Information & Ethics Committee on April 19th, 2018

[Robert Sherman]

I want to be clear. Prior to today, prior to our data policy changes, Canadians were served by Facebook Inc. in California, and the entity with which they contract was Facebook Inc. That remains the same, so there's no change with regard to Canadians.

[Charlie Angus, NDP, Timmins—James Bay, ON]

We're here because of a social app that Aleksandr Kogan used that gave him access to 85 million users, which was transferred to a political entity that may have undermined elections around the world, and when Facebook became aware of this, Facebook claimed that this was absolutely not a breach.

How can you be trusted with self-regulation if, in the face of such a massive misuse of data, Facebook did not tell anybody because it thought it wasn't worth telling them because it wasn't a breach?

[Robert Sherman]

I think it's critically important that we uphold the trust of our community, and part of what we've learned as a part of this is that we need to communicate more robustly about what's going on in—

[Charlie Angus, NDP, Timmins—James Bay, ON]

You say “communicate more robustly”. You became aware of this in 2015. You started telling Canadian users three weeks ago. That's not robust; that's your getting caught.

Again, the question before our committee is whether Facebook needs regulation because you cannot be trusted to do the right thing with personal information.

I want to reference Sandy Parakilas to you, who was brought in to fix the privacy problems at Facebook. He warned Facebook about numerous third-party apps, including a developer who was generating profiles of children without consent. He said that Facebook's response to him was that it did not want any negative press and that it wanted to deal with these issues to get them out of the way as quickly as possible. He proposed a deeper audit on how the data was being misused, and Facebook said, “Do you really want to see what you'll find?”

So I put it to you, Mr. Sherman, that obviously Facebook hasn't taken this issue seriously. We will have to look at regulation. Mr. Zuckerberg referred to regulation. Do you think Facebook has failed to represent the best interests of the people around the world who trust it?

[Robert Sherman]

I think it's certainly our intention to do the best we can in protecting the privacy and the information of users on our service. It's clear in this situation that we did not do enough. We're sorry for that, and we need to invest in doing more work.

With regard to notifying people about situations like this and notifying regulators, I think we found out about this in the first instance from news reporting. There was news reporting in the intervening period about this situation, and so it certainly was not something we intended to keep a secret. That said, I think notifying Canadians and others who are affected is something we should have done, and that we will do going forward.

With regard to the broader characterization of the discussions at Facebook, I don't remember working with Mr. Parakilas. He was at Facebook some time ago, and I'm not familiar with the specific discussion you're talking about—

[Charlie Angus, NDP, Timmins—James Bay, ON]

My concern is the issue of a corporate culture that has so much power over data but seems so loosey-goosey about its use, and we're talking about data that may have undermined the integrity of international elections. Mr. Parakilas was brought in to deal with the privacy concerns of Facebook, and he said that the overriding issue time and time again was to get the negative stories to stop. So three weeks ago, in the middle of an international investigation, Facebook suddenly announced it was taking the privacy concerns of Canadians seriously.

Are you here, Mr. Chan, to engage with us on the issue of regulation, or are you just here to try to make the bad story stop, which seems to be Facebook policy, as Mr. Parakilas said?

[Kevin Chan]

Absolutely, sir, we are here to engage with you substantively. On the issue of regulation, I think our CEO, Mark Zuckerberg, has been very clear that we do not oppose regulation. I think we want the right kind of regulation, and I think—

[Charlie Angus, NDP, Timmins—James Bay, ON]

Is GDPR the right kind of regulation for Canada?

[Kevin Chan]

If I may sir—

[Charlie Angus, NDP, Timmins—James Bay, ON]

That's the question.

[Kevin Chan]

There are some other things that I wish to add with respect to regulation. I think maybe Rob would have some views on the specific question that you have with respect to privacy regulation.

I just want to point out to the committee, so that people have this in mind, that I think for a lot of the things, including election integrity, which you touched on, Mr. Angus, we are not waiting for regulation. In many respects on that front, we are not waiting for regulation. We think to be proactive and do things now, when we can, is the responsible thing to do.

I'd like to comment on two other things. The first is with regard to “View Ads”, our ad transparency test in Canada. As you know members, obviously, there is no obligation to do that. We are actually rolling this out. We tested it first in Canada. Until this week, it was the only jurisdiction anywhere in the world where that was in place. Again, we are being proactive. We're not waiting for regulation. We're doing the right thing, based on what we learned coming out of the U.S. presidential election and the abuses that did happen on our platform.

With respect to regulation, the second one I would speak to is our Canadian integrity election initiative. As I mentioned in my opening statement, there is a report by the Communications Security Establishment that talked about the potential cyber-threats to the next federal election. There are a number of things in there. For two of them, we clearly had a piece of the responsibility for—again, cybersecurity and misinformation. Again, I just want to respectfully submit that we are not waiting for regulation. We are taking action now to address this well in advance of the federal election.

Maybe I'll turn it to Rob about—

[The Chair, Conservative, Bob Zimmer]

We're at the time, Mr. Chan.

Next up, we have Mr. Picard for seven minutes.

[Michel Picard, Liberal, Montarville, QC]

Thank you, Mr. Chair.

Mr. Sherman, Mr. Chan, I would like to move away from the sensational and scandalous side of the problem, while not understating how important and how serious it is.

So I would like to do a familiarization exercise with you on the situation at its most basic, so that people can really understand what we are talking about. Later, we will get back to the matter of the end user, Cambridge Analytica.

As a starting point, let me put a very simplistic deduction to you. It would seem naïve to me to think that Facebook has invested hundreds of millions of dollars simply to let people use an album—a word that the older ones among us will understand—an electronic album in this case, containing photographs of one's daily relationships and activities. It is an effective means of communication and you do not need to buy stamps or talk directly to other people.

Would a company invest hundreds of millions of dollars simply so that people can chat among themselves? I do not feel that that can be the ultimate goal of such an investment. The actual goal would be to have people participating in activities in a public forum, and, as a result, to gain access to a significant amount of not only public information, but information of all kinds, including about behaviour, material possessions, and so on. In my opinion, that has value and it is a product that can be sold.

Here is my first question. How do you determine the threshold at which private information becomes public information?

[Robert Sherman]

Sir, I think it's an incredibly important question. As you point out, our goal is to provide a service that enables people to communicate with the people, organizations, and ideas that are important to them, and to empower people to make the choices that are right for them. That's fundamentally what we—

[Michel Picard, Liberal, Montarville, QC]

That is the entertainment aspect. People use the communication service for the pleasure of chatting among themselves at little cost. You are not in business for philanthropic reasons. You are in business to sell a product or a service. Communication is only the means by which you are able to do business. If your business does well, it is greatly to your credit.

Let me ask the question again: how do you determine the quality of those two services, the service dealing with private information and the service dealing with public information? You are selling something here. We want to know what it is.

[Kevin Chan]

If I may, sir, just to back up, I think my colleague Rob was trying to get at that, but allow me to try.

The history of Facebook, as you probably know, is that it didn't start as a business. It was a project of our CEO when he was a student, and the intent was very much, as you point out, to try to connect friends. Over time that service has evolved. The core of what we do is still very much about connecting friends and family together. I think it's fair to say that at some point there was a need to monetize the platform. Advertising became a model that worked well for Facebook.

I would point out that if you roll back time to about 2014, it wasn't clear that advertising, especially mobile advertising, would work for Facebook. I would say, with all due respect, I think very much for all of us who work there and certainly for Rob and me, there was a sense of optimism—and perhaps we put too much in—in trying to help connect the world and make the world a more informed and more trusted community. I think those things are still very much our guiding north stars today.

[Robert Sherman]

If I might add with regard to advertising specifically, as you point out, that it is an important part of the service in part because it allows people to use Facebook for free, but also because good, relevant advertising can be valuable to people. I think we have a responsibility to build our advertising business in a way that also protects people's privacy. For example, an advertiser can tell us that they want to reach people who are 18 and over in Ottawa who are interested in cars. Then we can deliver the advertisement to those people without providing those people's private information back.

[Michel Picard, Liberal, Montarville, QC]

Gentlemen, stop, stop, stop, stop.

I am not talking about advertising. It is a specific question, how do you determine the difference between a piece of information that is private and another piece that is public?

It is a very simple question. If I post my holiday photographs on my Facebook page, I expect to see advertising from a travel agency that has viewed that public information. However, if I start to see advertisements connected with personal information that I have not published, it bothers me.

Who establishes the difference between what is private and what is public? That is the root of the problem. I cannot complain that a television channel has 20 minutes of commercials per hour of broadcasting. I have no choice, I have to watch them. I also expect to see advertising on Facebook, but how does that advertising target me personally? It is because, in some way, someone has defined what is private and what is public. I want to know the threshold used to determine that.

[Robert Sherman]

I certainly agree that there's a difference between public and private information. Whenever you post something on Facebook, you are able to choose right then and there whether that information will be publicly visible, whether it will be visible to your friends, or whether it will be visible to a narrower category of people.

One of the things we've invested in very heavily and which I think we need to invest more in, as Kevin mentioned, is transparency around advertising and, specifically to your point, the specific information or the specific interests that are used to judge what advertisements to show to people.

That means a couple of things. It means there are some things we shouldn't make available for targeted advertising at all. Second, it means that we should tell people—and we do tell people when they see particular ads—why they're seeing those specific ads. In my earlier example, if we think you're interested in cars, we'll tell you that that's the reason. Third, we need to put people in control. If they'd prefer not to see ads based on particular kinds of information, they should be able to do that as well.

[Michel Picard, Liberal, Montarville, QC]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Picard.

Next up for five minutes we have Mr. Gourde.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you, Mr. Chair.

Thank you, Mr. Chan and Mr. Sherman.

Along the same lines, Facebook has changed the world of information and the world of advertising in the last 15 years. Advertising on Facebook is done in a very sophisticated and very clever way. As an example, if I sell bicycles and I want to reach a certain clientele, I am going to advertise my shop on Facebook. It will then be possible for people in my region or my city looking for bicycles, or for information on a specific model, to see my advertisements at the top of the page. I feel that Facebook is capable of doing that kind of targeting. Is that true?

[Robert Sherman]

Yes, that's correct. The basic way that advertising works on Facebook is that an advertiser can come to us. An advertiser in your riding might be able to say they're selling bicycles and want to reach people in this area who are interested in bicycles. We would then deliver the advertisement to those people, as I said before, without telling the advertiser the specific people who would have seen it. But our goal is to show people ads that are relevant and useful to them. People tell us this is important when they see advertising. If we're using their time we want to make sure that people are seeing ads that they will find valuable.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Let me continue.

But that advertising still targets people who have clicked on the advertisement about bicycles. Mr. Chan, are the people subsequently receiving that advertisement grouped together by artificial intelligence, or do other people do that research?

[Kevin Chan]

It's based on the signals we receive, the things you may have liked on Facebook and interest you have expressed on Facebook. We try to have some estimation of what your stated interests may be, and through that you're going to get potential advertising because you're in a certain audience that potentially likes bikes, for example. But I do want to unpack a bit what Rob was saying earlier....