Information & Ethics Committee on Dec. 6th, 2012

[Jennifer Barrett Glasgow]

Consumers who want to have their telephone directory listing removed may have it removed from the directories we sell for the search engines or they may have it removed from all of the directory products, things that are used for direct-marketing purposes rather than just directory search engines. They can contact us to do that via our website. They can fill out the form online and that opt-out is posted in the next update cycle of our database, which is monthly, and then redistributed to our clients.

For the business side of the house, we offer essentially the same service, but because businesses really don't typically want to opt out, they usually contact us if they've moved or changed their telephone number or something. They're typically more interested in a correction, because businesses want consumers to find them. We will make that correction, and it will be published in the normal update cycle, but if they want us to do a special distribution of that new data, then we do ask for a small fee for that.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

This is your Canadian business that you're referring to right now?

[Jennifer Barrett Glasgow]

It's for the Canadian directories. That's correct.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

I don't think I have any other questions at this time.

Thank you very much.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you, Ms. Davidson.

Mr. Andrews now has the floor.

[Scott Andrews, Liberal, Avalon, NL]

Thank you, Jennifer, for being here with us today.

You said your information for Canada is limited to the directory and the census, but are there Canadians doing business in the United States through different companies or different loyalty programs or those kinds of things whose data you might actually catch through a company or an organization that they're doing business with in the United States?

[Jennifer Barrett Glasgow]

Well, if we did, if some of our sources provided us data on Canadian citizens, then we would screen them out when the data came to us to put into our products.

Each of our products in each country is built for that country, so that we can be sure we're complying with appropriate laws relative to citizens' data.

[Scott Andrews, Liberal, Avalon, NL]

So you'd screen out Canadian data?

[Jennifer Barrett Glasgow]

Yes. If we bought a list from someone that had both Canadian and U.S. data in it, we would exclude all of the Canadian data when we built our U.S. product.

[Scott Andrews, Liberal, Avalon, NL]

Okay.

We heard a lot about data matching and getting information from five, six, or seven different sources and then data matching people based on partial information or bits and pieces. Could you explain to us a little how exactly that process works?

[Jennifer Barrett Glasgow]

Yes. Let me start with Canada, because it's pretty simple, and then I'm happy to describe what we do in the U.S., which is far more complex.

In Canada, we match name and address and telephone number, because these are telephone directory listings and we have a phone number for every record.

We append census data to that based on geography.

We would take your census file, which is at a geographic level, and then we would append census characteristics to the individual record. If someone were using it for direct marketing purposes or telemarketing purposes, they would have more information about the individual than just their name, address, and phone number. That's a fairly simple process.

In the U.S. and in other countries, we will match names and addresses. We will match telephone numbers when we have them. When we're not dealing with directories exclusively, we may have records that do not have a telephone number on them.

We would use the highest, most accurate information we have available in the record. Part of our matching algorithm—I think it's something that any good data company that collects and assimilates data from multiple sources needs to do—is to have quality standards related to the data integration or data matching.

For instance, take an initial; my name might come in from one source as “J.” Glasgow, or it might come in as “Jennifer” Glasgow. If I lived in an apartment building, I might have the street address but be missing the apartment in one record. We would go through a data hygiene process to try to standardize and clean up, to the degree we can, any inconsistencies in the address or misspellings of maybe street names or other things like that. Then we would match records together to try to determine if we have information about the same person or household from multiple sources that could be integrated together to build a composite of information.

That's how we get, as the earlier member discussed, up to 1,500 different data elements on one individual and household.

[Scott Andrews, Liberal, Avalon, NL]

Thank you very much.

[The Chair, NDP, Pierre-Luc Dusseault]

Mr. Kramp, do you have a question?

[Daryl Kramp, Conservative, Prince Edward—Hastings, ON]

I would like to maybe dovetail the privacy issue with the security issue.

Where does your hardware and software come from? Where does it originate? What is its proprietary nature? Is it U.S.? Is it Asian? Is it European?

[Jennifer Barrett Glasgow]

It's primarily U.S. Our largest data centres are in the U.S., but we do have data centres in the U.K. that service our European operations. We have data centres in Australia and China that service our Asian operations.

The data centre for all of the processing we do for Canada is based out of one of two locations in the U.S.—either our Chicago data centre or our Conway, Arkansas, data centre, which is just outside of Little Rock, our headquarters, where I reside.

[Daryl Kramp, Conservative, Prince Edward—Hastings, ON]

Thank you.

[Jennifer Barrett Glasgow]

The software is commercially available software from IBM, from Oracle, from SAS, and others.

[Daryl Kramp, Conservative, Prince Edward—Hastings, ON]

The reason I'm wondering is that obviously we have heard a lot of discussion...certainly in the U.S., where an election has just passed. On a consistent basis, though, both political and business interests in the U.S.A. have expressed concerns regarding security, particularly with regard to the interaction with the Asia-Pacific region.

Would you like to comment on that?

[Jennifer Barrett Glasgow]

We certainly understand the concern, having a footprint in Asia, in both China and Australia. We have firewalled all of our different operations. We limit access by employees who have access to servers or to systems, or who do maintenance on servers and systems by region as well, because we're sensitive to all of those concerns.

In terms of many of the requirements we follow for our clients in regulated industries, such as financial services or health care, we don't segment the client processing out separately from other industries, so other industries, such as retail, telecommunications, or the catalogue industry, enjoy the benefit of those higher security standards from those regulated industries.

[Daryl Kramp, Conservative, Prince Edward—Hastings, ON]

I'm just wondering how confident you are in your firewalls, particularly when the interaction now of course encompasses the entire financial sector, the insurance sector, telecommunications, and all of the technology companies. If there is any concern at all with regard to firewalls, I would suggest that perhaps some of the people who have registered international security concerns....

Have you been able to alleviate all of their concerns, or is there any lingering doubt?

[Jennifer Barrett Glasgow]

We have alleviated all of the ones that we're aware of, but I will reiterate that it is a continuing, iterative process, which is why we do audits ourselves. We do all kinds of data loss prevention, as well as firewall and on-site security checks daily, so that as the threats evolve, which they do over time, we're always at least one step ahead, if not further ahead, of the bad guys.

[Daryl Kramp, Conservative, Prince Edward—Hastings, ON]

The reason I asked is that I have some responsibilities here as chair of the Canada-China relationship. As such, there is a lot of interaction, and there are concerns registered between technology companies, whether it was Data Comm with the Huawei corporation and/or others.

Knowing that in the Asian market right now there is such an abundance of new players on the scene in the transmission of data, whether it's through the Philippines or wherever, I would really, really like to be assured that with the scope and the market share you have, you feel very confident that, should Canada have any interaction at all, even to a greater extent than we do right now, obviously the assurance is there that your security is absolutely flawless.

[Jennifer Barrett Glasgow]

Well, “flawless” is a word that I'm not sure applies to security these days, unfortunately, but we take every precaution we can. As I said, we're constantly checking it and we have the added value of having our clients come and check us as well.

[Daryl Kramp, Conservative, Prince Edward—Hastings, ON]

Thank you very much.

[The Chair, NDP, Pierre-Luc Dusseault]

Mr. Boulerice now has the floor.