Evidence of meeting #59 for Access to Information, Privacy and Ethics in the 41st Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was bluekai.
A video is available from Parliament.
December 11th, 2012 / 3:55 p.m.
Conservative
John Carmichael Conservative Don Valley West, ON
Thank you, Chair.
Thank you, Mr. Chapell, for being with us today. I am getting a quick education from my colleague.
As you know, this study has been going on for some time. We have been trying to clearly understand our role as legislators in ensuring that consumer privacy is paramount. Through this study, we have come across a number of different areas that are very concerning, and there have been others about which we have been told it's best to just leave the industry alone, because with any more regulation we would stifle growth and employment. We're trying to find a fine balance in terms of where we belong in this whole process and at the same time ensure that consumer privacy is critical.
As you know, we have met predominantly with social media companies. I wonder if you would agree that the social media companies will push the edges of the envelope to the extent that they are able to until such time as a regulatory process says, “Enough.” Would you agree that is a fair statement, or am I overstating it?
3:55 p.m.
Outside Counsel, Privacy Officer, BlueKai Inc.
I think it's safe to say that social media companies are participating in a developing culture regarding privacy. For example, I've been focusing on privacy for almost a decade. From a privacy standpoint, the notion of providing a website with a list of all your contacts and the events you happen to be going to and pictures of friends would have been unthinkable 10 years ago, yet today it is fairly widespread. Even the initial news feed was fairly controversial when Facebook offered it, and a number of folks screamed that this was a privacy invasion.
Both from a legislative and a regulatory perspective, it's a delicate balance to define the balance between stifling innovation and protecting consumer privacy interests. Fortunately in Canada, while I don't claim to be an expert in Canadian privacy law, I do know that a pretty comprehensive framework is in place already, and a self-regulatory program is going to be launched within the next several months.
From my perspective, it would be a very good idea to see how that program develops prior to taking proactive steps. At least give the industry the opportunity to demonstrate that this is in the consumer's interest.
3:55 p.m.
Conservative
John Carmichael Conservative Don Valley West, ON
Hopefully if I've got enough time I'll come back to that before we finish, but I'm sure some of my colleagues today will pursue that line.
When you talk about the preference data and the privacy constraints around BlueKai, as the data drop into your data vault—for lack of a better term—and consumers determine they don't want their information out there anymore for whatever reason, when they push that opt-out button on that cookie, I read somewhere there's a six-month window, I believe, before that data is deleted. I'm not sure if that's accurate; you can correct that.
When I've opted out at my choice with my data—this is the information being stored at BlueKai or any other aggregator—am I correct in understanding that the data is fully deleted?
3:55 p.m.
Outside Counsel, Privacy Officer, BlueKai Inc.
It is. I think when you're referring to six months, that's BlueKai's data retention period, but that's a separate thing from the opt-out period.
Once a user has hit an opt-out mechanism and a BlueKai opt-out cookie has been dropped, that effectively replaces the other BlueKai cookies and zeroes out that particular record.
4 p.m.
Conservative
John Carmichael Conservative Don Valley West, ON
So the history that I've been aggregating in BlueKai over the period of time that we've been friends is completely removed?
4 p.m.
Outside Counsel, Privacy Officer, BlueKai Inc.
I think it's safe to say that the opt-out cookie removes any targeting and preference data existing on that computer for future ad targeting.
4 p.m.
Conservative
John Carmichael Conservative Don Valley West, ON
Are we back to the anonymous now, and the data being retained for the advertising media preferences, etc.?
4 p.m.
Outside Counsel, Privacy Officer, BlueKai Inc.
I think to the extent that data is stored over a period of time by, say, an advertiser advertising in a digital format, the pseudonymous data will be maintained over time. The opt-out is typically forward-looking, and in the future they're no longer going to conduct online behavioural advertising.
I think that to destroy all data retroactively becomes a pretty significant challenge. There are people who are far more articulate than I, but I might point the committee to some of the discussions going on in the European Union regarding the right to be forgotten.
4 p.m.
Conservative
John Carmichael Conservative Don Valley West, ON
In our role—and we are going to be completing our study shortly—how would you advise us, from a recommendation perspective, in terms of what we should be looking at or be thinking about in terms of maximizing our effectiveness in protecting our consumers—Canadian consumers, specifically—in the use of their privacy?
4 p.m.
Outside Counsel, Privacy Officer, BlueKai Inc.
Allowing the self-regulatory program to continue to develop, I think, would be a very good start. Then I would suggest regular interaction, whether that's strictly the Office of the Privacy Commissioner or whether this committee also gets involved, or both, but I think a regular check-in—I don't want to say a report card—might be a good way for this committee to continue to have oversight on the development of the self-regulatory program.
These things tend not to happen overnight. I have some experience with that in the United States, but I think that—
4 p.m.
Conservative
4 p.m.
Outside Counsel, Privacy Officer, BlueKai Inc.
We're moving in the right direction.
4 p.m.
NDP
The Chair NDP Pierre-Luc Dusseault
Thank you, Mr. Carmichael.
I now yield the floor to Ms. Borg for five minutes.
4 p.m.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Thank you, Mr. Chair.
This discussion is very useful, and I want to thank our witnesses for joining us today.
My first question is about the clients who use your program and services.
How can an Internet user determine whether a specific company uses your services to then be able to go on your website and say that they no longer want to be subject to certain provisions? Is that information provided somewhere? Do Internet users have access to that information?
4 p.m.
Outside Counsel, Privacy Officer, BlueKai Inc.
We're seeing more and more Internet users download their own transparency tools. Ghostery is one that comes to mind, but I believe there are others. They're browser-based plug-ins that tell an Internet user which cookies are being dropped by which companies on the websites that they visit. Certainly, users can be provided with that mechanism with some additional transparency. We're seeing more and more Internet users utilize those exact types of tools.
Moreover, in the industry self-regulating program—and here I'm talking about the United States—there are two websites. One is called networkadvertising.org and the other is aboutads.info. Both of those websites enable users to opt out from all member companies.
Again in the United States, it's probably worth noting that we're seeing more and more forward-looking little icons on digital advertisements that are being targeted with online behavioural advertising data. From the user's perspective, looking at that little dot on the advertisement may not let that person know exactly which company is targeting them, but it does provide a mechanism for them to understand a little bit more about the practice of online behavioural advertising and then let them go to the opt-out page.
4:05 p.m.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Thank you.
So, if I have understood correctly, it is up to the user to use those tools to make that determination.
My next question is also about your clients.
When you sell your products or contact a client, do you encourage the protection of personal information?
4:05 p.m.
Outside Counsel, Privacy Officer, BlueKai Inc.
Yes, we do.
I find myself involved in many, if not most, client interactions, helping to educate companies about what the privacy rule set is. Some of that depends on the jurisdiction and some of it depends on the type of data that's being utilized, but we take that very seriously. We see one of our roles in the marketplace as being the ones to help educate clients on what the rules of the road are for privacy.
4:05 p.m.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
During your presentation and when answering my question, you talked about principles that have to be applied.
Could you elaborate on the principles you encourage, both as a member of the associations you mentioned and as a company that uses that data?
4:05 p.m.
Outside Counsel, Privacy Officer, BlueKai Inc.
Sure.
I'm going to talk mostly about the United States. Many of these concepts are certainly working in other jurisdictions.
The first organization I mentioned was the Network Advertising Initiative. It's an industry trade association that's been around for about 12 years. The organization is made up primarily of what we call the Internet intermediaries: the networks, the platforms, the exchanges, and the data companies. These are the entities that sit in between a website publisher and an advertiser. They help facilitate the delivery of that.
With those companies, historically the challenge has been that since they don't control the ad and they don't control the website, it's difficult for those companies to push privacy standards out into the rest of the ecosystem. Those privacy standards involve notice, transparency, opt-out choice, and a rule set around what we call “sensitive data”.
When I refer to the Digital Advertising Alliance, I'm referring to what is more of a broad coalition of industry associations, which includes the Network Advertising Initiative. However, it also includes the online publishers, the online advertisers, and the digital advertising agencies.
The goal of the Digital Advertising Alliance is to make sure that all the privacy standards are harmonized within the business ecosystem.
4:05 p.m.
NDP
The Chair NDP Pierre-Luc Dusseault
Thank you, Ms. Borg. You're out of time.
I now yield the floor to Mr. Butt, for five minutes.
