Information & Ethics Committee on April 19th, 2018

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

There's an app developer of a game called Cow Clicker who posted about it on The Atlantic's site. He said it was a really rudimentary game. If I had clicked on that app and played this ridiculous Cow Clicker game, the developer would have had access to my friends' marital statuses. Does that make sense to you?

[Robert Sherman]

It doesn't. It's one of the things in our developer policies, which we require all developers to abide by. We impose a series of restrictions on what information they can collect and how they can use it. Among those restrictions is a rule that says developers cannot ask for more information than they need to operate the service they're providing. Since 2014, we've operated an upfront review process that looks at that, among many other things. But certainly, it's not our intention that apps use the Facebook platform to collect information they don't need. As we announced several weeks ago, we're making much more significant restrictions in the amount of information that most apps can get.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Unfortunately, those changes are only being made now that this situation has been made public and not because you ever thought it was the right thing to do.

Thanks very much.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Erskine-Smith.

Next up, for seven minutes is Mr. Kent.

[Peter Kent, Conservative, Thornhill, ON]

Thank you, Mr. Chair.

Thank you, Mr. Chan and Mr. Sherman, for attending this committee today. It's good to see you again.

These data mining scandals seem to have finally penetrated the consciousness here in Canada that the data world is one that is largely without national boundaries, without effective protection or regulation of the personal information that Canadians voluntarily or unconsciously surrender as their part of the contract to use your service. In many ways, it is a fine service; I use it politically and have no complaints in that area. But, of course, our focus here is on the abuses that data mining has, and would potentially have, to interfere in our democratic process.

Where should Canadians look at Facebook for responsibility and accountability: to your Canadian entity or to the parent company? When did Facebook Canada learn of the abuse of personal users' privacy, and did Facebook Canada, Mr. Chan, individually and separately, hold back the reporting of that abuse for two years as the parent company did? Were you aware of that breach for the past two years?

[Kevin Chan]

No, sir. To talk about the particular instance, we knew, I think, as everybody learned through press reports—I forget the exact date—about a month ago or something like that, sir. That would be the extent of our knowledge in Canada.

[Peter Kent, Conservative, Thornhill, ON]

As you know, our Conservative government strengthened Canada's Personal Information Protection and Electronic Documents Act, PIPEDA, just before the election in 2015. This Liberal government, after sitting for three years on creating some of the regulations introduced in that legislation for the breach of security safeguards regulations, yesterday very quietly posted regulations on the Canada Gazette regarding the timely reporting of breaches to the Privacy Commissioner and to affected individuals.

Can Facebook Canada assure this committee that at the next violation of users' privacy, Facebook won't hold back that information for two years as it did in this case?

[Kevin Chan]

Sir, absolutely, we are already taking action, as Rob mentioned. We are already taking action to notify all users of the particular instance regarding Cambridge Analytica. Our commitment, and the commitment of our CEO, is that, in fact, we're going to go back and do an audit of all the other apps that were in place at the time when the platform permissions were set a certain way. If we find evidence of wrongdoing there, we will also suspend and prevent those apps from functioning on Facebook. Then we will notify all potentially affected users for those apps as well.

Absolutely, going forward, that is very much our intent, sir.

[Peter Kent, Conservative, Thornhill, ON]

Thank you.

When elements of our committee visited Facebook's headquarters in Washington last October—and thank you for your hospitality, for sharing assurances on the company's commitment to social media operations and precautions, and for the demonstrations of some of the wonderful new products, like the oculus virtual reality devices—we discussed in general the possibility of new regulations here in Canada with regard to PIPEDA, or perhaps even going beyond the existing regulations with more meaningful regulations and penalties for violations of Canadian users' privacy.

We were told, almost in passing, that any new Canadian regulations might well put at risk Facebook investments in Canada along the line of the $7 million invested in the artificial intelligence project in the Montreal hub.

I wonder whether today, after Cambridge Analytica, AIQ, and Mr. Zuckerberg's testimony in Washington last week, that same caution against more meaningful regulation would still be made by Facebook to Canada?

[Kevin Chan]

Sir, I will turn to Rob for the more specific answer about what the prospective view is. I just want to be very clear, sir, that we certainly do not base our investment decisions on the specific regulatory environment. In particular, I did read some reference to some interview somewhere about about our AI research centre specifically. I just want to be very clear that it is not at all our view. That is not the representation we would have made. In fact, it's quite the opposite: we are quite proud to be supporters of AI in Canada, in Montreal and in Quebec. We are a global leader in this regard and Facebook is very proud to be part of that. I just want to be very clear.

Just last week we were in Montreal where we held an event in partnership with the Canadian Institute for Advanced Research celebrating the Montreal AI ecosystem. At no time would we have made investment in our AI lab contingent on any other consideration than the fact that there is talent in Canada and we feel fortunate and honoured to be a part of that.

[Peter Kent, Conservative, Thornhill, ON]

Mr. Sherman.

[Robert Sherman]

Sir, with regard to the PIPEDA study more broadly, we appreciated the committee's attention to this issue. Canadians deserve strong privacy protections and we appreciated the opportunity to provide information as part of that study.

I think in looking at privacy regulation more broadly, it's important, as the committee's report pointed out, that Canadians have information and transparency about how their information will be used and that they're in control of that information. A lot of those concepts exist in PIPEDA as it stands today. If you look at Facebook's history in Canada and our engagements with the Privacy Commissioner, a lot of the improvements, including many of the improvements that we talked about around the Facebook platform, come directly out of our engagement with the Privacy Commissioner.

I note that the committee has suggested several changes and improvements that might be made. I think it's appropriate to look at those, and one of the ones that you've already mentioned around data breach notification particularly is something that we've learned some hard lessons about and is certainly worth taking a look at.

[Peter Kent, Conservative, Thornhill, ON]

Just very briefly, one of our recommendations was for the government to consider more closely aligning with the European Union's general data protection regulation that comes into effect in May of this year. Would Facebook be comfortable, the parent company of Facebook Canada be comfortable, if Canada were to adopt similar GDPR regulations?

[Robert Sherman]

We think everybody who uses Facebook's service globally deserves strong privacy protections. That includes people in Canada, of course, and people in Europe. We've put in a lot of work, as we have in Canada, to provide those strong protections. As a part of our work to prepare for GDPR, we've built a number of new privacy controls settings and other engagements, and those are things that we plan to roll out in Canada as well.

[Peter Kent, Conservative, Thornhill, ON]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Kent.

Next up for seven minutes is Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Mr. Chan, Mr. Sherman, for joining us this morning. At the outset I want to say that Facebook in my region has been revolutionary. I represent a region that's bigger than the United Kingdom. I have communities that have no access to roads. I have some of the poorest communities in North America. The access that Facebook provides young indigenous people, for people contacting my office.... I don't use the phone anymore. If I have a medical crisis in Kashechewan, I get a message on Facebook and they get a response. So the power of Facebook to do good is incredible, but we are here because the power for Facebook to be misused for terrible things is also at issue.

The question before us is the failure of Facebook to respect the absolute power it has. The sense is that in some ways it thinks domestic laws are somehow quaint. I was very surprised this morning to learn that Facebook has shifted 1.5 billion users from Facebook Ireland to Facebook California to escape the GDPR.

Mr. Chan, will you tell this committee that as an act of good faith you will immediately implement the GDPR for all users in Canada for Facebook?

[Kevin Chan]

I think I'll let Rob address that one.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Chan, you represent Facebook Canada. He represents Facebook California. I want to know will you put in the GDPR? Will you commit today so that you don't have to be regulated to do it, but that Facebook will self-regulate in Canada with the GDPR. Yes or no?

[Kevin Chan]

Sir, I'm not aware of the point that you just raised. I'm not familiar with the point you say you've just learned.

[Charlie Angus, NDP, Timmins—James Bay, ON]

We're talking about 1.5 billion users who were shifted to escape European law this morning.

[Robert Sherman]

Mr. Angus—

[Charlie Angus, NDP, Timmins—James Bay, ON]

Will you just say, “We'll implement in Canada”? Then we can move on to the next question.

[Robert Sherman]

Mr. Angus, our plan is to provide the same privacy controls and settings that we're offering in GDPR, the same engagements on the same topics to people in Canada that we're offering to—

[Charlie Angus, NDP, Timmins—James Bay, ON]

Will you implement the full GDPR? I mean, you tell us you're going to do tweaks. Why would you need to move 1.5 billion users out of the range of the European law?