Information & Ethics Committee on Dec. 11th, 2012

[The Chair, NDP, Pierre-Luc Dusseault]

Order, please.

We will begin the 59th meeting of the Standing Committee on Access to Information, Privacy and Ethics and continue the study on privacy and social media.

Today, we are fortunate to have two witnesses with us. First, we have a representative from BlueKai, Mr. Chapell, who will make a 10-minute presentation. Afterwards, we will be able to ask him questions. We will also hear from the Privacy Commissioner who is visiting us for the second time. She will summarize what has been said so far, since this should be the last meeting on this study.

Without further ado, I yield the floor to Mr. Chapell for ten minutes. As I already said, we will then have an opportunity to ask him questions.

Mr. Chapell, I want to thank you for joining us. The floor is yours.

[Alan Chapell, Outside Counsel, Privacy Officer, BlueKai Inc.]

Thank you, Mr. Chairman.

Mr. Chairman and members of the committee, thank you for inviting BlueKai to testify at this timely and important hearing. My name is Alan Chapell, and I am the outside counsel and privacy officer for BlueKai Incorporated, a digital data company with headquarters in Cupertino, California.

It is an honour to appear before this committee. I am pleased to describe BlueKai's business and share with the committee some of the privacy innovations we've developed at BlueKai.

BlueKai's mission is to build the world's first complete enterprise platform for data-driven marketing with the utmost attention and diligence to ensuring consumer privacy. We offer a data management platform that enables advertisers to collect, store, and utilize anonymous consumer preference data. Since our founding in 2007, BlueKai has embraced the privacy by design ideals championed by Information and Privacy Commissioner Dr. Ann Cavoukian. We recognize the importance of incorporating privacy into our products and services and have fostered a culture of protecting consumer privacy interests from day one.

BlueKai's platform enables businesses to utilize pseudonymous bits of marketing data for online behavioural advertising and analytics purposes. The platform allows businesses to create target audiences based on a combination of their own data and third party data in order to reach their target audiences across third party advertising networks and exchanges. The platform also helps those businesses to measure with accuracy which campaigns performed in order to refine media buys and advertise creatively over time.

The marketing data stored on the data management platform is generally governed by the privacy polices of our clients. BlueKai offers guidelines to help ensure that our clients understand the applicable privacy law and self-regulatory standards.

BlueKai also offers a data exchange that enables businesses to utilize pseudonymous third party data for their digital advertising campaigns. We take steps to ensure that the third party marketing data listed on the BlueKai Exchange meets or exceeds applicable privacy law and self-regulatory standards.

BlueKai is a board member of the Network Advertising Initiative, a coalition of more than 95 leading online advertising companies committed to shaping and enforcing responsible privacy practices for online behavioural advertising. We are also a member of the Digital Advertising Alliance, the industry-wide self-regulatory program for online behavioural advertising. We've been active in the behavioural advertising self-regulatory movement in North America, Europe, and the rest of the world since our founding.

We understand that a similar behavioural advertising self-regulatory program is being developed in Canada. Further, this program's privacy requirements are generally in harmony with the policy position on online behavioural advertising offered by the Office of the Privacy Commissioner of Canada. BlueKai has historically been a leader on the move to industry self-regulation. We aspire to continue that pattern and be one of the first companies to participate in the Canadian self-regulatory initiative when it is launched.

Last but not least, BlueKai participates actively in the World Wide Web Consortium's tracking protection working group to develop a browser-based do-not-track standard.

In addition to being active participants in industry self-regulation for online behavioural advertising, BlueKai has a history of innovating on privacy issues. l'd like to share two of those privacy innovations with the committee today.

The first is the BlueKai Registry. BlueKai was one of the first digital marketing companies to provide consumers with enhanced transparency by offering access to marketing data via the BlueKai Registry. The BlueKai Registry, which is available at BlueKai.com, brings transparency to consumers by allowing them to see what preferences are being stored via the BlueKai cookies on their computer.

Furthermore, consumers may also control their anonymous profile by managing their topics of interest. We strongly believe that offering consumers this level of transparency and control builds consumer trust. We've seen that in practice; relatively few consumers who visit the BlueKai registry actually opt out from further use of their preference data. This suggests to us that consumers who understand BlueKai's practices are generally less concerned by them.

The second innovation is the BlueKai opt-out protection tool. One of the challenges to offering opt-out choice in an online advertising context is that cookies serve a dual purpose. In other words, cookies are used to store marketing data and to record an Internet user's opt-out choice.

When Internet users delete all of their cookies, their opt-out choice may also be deleted. The Office of the Privacy Commissioner of Canada has proposed that opt-out choice is appropriate for most forms of online behavioural advertising; however, the Privacy Commissioner also recommends that such choice be made persistent. This recommendation is in line with the recommendations made by regulators across the globe. BlueKai has taken steps to meet those recommendations with the BlueKai opt-out protection tool.

Utilizing some open-source code, BlueKai developed a Firefox browser plug-in that was designed to protect user opt-out choice even when users have deleted their Internet cookies. This code was licensed to the Network Advertising Initiative, so all NAI member companies were able to leverage the opt-out protector technology. This opt-out protection concept was further embraced by the Digital Advertising Alliance and expanded to include most major Internet browsers.

We're proud that our hard work was able to help BlueKai and other online behavioural advertising companies to protect consumer privacy choices. We take privacy very seriously at BlueKai and are happy to have had the opportunity to share some of our privacy innovations with this committee.

I'd be happy to answer any questions.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

I will now yield the floor to Mr. Angus for seven minutes.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Mr. Chair.

Thank you very much for coming today. We really appreciate your participation in this study.

As you're probably aware, we're trying to get a sense of the world of big data and how it plays in with social media so that when we come forward with possible recommendations, we're not proposing reactive legislation that would actually interfere with the development of the new opportunities out there and that will also, as well as we can in our position as MPs—which is very far from the cutting edge—try to ensure we have some basic standards of protection, particularly on the privacy rights of Canadian citizens.

I'd like to ask you a first question. Does BlueKai gather data on Canadians?

[Alan Chapell]

We do have some business in Canada. It is not a large lion's share of the business that we currently do, but there is certainly some data collected on Canadians.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

We met with Acxiom last week. They said we were too small a market, which we didn't take personally. We were actually kind of relieved generally, I think, that they only were interested in our phone books.

One of your founders, Omar Tawakol...?

[Alan Chapell]

Yes: Omar Tawakol.

[Charlie Angus, NDP, Timmins—James Bay, ON]

He says, “Right now, data looks like black, gooey material. Oil was to the industrial revolution as data is to our information economy.”

Do you mine this black gooey material, or do you process it? What's your role with the goo that is data?

[Alan Chapell]

I think he is making the analogy that data can be very valuable. It can be very helpful to consumers. It can foster innovation.

Our primary business is a data management platform, which really provides the plumbing for the oil pipeline, I guess, if we're going to extend the analogy.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Do you congregate these various points of data into profiles or do you take what data is there and then make sense of it?

[Alan Chapell]

I think we do a little bit of both. There is certainly an analytics and analysis component to the platform, and certainly the data exchange product does obtain consumer preference data.

[Charlie Angus, NDP, Timmins—James Bay, ON]

All right.

I'm interested in the opt-out clauses and certainly in the issue of cookies. I turn my cookies off, but sometimes I can't go onto a website—Firefox or other browsers—unless I turn the cookie on, which means I'm actually allowing myself to be tracked. I don't really feel that it's something I've agreed to; I've agreed to go to the website, and I need to turn the cookie on. How important is the cookie in terms of being able to track what I do online?

[Alan Chapell]

The cookie is essential for a number of things online: certainly the ability to track, the ability to remember a particular browser on a particular page when it visits the next page in order to provide what they call “state”, so that there's some ability for a continuous user experience.

[Charlie Angus, NDP, Timmins—James Bay, ON]

That means that if I go from one site to another to another, it's actually possible to track me and say that I was here, I was there, and then I was there. It starts to form the pattern.

[Alan Chapell]

It's certainly possible. What that would presume is that the same company was dropping cookies on the first site you visited, and then the same company was dropping cookies on the second site you visited, and the same company was dropping cookies on the third site you visited.

[Charlie Angus, NDP, Timmins—James Bay, ON]

But a data broker could take the information from the three different points and correlate it. This wouldn't be necessarily the one cookie on Amazon or another commercial site, but these points of data actually can be congregated into a profile.

[Alan Chapell]

I think the data points can be congregated not necessarily into one continuous profile knowing that you've been on website X, website Y, and website Z, but if website X is a finance website, it's very possible that there may be an indication that the browser has visited a finance website. If the next one is on a travel website, there's a possibility at least that a cookie indicating a preference for travel would be dropped on the browser subsequent to that.

[Charlie Angus, NDP, Timmins—James Bay, ON]

A New York Times article on BlueKai was really interesting. It said:

BlueKai's business model stands or falls on the idea that our digital profiles are anonymous at the time they're auctioned off. In fact, computers can link our digital profiles with our real identities so precisely that it will soon be hard to claim that the profiles are anonymous in any meaningful sense.

With my tracking experience of going to a financial adviser, trying to find a place to go in Cuba, and how much booze I bought for the Christmas party because I was looking at various prices, that's not anonymous data. That's fairly easy to link to me as a person. Is that correct?

[Alan Chapell]

My first answer would be that BlueKai doesn't engage in any type of profiling regarding alcohol usage, so it's important to make that clear.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank God.

[Alan Chapell]

There are a number of segments that we consider off limits.

[Charlie Angus, NDP, Timmins—James Bay, ON]

But you do provide that profiling, and it goes to an actual person. It's not just aggregate data.

[Alan Chapell]

It goes to a specific Internet browser—

[Charlie Angus, NDP, Timmins—James Bay, ON]

Right.

[Alan Chapell]

—which may or may not relate to a specific individual, because computers are shared or Internet browsers are shared.