of the private sector, we feel the private sector needs to take the ownership to get the educational message out.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Do you have any recommendations for SMEs in regard to making easily understandable privacy policies? We've heard over and over again that you need to be a Philadelphia lawyer to understand these privacy policies. Do you have any suggestions?

[Karna Gupta]

I think the point is valid. This needs to be written up in plain English rather than in legalese. In addition, it needs to be distributed as almost a code of business for businesses that are part of the ICT community.

That information could be disseminated through ITAC and other organizations. For example, there is the Canadian Manufacturers & Exporters and the Canadian Marketing Association. Several associations across Canada could collaborate to get the message out, and it needs to be simple to understand. People going into it should be able to easily understand what the ground rules are, what they need to comply with, and how they move forward. They're looking for clarity, but most people don't know what it really means.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Mr. Landry, you talked about the vulnerability of minors to marketers, and you talked about the explosion in the collection of personal information, with people not knowing who it's going to be used by, and the third party acceptance or denial. Can you talk a bit more about that, where you feel we are on that and what we can do to improve this situation?

[Dr. Normand Landry]

With pleasure.

We feel the main problem is that there are so many policies on the confidentiality of personal information, sometimes on the same social media site and among platforms.

Within a single site, like Facebook, dozens and dozens of different applications are offered. When you register for each of those applications, there is a confidentiality policy that you must agree to. When you have 15 or 20 of those applications, it is almost impossible for the average user to be able to specifically control access by third parties to their information. That creates a volume of confidentiality policies that is simply untenable for the average user.

Add to that the fact that the average user often has a number of accounts on different sites. Each site has its own general confidentiality policy. Each of those sites also has third parties, such as game developers or marketing companies, that do business with them. You very quickly reach a volume that is simply unreasonable. It's unreasonable to expect that a user who is required to add more and more contractual agreements is a master, with full knowledge, of the decisions that are made with respect to personal information.

If you take for granted the fact that very young children have access to these sites and use them and that these sites take them in when they don't have the training, resources, or skills necessary to pay attention to the information provided, you end up in a situation where the exercise of real control is just wishful thinking. Pushing this on the user, saying that it is the user's duty to take responsibility overlooks a policy economy of personal information that, among other things, operates on this generalized confusion on the part of the user.

Furthermore, the issue of privacy for children is particularly serious. We are suggesting a national, pan-Canadian policy. It would also include a very clear component on critical media education, particularly digital media. It would be in the school curriculum, and children would be required to develop skills at a young age and early in their schooling.

You know, there are two ways to see the problem currently. We can see the users of social media as consumers who want access to services, or we can see them as citizens. We can also see them as both. In the end, the final question, the question you are going to deal with, is which of the two you want to make a priority.

Is your priority a group of consumers who have individual rights, or is it creating a body of citizens who are informed about their privacy?

The two aren't incompatible, but they are both fundamentally under stress. It will be important to make a choice.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you for your answer. Unfortunately, your time is up.

Mr. Angus now has the floor for five minutes.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Mr. Chair.

Thank you both for coming.

In 2004 Laurier LaPierre produced a very interesting report called “Canadian Culture Online: A Charter for the Cultural Citizen Online”. Mr. LaPierre was trying to respond to what was seen as the big issue of the time, which was how the traditional cultural industries were going to find their place on the worldwide web, as it was called then. Nothing was really done with that report, but I thought that the idea of a cultural citizen was a really important concept, the role of a cultural citizen and the rights of a cultural citizen.

Mr. Landry, you talked about this charter of privacy. What do you see that this charter would do? How would it be built around the concept of an online citizen?

[Dr. Normand Landry]

Thank you for your question.

The first thing the charter would do is create expectations. I think the industry would like that. Very clear expectations would be created for the industry, along with a framework establishing parameters for what we consider to be normal and usual privacy protection rules in Canada.

Basically, expectations would be created in three highly specific areas. First, clarifications would be made to the procedures for collecting, processing and analyzing social media users' data. The current problem is a lack of transparency. Users don't know what is being collected, where that information is going and what kind of control they can have over that data.

Second, as I already mentioned, we would also need ways to allow users to participate in the discussion process on privacy issues. Our approach would include much broader participation. A charter would aim to achieve not only greater transparency, but also greater inclusion in the decision-making process.

Finally, the charter would provide specifically for companies' commitment to co-operate with the Canadian Parliament, provincial parliaments and various federal and provincial privacy protection organizations. Once those commitments have been made, we would establish a relatively consistent normative framework for the whole country. Businesses would thrive within a clear and specific framework.

I disagree with the theory that giving businesses greater responsibility will scare them off. Doing business in the digital world and social media in Canada is currently very profitable. I am not at all worried when it comes to that.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you for that.

I am interested in how you say we can look at users as consumers, or we can look at users as citizens, but something that has certainly been an eye-opener for us is that users are the product. They're what's being marketed. The more users you have, the more you can market, so there's a value to the person.

When I meet with young people, they are very concerned about privacy. They are very aware of the issues. They're just not sure where they fit into this universe that they have basically grown up in where they are using a platform that has been phenomenal for growth but they're also the product on the platform.

Without becoming too encumbering of the process and to allow this incredible revolution to continue, how do we reassure people that when they're on there, if they choose not to be a product, they're not going to be a product?

[Dr. Normand Landry]

My answer has two parts.

The first is transparency. I urge you, please, to reread Facebook's privacy policy. Reading that policy will not provide you with any answers to the most difficult questions we are currently facing. So there is a problem with transparency. Social media site operators should review the ways in which they communicate their business model to their users and review the use of the data they collect.

The other part—and we both agree when it comes to this—is that we will need an investment in a national strategy for citizen education on media and digital media. We need that strategy as quickly as possible, along with considerable resources and a vision of where we want Canada to be as a high-tech society in 10, 15 or 20 years.

I think these are the two most important aspects.

[The Chair, NDP, Pierre-Luc Dusseault]

Unfortunately, Mr. Angus, your time is up.

[Charlie Angus, NDP, Timmins—James Bay, ON]

I was just getting started.

[The Chair, NDP, Pierre-Luc Dusseault]

You may be able to continue later, but for the time being, we move to Mr. Carmichael for five minutes.