Information & Ethics Committee on Nov. 27th, 2012

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I am a Facebook user, and I find it very useful for being in contact with my constituents. I chose a public profile because I am a public figure.

Let's say I want to choose something more limited, that I only want Mr. Boulerice to have access to what I am going to put on my wall because he's my friend. Can I do the same thing, for example, with respect to the websites, the applications? Can I choose a closed circle? It seems to me to be a little contradictory that I can choose who of my friends will have access to it, but not which of the big companies will have access to it.

[Robert Sherman]

That's an important point. I think the relationship you have with your friends is different from what Facebook has with service providers and other kinds of entities with which we interact. We do provide controls in many cases. For example, we have application controls that let you choose the circumstances under which applications and websites can get access to your information.

You may be in a situation where you would like your friends to see information but would like only certain apps to see it. Those are things we enable you to chose on an app-by-app basis.

When I say “apps” I am really referring to mobile applications and also web-based applications.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

With respect to advertisers, can I choose who will get my information? If, for example, I absolutely do not want someone to know my music preferences and which bands I like, can I say that my information and my consumer profile cannot be disclosed to that person or company?

[Robert Sherman]

With regard to your music interests, for example, we allow advertisers to make a judgment that they want to show advertisements to people who like a particular type of music. In those instances we may show the advertisement; we may identify that you like that music because you have told us on your timeline, but we won't then tell the advertisers “this particular person likes this kind of music” unless you have chosen to make that information public.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

Unfortunately, your time is up, Ms. Borg.

Mr. Calkins has the floor for five minutes.

[Blaine Calkins, Conservative, Wetaskiwin, AB]

Thank you, Chair. I very much appreciate it.

Thank you, Mr. Sherman, for being here today. We've had a really good study in regard to this particular issue. I don't expect that you've made any efforts to follow along with the lines of questioning, but I think you are getting a sense of where we are with our committee.

Essentially our Privacy Commissioner is looking for expanded powers and authorities in order to deal with some of these particular issues. I am just wondering how you would feel about that.

I apologize if I am asking you a question that has already been asked. I had some urgent business that I had to attend to earlier.

Could you tell us about the relationship Facebook has with...or do you have a relationship with the Canadian Privacy Commissioner?

[Robert Sherman]

We do have a relationship with the Canadian Privacy Commissioner. In fact, we find that relationship to be very productive and positive. We're able to talk with them about decisions that we make from a privacy standpoint and get their feedback, which I think helps us make a better product and helps us better protect the privacy of Canadians.

I think when you look back at the relationship that we've had with the Privacy Commissioner's office over the years, you see that many of the innovations that we've had are on privacy. Many of the things that are hallmarks of the way privacy works on Facebook came out of those consultations, so I think it's been an incredibly positive relationship.

I'm not an expert on Canadian privacy, but I'm familiar with the study, and I should say that I appreciate, and Facebook appreciates, the work the committee is doing to study these issues.

With regard to the question of whether the Privacy Commissioner's power needs to be expanded, I think my sense is that if you look at a company like Facebook, we're a good example of the fact that the existing regime works quite well. We've had consultations with the Privacy Commissioner on an ongoing basis and we've made changes to our product, in fact, in response to her feedback. We've made those judgments based on the fact that the Privacy Commissioner has suggested ways that we can better protect the privacy of Canadians.

I think those are things that, if you were designing a privacy regulatory regime, would be the outcome that you would seek to create.

[Blaine Calkins, Conservative, Wetaskiwin, AB]

I appreciate that.

I'm going through the information on your sign-up page. I've never directly, personally, used Facebook. I think I've had, through some work that I've done, a page or a place that folks can visit through some outreach that I'm trying to do, and it works quite well in that respect.

I do have some questions for you that I've asked others in the past insofar as deleting and deactivating information goes. Apparently Facebook, when I read through here, seems to have the ability to and can clearly differentiate between deleting and deactivating, which I think is very important.

People post a lot of personal information on Facebook. I mean, that's what it's all about. That's the raison d'être of the site. What assurances can you give to me and to this committee that when they want to have that information pulled down from the site and to deactivate or delete their account, that this information is actually deleted, if the users do choose to delete that? How far does that go insofar as going into your backups, going into any information that might have been collected or disseminated for either reuse or for marketing purposes?

[Robert Sherman]

We think user control, user trust, is an essential part of the Facebook experience, and it's an issue that we spend a lot of time thinking about. We understand that people won't feel comfortable using our site if they don't trust us, so we want to do everything we can to be transparent about how Facebook works and how people can have control over their data.

So when you use the deletion function, whether it's the account deletion function or just the function to delete a particular piece of content, that starts what we call an “active deletion” process, where it removes it immediately from accessibility on the site from our active servers. It then goes to the various places and backups and things like that in alternative servers, where we keep the information, and sends the command to those servers that indicates that the information should be deleted.

That process takes a bit of time, because we do have backups and so on, but we do try to have a process in place to make sure that information is deleted in a way that's reasonable and consistent with the instructions we receive from users.

You mentioned deactivation, and I do want to distinguish between deactivation and deletion. Deactivation is not a situation in which a user requests deletion of their information. We actually just suspend their account, but maintain it.

[Blaine Calkins, Conservative, Wetaskiwin, AB]

No, absolutely; the information is there so it can be reactivated in the event that a user wants to. I understand the practicality of that. I'm just worried that some consumers might think they're actually deleting something when in fact an account is deactivated.

The question I want to ask you right now is this. I don't know if you have any survey information. Obviously, when I look at the site, and it's very typical of what most sites are, it says, “By clicking Sign Up, you agree to our Terms and that you have read our Data Use Policy, including our Cookie Use.” That's what it says on the page that I have open here in front of me. The terms that you have are 19 clauses long, and it's written largely in legal jargon. That's fine; it's a binding agreement. Your data use policy is quite broad and would take an educated reader or user quite some time to read and discern, particularly the part about cookie use. For those who aren't very familiar—even though the younger generation has grown up with computers, I didn't have that luxury, but I've figured it out since—all of that is a single yes-or-no agreement by the end user who wants to use your product.

First of all, how many people do you think will actually read all of that before they click on it? Do you have any indication from your users of how many of them actually have done so, even though they're responsible to do so?

As well, would you ever give any thought to having a situation whereby a user would have options to agree to certain terms and certain conditions and give them the option, depending on their feedback, of tailoring your site and the services that you offer to them, based on their preferred level of user interaction and user interface with your company?

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you. I will give the witness about 30 seconds or a minute to answer your question.

[Robert Sherman]

Thank you very much.

I think with regard to all of these tools, we try to be transparent with users and provide them with information. We hope they are written in a way that's reasonably easy to understand, and we've received feedback from people in a number of different ways that they are able to understand it.

We try to present the data use policy in what we call a layered format. Essentially what that means is if you go to our privacy page, you can get the high-level information and drill down if you want to do that. With regard to cookies specifically, which you mentioned, one of the pieces of information we provide to people is a special “frequently asked questions” about cookies, which is written in plain English and includes detailed information about how we use cookies and the purposes for which we use them.

So we try to make that information accessible. I don't have statistics on how many people read it or don't read it, but we think, through the feedback we have received, that people understand that.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

Mr. Boulerice has the floor for five minutes.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you, Mr. Chair.

Thank you, Mr. Sherman, for being here today. I must admit that I am one of those politicians who uses Facebook quite a lot most of the time.

I will seize this opportunity. So along the same lines as Mr. Calkins' questions on your data use policy, I'll read you an excerpt from the chapter that deals with the use of information you receive. I would like you to tell me if I have understood correctly. It reads as follows:

While you are allowing us to use the information we receive about you, you always own all of your information. Your trust is important to us, which is why we don't share information we receive about you with others unless we have:

received your permission;

given you notice, such as by telling you about it in this policy; ...

In other words, people who do not read the policy and click on "I agree" are basically giving you the right to use personal information, such as their photos.

[Robert Sherman]

We try to provide information about how Facebook works, how information is shared in a number of different ways, in addition to the data use policy. Obviously we provide the data use policy to every user of Facebook before they can access our site. We require them to accept it, and we hope they do read it.

We also provide information about how information is shared in a number of different ways, including in our interface. For example, we have the inline privacy controls, which, if you have used our site, you're familiar with: when you're posting, you get to make a judgment about who will see that information.

We think there are a number of different ways that we provide information to people. We also have a help centre where you can search for information if you want to know about how we do a particular thing and hope that makes the information accessible. We do try to provide a readable data use policy.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

But am I correct in saying that you consider the simple fact that they have clicked on the words "I agree" to mean that people have been informed that they are authorizing you to use their personal information?

[Robert Sherman]

Yes. When people agree to the data use policy, we understand that they have agreed.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you.

You collect information about people's interests, their age, where they live. In that way, you can target the applications, the games and the advertising they will receive on their page. And that is the business model for most social media sites.

I would like to know if there is a specific code of ethics, especially with respect to adolescents. For example, do you prevent weight loss products from being advertised on the pages of adolescent girls who are 13, 14 or 15 years of age?

[Robert Sherman]

We do have a set of advertising guidelines, which I think covers the areas you're referring to. You can read them on our site. If you go to the bottom of any page, there's a link called “terms”, and that leads you to a place that provides all of our governing documents, including our advertising policies. There is also additional information in our help centre about that.

We do have policies that restrict advertisers' ability to target based on certain sensitive characteristics—for example, based on race or ethnicity—and we limit them on that basis. There are other content-based restrictions as well on how advertising can work.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Suppose I'm the parent of an 8-year-old and a 12-year-old—which is actually the case—and I learn that they have created a Facebook profile. Should I want to delete it, but they stubbornly refuse to give me their password in order for me to do so, who could I talk to?

[Robert Sherman]

One of Facebook's policies is that you have to be age 13 older to gain access to our site. That's because our view is that our site is designed for people who are above that age. So we take a number of different steps to prevent children, including ages 12 and 8, as you mentioned, from gaining access to the site.

Those tools aren't perfect. One of the things we do is we delete the accounts of children under 13 once we've verified that they in fact belong to people who are under 13. If you go into our help centre, you can find information on how to contact us. We would obviously want to verify that you are the parent of the person who created the account before doing so.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you.

With respect to deleting or removing something from your site, the policy says, "We store data for as long as it is necessary to provide products and services to you and others, including those described above. Typically, information associated with your account will be kept until your account is deleted."

What do you mean by "typically"? What are the exceptional circumstances in which you would not delete the information when I delete my profile?

[Robert Sherman]

I think the portion of the policy that you're referring to is information that's received in connection with advertising. In that case, we say we receive information in connection with advertising, and then we delete it when we no longer need it. That is a general policy that applies regardless of whether you delete your account.

When you delete your account on Facebook, then we will remove any personal identifiers from data that we've collected or deleted so that you're not identified by any information we have.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you for your answers. The time is up.

Mr. Carmichael now has the floor for five minutes.

[John Carmichael, Conservative, Don Valley West, ON]

Thank you, Chair.

Thank you, Mr. Sherman, for appearing today.

I have two areas that I'd like to address in the time we have. First, I'd like to go back to the deletion element. You've talked about that a couple of times.

I think I clearly understand the difference between deactivation and deletion. The concern I have is on the deletion aspect. What happens to the data?

If I, as a consumer or a user, choose to delete—we bypass the 14 days, I want out—do I have my information fully deleted at Facebook and there's no more record of me, other than what's already been shared, I would think, through the communities?