Information & Ethics Committee on Dec. 6th, 2012

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you very much.

Thank you for being here. I have to admit that I did not know of your existence until the committee started its study on privacy and personal information.

You have data on 500 million people. You could have up to 1,500 different data points on each of these people. You learn a lot about someone if you have 1,500 data points about them. That's quite an achievement. How do you collect all this information on all of these people?

[Jennifer Barrett Glasgow]

Let me maybe clarify the 1,500 data points.That is the maximum number of data points that we attempt to collect. I don't know that we have all 1,500 elements on any one individual.

About half of those are actual interests and activities that consumers are involved in and, of course, while I may play golf, I typically may not also play tennis or boat or have other hobbies. The average number of elements on any one individual is certainly not nearly that high. I would say that it's maybe more in the category of several hundred.

Also, I think it's important to understand that it is a description of our U.S. products, and that is the business that has been around the longest—for over 40 years. We have more recently expanded into other geographies—Canada, Europe, Latin America, and Asia—and in those countries, we have far fewer information points.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

How do you know whether someone plays golf rather than tennis?

[Jennifer Barrett Glasgow]

The data in the U.S. comes from three primary sources. It comes from public records, but for something like golf or tennis, it would typically come from a consumer survey in which they have indicated that this is an interest of theirs. Or it would come from a subscription to a golf or tennis magazine, or purchases from a golf or tennis catalogue.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

When I was going over your client list, to whom you sell information on individual profiles, I noticed that HSBC was on the list, and this bank is suspected by an American senate committee of having indirect links, but potential links, with Mexican drug cartels.

If you really want to protect the privacy of these people, how can you ensure that your clients protect the personal information of hundreds of thousands of people, even millions of people? Indeed, once you've given the information to HSBC, how can you know what the bank will do with that information? If there is illegal activity involved, it's potentially dangerous.

[Jennifer Barrett Glasgow]

We provide data to any client—HSBC or any other client—under contract, and that contract specifically says what they can do with the data. In the case of our U.S. clients, they can use the data for marketing purposes. They typically do not receive all of those data points. They are interested in certain data points for their particular marketing purposes, and not all data points are applicable to all industries.

They would receive a subset of the data, and they would have a requirement from us to use it for a period of time and to either return it or destroy it. For our larger clients we actually often have on-site employees of Acxiom who work at the client's location who give us added assurances that those contractual terms are being followed.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

For the purposes of our study, I would like to know whether you have a business relationship with social media companies like Facebook or Google.

[Jennifer Barrett Glasgow]

We do provide some data to Google and Facebook. As I said earlier, we indicate through surveys and other non-social media services or sites that people have an interest in social media, a high or low interest, and what kinds of social media, such as Twitter or other chat rooms, as opposed to, say, a Facebook-type of social media. But we do not integrate data from those sites into our products.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

That's it? All right.

[The Chair, NDP, Pierre-Luc Dusseault]

Mr. Angus would like to clarify a point.

You will be the last one. There still is some time left.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Madam Barrett Glasgow. We're really pleased that you participated in this. We have a lot of concerns about the role of big data, and you put a face to it. I can say—no offence to your company—that I'm kind of pleased that Canada is so small in your world that you just have my telephone book information. Thank you for that. If you ever decide that we're a little bigger in your world, please let me know. I'd certainly be inviting you back to our committee.

I'm looking, then, mostly at what you're gathering in Europe and in the United States for information. I'm looking at your catalogue and what you offer, your customer data products catalogue.

People can gather a phenomenal amount of information from this. I know not everybody has 1,500 data points; I don't know if I have 1,500 data points in my life, but maybe I do. But I see allergies, seniors' needs.... If you're getting people's records, their phone records, their allergies, their ethnicity, when someone buys that data, do they get the names with that, or do they just get aggregate data with the names stripped out?

[Jennifer Barrett Glasgow]

No, they typically get the names. The data is delivered to the clients in two ways. They can buy a list from us that is a selected list based on certain criteria that they specify. In other words, a drug company might want a list of people with an interest in allergies or who suffer from allergies, because they want to promote a particular new product to them. We would select those people from our database and send that client of Acxiom's the list, and it would include the names and addresses. It might include the telephone numbers if they're intending to do a telemarketing campaign.

The other way they can receive data from us is through something we call “list enhancement”. That is where our client, in this case the drug company, would send us the names and addresses of people they are looking for allergy data on, and we would match those to our database and append the data that they specifically have requested—in this case, interest in allergies—to their list, and send that list back to them.

[Charlie Angus, NDP, Timmins—James Bay, ON]

So if I have a loyalty card and I'm picking up medication, and that data is being put together and someone buys a list, they know what I'm taking?

[Jennifer Barrett Glasgow]

No, any of the health-related information comes from surveys. It does not come from protected health information. In the U.S. we have a law called the health information portability and accountability act, HIPAA, which regulates prescription information and patient-doctor information. This information would have come from a consumer filling out a survey saying they either suffer from allergies or have an interest in allergy products because of someone in the household who does.

[Charlie Angus, NDP, Timmins—James Bay, ON]

But you're saying you don't separate the data points out so that if we start to identify that Joe Blow goes to the liquor store and uses his air miles points to buy his liquor every week, that's put in the data. We know that he's been divorced because we have the divorce records. We know where he lives. You don't separate the name information from what they do. That can all be purchased.

[Jennifer Barrett Glasgow]

The type of data you just described, such as what he purchases at the liquor store and so forth, would not be the type of data that Acxiom has. We have general demographic information that describes the household characteristics: is this a couple living there? Do they have children? Is it an older couple or a younger couple? It's that type of thing, and then we would have interests and lifestyle information, not related to any kind of sensitive or health or financial types of transactions. It's general in nature, but it is associated with the actual names and addresses.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you very much.

That's all the time we have, unless there is another question.

Thank you very much for your time and for having appeared before the committee today. We are going to carry on with our business.

[Jennifer Barrett Glasgow]

Thank you.

[The Chair, NDP, Pierre-Luc Dusseault]

However, I would ask committee members to stay for another couple of minutes to discuss another matter.

I would just like to ask you to think about what our next study could be. As you know, we are hearing the last of the testimony. So when we come back from the Christmas break, we'll have to begin a new study. So we will have to think about that. We will probably have some time to discuss that at the next meeting, which is next Tuesday. At that point, we will hear from the access to information commissioner, who has managed to find some time in her schedule to see us.

I just wanted to let you know about that.

Further, no one from Microsoft or Apple will be able to come. That is the other thing I wanted to tell you. In fact, that's about all I wanted to say.

So, for your homework, you will have to think of another subject we could study when we come back after the holidays.

Mr. Warkentin, go ahead.

[Chris Warkentin, Conservative, Peace River, AB]

I just wanted to mention that we would be discussing with the opposition what might work in terms of the year, and so we'll do that, but we also wanted to clarify that it is confirmed that we're not meeting on Thursday.

[The Chair, NDP, Pierre-Luc Dusseault]

Unless the committee states otherwise or something comes up, we will not meet on Thursday, December 13.

[Chris Warkentin, Conservative, Peace River, AB]

I just wanted to confirm that. Thank you.

[The Chair, NDP, Pierre-Luc Dusseault]

As it now stands, we will not meet on December 13.

I also just wanted to say that the access to information commissioner tabled her report this morning. I just thought I'd let you know, in case you were interested.

Mr. Angus, you have the floor.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

Will we have the Privacy Commissioner come one last time?

[The Chair, NDP, Pierre-Luc Dusseault]

Yes, next Tuesday.