Information & Ethics Committee on April 19th, 2018

[Robert Sherman]

Our expectation is we will tell people how we're using face recognition technology. They'll have the opportunity to make one of two choices. The boxes are of equal prominence. One is to say they accept it, and they want to agree. The other is that they want to make a different choice. People will have equal ability to choose either one.

[Raj Saini, Liberal, Kitchener Centre, ON]

It will just be one step.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr Saini.

Next up for five minutes is Mr. Kent.

[Peter Kent, Conservative, Thornhill, ON]

Some observers and critics might say the Facebook business plan is out of control. In the absence of the regulations and protocols you're now developing—that Mr. Zuckerberg said in Washington last week the company is now developing—would Facebook consider downsizing or resizing the company to something closer to its original form in order to eliminate some of the issues with third-party advertising and vandals who are abusing the system one way or another with disinformation, or fake news, if you will? It's a serious question. It would be a costly question, absolutely, for Facebook, but might it not be time for Facebook to downsize its business plan to more effectively protect user privacy?

[Robert Sherman]

It's important for us to invest very heavily in protecting user privacy and, to some of the other questions that have been asked today, to take steps to ensure integrity on the platform. I'd say two things about that. The first is that you're right that we need a focus, and particularly across the company what we've tried to do is to get people who work on our products and services—not in the context of the Facebook platform, which we're talking about today, but in other areas as well—to focus their work on promoting integrity, protecting people's data, protecting people's experiences, and promoting our broader obligation. Certainly we need to focus in that way.

As a part of our broader obligation, looking across Facebook developers and other third parties that we have relationships with, in the category of Mr. Kogan for example, we're going to have to invest very heavily in additional personnel and processes to make sure we have oversight in those areas as well.

[Peter Kent, Conservative, Thornhill, ON]

Mr. Chan.

[Kevin Chan]

One way to look at it and the things that Rob went through in his opening statement is to say that the process we're engaged in is very much locking down the platform. In a way, what you're talking about is making sure certain things.... We already made significant changes in 2014, as Rob mentioned, but even today, subsequent to the Cambridge Analytica news reports, we are doing a whole bunch of things not only retroactively to look at what happened with these apps, but also prospectively to change the way apps work on Facebook and drastically limit the amount of information they can get. That's just right.

The other thing I should just point out is that obviously our CEO has been very clear that this is going to be a significant investment. We expect a material impact on profitability. I think he said that, but I just wanted, again, to make that clear to the committee as well.

[Peter Kent, Conservative, Thornhill, ON]

Some of my colleagues have been talking today about the complexity and volume of material involved in acceptance clicks and opting in and opting out. For years the voices from academia and the tech world were largely ignored when they cautioned users about the way they access and what they access, and what the contract is when they click the accept box and basically agree to gain a user adventure or a good user application at the expense of revealing their personal privacy in greater or lesser amounts.

Do you think it's time now to simplify the cautions? Or is there a need for greater public education, perhaps even in schools, warning people who are going to use social media about the dangers, pitfalls, and traps they may encounter in rushing to click acceptance to gain use?

[Robert Sherman]

I think we at Facebook, and actually we as a broader society too, should be investing in more ways of communicating with people about privacy, rather than less. One of the things that I know the Privacy Commissioner of Canada has emphasized is that there are different kinds of uses of information that require different kinds of notice, and some uses are more sensitive than others. I certainly agree with that sentiment.

I think the way we've approached this at Facebook is to provide more detailed information in places like our privacy policy, so that people who want to dig into the details of how information is used and how they can control it can do that, and also to communicate on a day-to-day basis with people outside of the privacy policy, in ways that are maybe more accessible, about specific information, such as how to control who can communicate with you and how Facebook uses information as a part of delivering ads and how you can control that, etc. I think all of those are important.

I think your idea of doing communications within schools or in communities to help people gain literacy and the ability to make choices that are right for them is a thoughtful one, and I think that's something we should take on board.

[Kevin Chan]

If I may just add to that, on the specific thing about reaching out to the broader ecosystem and working with partners, certainly we do that in Canada with MediaSmarts, as I mentioned, which is Canada's digital literacy organization. They work closely with schools in classrooms across the country. I think that is an important ultimate backstop.

That's not to say that we don't have responsibility on our part, and I think Rob was very clear. Not only have we historically done this, we're doing more. I think the recent controls we've announced make it even easier. Before this, I think you had to go to potentially up to 20 different screens to control your experience on Facebook. We're now centralizing all of that in one map, if you will, where you can play with all the dials and have complete control over your experience and your privacy on Facebook.

We completely agree that it's very important, and we are moving to roll that out, not just in Canada but around the world.

[Peter Kent, Conservative, Thornhill, ON]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Kent.

Next up for five minutes is Ms. Vandenbeld.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

I want to thank both of you for being here. As you know, this is really a crisis of confidence that many Canadians feel. It's a medium that we're using in our social interactions and to gather information and news, so I appreciate your answering the questions.

I do have some concerns regarding some testimony that we heard in our last meeting from Mr. Chris Vickery, who is an expert in data breaches. He referenced that there was another Facebook breach involving about 48 million records. He alluded to the point that this could even involve Messenger, where people's most intimate messages to one another in a private setting may have been breached. It was testimony that we heard just two days ago, but are you aware of this potential breach? Is it possible that there could be others?

[Robert Sherman]

I think certainly we've said that we intend to undertake an investigation with regard to Cambridge Analytica and the situation there. We need to understand what happened and where that information went. If it's still out there, we need to make sure that it's taken care of.

With regard to other situations, I think you're right: it's possible that there are other situations out there. The one that I think you may be referring to is a situation of scraping, where even public information that's available on Facebook and on the Internet was collected by a party. If that was done, that was in violation of our policies, and I think that's another area where we have taken steps but need to take more steps.

I think it's certainly a possibility that there are other incidents out there. It's incumbent upon us to do the work to understand those and mitigate them.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

We are talking about one app that Cambridge Analytica was using for information. There are hundreds of apps. We see invitations every day on our Facebook feeds. You're talking about 272 people who joined one app, and that affected 600,000 people. With all the other hundreds of apps out there, how big might this problem actually be?

[Robert Sherman]

That's something we need to get to the bottom of. We have undertaken already an effort to look back at apps that would have had access to that level of data prior to locking down our platform in 2014. We're in the process of doing that. We don't have firm answers on exactly what the scale of the problem is at this point, but it's something that we do need to undertake and that we're working to do expeditiously.

In addition to looking backward, we have an obligation to look forward, and that involves really three things. The first thing is making sure we are locking down the information that is available, so going forward, the type of information that was available previously won't be available.

The second thing is, for the limited information that is available, we need to make sure we're exercising effective oversight and that we're understanding who has that information and what they're doing with it.

The third thing, as we've talked about earlier today, is communication. We need to commit, and we have committed, to communicating much more quickly and much more practically with people when these situations arise.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

On the oversight piece, the second piece you mentioned, I noted that in your opening remarks you said that apps that have information will be removed after three months, that permissions will be revoked if it looks as though they're being abused. However, our committee has heard that once somebody has access to this large volume of information about an individual, they can create psychosocial behavioural profiles of that person, so that even, for instance, in the case of Cambridge Analytica, if the information has been returned to Facebook and deleted from the servers, it doesn't matter anymore because they have that behavioural profile, which then could be in the hands of anybody.

How do you prevent that from happening, and how do you make sure that flow of information is stemmed to begin with?

[Robert Sherman]

There are two answers to that. One is a policy answer, and one is an enforcement answer.

With regard to the policy piece, it was at the time, and continues to be, a violation of our rules for a developer to use information in that way. It would restrict both their use of the information that they directly receive from Facebook, as well as any downstream uses, such as the profiling that you are talking about. Those would both be violations of our rules. We're undertaking to investigate that ourselves.

We understand that the Information commissioner in the U.K., which has jurisdiction over Cambridge Analytica, is undertaking an investigation, and we're co-operating with that. We understand that the Privacy Commissioner in Canada is doing so as well, and we're co-operating there. We need to co-operate with both of those investigations and understand what's happening.

With regard to enforcement, after the regulators who are undertaking the investigations have told us that it is safe for us to do so, one of the things we need to do is to understand whether any of that downstream data exists. If it still does, we would take the position that it's just in the same category as their earlier data and needs to be deleted as well.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

I have one more question. I know I have limited time, but who owns the data that is put on Facebook? Obviously the public data is public domain, but when you have a message that you're sending to someone, you put your photos to friends and family only, who owns that data?

[Robert Sherman]

If you put information on Facebook, you own that data, and that is stated explicitly in our terms of service.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Therefore, you can remove that data at any time, and be notified if somebody else is using that data. Is that something you're looking into?

[Robert Sherman]

That's correct. If you put data on Facebook and you want to delete it, you can delete that specific piece of data. As we referred to earlier, you can delete your account entirely and remove all the data in your account, if that's what you want to do.

One of the lessons we have learned as part of this is communicating more proactively with people if their data is misused, and that's something that we intend to do as well.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Thank you. I am out of time, but hopefully I'll get another round.

[The Chair, Conservative, Bob Zimmer]

Thank you.

Next up, for a three-minute round, is Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you very much.

We've been talking about the data breach and the corporate culture at Facebook in response to it.

Mr. Chan, I would like to talk a bit about the corporate culture of Facebook Canada, because you're very busy in terms of outreach. You've met with election minister Gould, Minister Morneau, Minister Duncan, Minister Joly, Minister McKenna, and Minister Carolyn Bennett, who said she was absolutely inspired by your wise and frank counsel, which is very impressive.