Information & Ethics Committee on April 26th, 2018

[Prof. Thierry Giasson]

That is an excellent question.

The electoral communication of third parties is of course governed by the Canada Elections Act. The courts have in fact issued numerous decisions that forced Elections Canada, around the year 2000, to review part of its legislation in this regard.

I think the digital dimension complicates the work of the heads of elections monitoring agencies such as Elections Canada, Elections Ontario, and Elections Quebec. I think they would be the first to admit that they do not necessarily have the human resources needed to do this work. I think we need to review the resources allocated to these election assessment agencies and give them all the resources they need to do this important media monitoring work. Having a diversity of platforms for political communication is all well and good, but for elections regulation officials that means having the resources to investigate all these platforms. So there is a multiplication of platforms which, in my opinion, makes the monitoring work of elections officials more complex.

[The Chair, Conservative, Bob Zimmer]

Thank you.

Next up is Mr. Kent, for seven minutes.

[Peter Kent, Conservative, Thornhill, ON]

Thank you, Chair.

Thank you, both, for attending by video conference today.

Since my late-life involvement in partisan politics in 2006, every election has seen new technologies available for use and new ways of accumulating, analyzing, and applying data to identify the voters who are supporters and those who are not. A lot of what we are hearing in this particular study of the vulnerability of our democratic electoral process with regard to the inappropriate use of user data by Cambridge Analytica or Facebook is where to draw the line.

In my experience, it is as Professor Giasson outlined—identifying voters through the electoral list, through responses or clicks on social media or political party sites, or through volunteers coming forward and providing their information.

Where would you suggest we draw the line on accumulating a certain number of data points on Canadian voters? We are told that, in the case of Facebook and Cambridge Analytica, they accumulated in their so-called information warehouse as many as 5,000 data points on more than 230 million Americans, obviously to be applied in a way to compromise or interfere with the democratic process through the vulnerabilities or preferences of those social media users. Where would you suggest we draw the line in Canada?

[Prof. Thierry Giasson]

I invite you to get with the times and recognize that holding elections in 2018, 2019 or 2020 is not the same as it was in 1998. I think you have summarized that very well, sir.

There are things that political parties could decide to stop doing or that we could no longer allow political parties to do. Personally, I think the use of social media should not be allowed. I think that for all the information that is gathered when people visit your organizations' websites or through your online petitions, there should be a box explaining what you will eventually do with the information. That way, citizens would clearly understand that when they give you their telephone number, their email address, and their postal code, this information will be entered into a database and used in targeting to determine whether or not they are interesting voters for your campaign.

Citizens do not have access to that and you do not tell them, which leads some media and researchers like myself to say that political parties are in a sense spying on citizens, collecting information without their knowledge, and using that information to manipulate public opinion during the election campaign.

I think a modern elections act should provide a very strict framework for the use of data from social media. You already have enough information at your disposal to do the kind of targeting you need to do without necessarily also collecting this information and storing it in your databases.

[Peter Kent, Conservative, Thornhill, ON]

Thank you, Professor. I certainly agree, and I think my colleagues around this committee table would agree, that transparency in terms of the acceptable use of voter data would certainly address the concerns of people who have suspicions that it might be misused. I think that, in 2015, L'actualité basically accused all Canadian political parties of spying on Canadians.

In your remarks, you talked about data brokers, not the accumulators of data, but the brokers who come in to figure out ways to apply that data to effect a certain electoral outcome. You said that these intermediaries who generate databases use various methods more or less legally. Are you aware of any cases of illegal use of political party databases in Canada?

[Prof. Colin Bennett]

One of the problems with the lack of transparency is that you don't really know where the illegality might be. There are certainly a lot of grey areas here.

In response to your question, however, I would make just two quick points.

It's very important for the committee to note that Cambridge Analytica is one of several companies that do this. Claiming to have 5,000 data points on citizens is actually not uncommon. There are several companies I could point to in the United States that do similar things. The thing that brought Cambridge Analytica to public and media attention was its use of psychographics, which I think most Canadians would really feel crossed the line. However, again, I'm not sure that it would actually be illegal.

In my judgment, the 10 PIPEDA principles provide the guidance here. In the paper I submitted to the committee, I've gone through all 10 principles and explained how our political organizations can, and should, comply with all of them. The parties already do, to some extent, but it's not complete. My plea is not only for transparency here, but also for uniformity, whereby there would be a common agreement among our major federal political parties on what is acceptable practice, online and off-line, with respect to all the sources of personal information captured on Canadians.

[The Chair, Conservative, Bob Zimmer]

You have 10 seconds.

[Peter Kent, Conservative, Thornhill, ON]

I'll hold my question for the next round.

Professor Giasson, did you have a comment?

[Prof. Thierry Giasson]

Yes. Based on the research and the interviews I've done with strategists from federal parties and Quebec-based parties, the purchasing of data from third parties or information brokers is very rare. The only instance that was documented, by a few colleagues of mine, was of the Conservatives buying some data from third parties on consumer habits. We don't know if this data was collected illegally, but I would presume not.

From the testimonies I got in my research, this is a very exceptional practice. It's not common.

[The Chair, Conservative, Bob Zimmer]

Mr. Masse is next up, for seven minutes.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

Thank you, gentlemen, for appearing today.

Perhaps I could follow up on the 10 standard principles. Unfortunately, we don't have the paper in front of us. Did you include in that submission a grading of the different political parties? Would it be fair to say that the larger political parties have an advantage, or at least a more probable case of being able to meet those standards for financial reasons, such as having internal supports and money used to ensure that those standards are actually met?

Specific to that, how does another party get started in Canada if the encumbrance is too much with regard to that? How do we not stymie democracy with that?

[Prof. Colin Bennett]

That's a good question. I don't grade the political parties. It's very difficult to do this on a common standard.

The experience in B.C., where political parties have had to comply with our legislation, which is pretty much based on the PIPEDA principles, has been quite encouraging. One of the things it forces parties to do is to consider internally all the different sources of personal information they have.

One of the difficulties with what I see at the federal level is that it is not clear what these privacy policies apply to. Some of them are based on data captured through the website, and some of them are more general.

To your point about smaller political parties, I actually think this is a way to level the playing field and allow smaller political parties into the game more effectively. This is one of the effects of social media as well. It should not be a costly compliance exercise.

Opposed to that argument, of course, is the cost of a data breach. Any organization that has suffered a major data breach will know that the costs of that, in terms of finance and reputation, are far in excess of the costs put in up front to develop a clear privacy code and some transparency for the Canadian electorate.

Mr. Masse, you asked an extremely good question. It needs far more analysis, but that would be my response at the moment.

[Brian Masse, NDP, Windsor West, ON]

This is my sixth term here, and I've seen blatant electoral fraud, which has even had the consequence of members of the House having to resign from their active seat.

To follow up, would it enhance our democratic response? I know that we have chronic underfunding for the Privacy Commissioner, the Competition Bureau, and the Chief Electoral Officer, but if there were rules prescribed, for example, by an independent body like the Chief Electoral Officer, with an enforcement mechanism, in terms of how data is accumulated and used, and those responsibilities, which would be enforceable by punishment of law, in an ideal world, would that be the way to govern a set of rules that would then be applied across established political parties or those trying to find roots in Canadian democracy?

[Prof. Colin Bennett]

I think that this would be one approach, yes, but my plea is for some more detailed legal analysis on this. I think one of the dilemmas here is that the Chief Electoral Officer knows political parties and knows the regulations on political parties, but he is not necessarily resourced and adept at dealing with privacy issues. The Privacy Commissioner has those skills and resources but doesn't have the legislative mandate to do that, so it falls between the cracks. The other institution that is responsible here is the CRTC, of course.

I think there will have to be some very careful legislative and constitutional analysis on this question. In the meantime, I don't see any reason why there couldn't be a code of practice agreed to, under the auspices of the Privacy Commissioner and the CEO, perhaps jointly, that would have the effect of establishing a more level playing field, establishing more transparency, and preparing for the day when legislative rules come in.

[Brian Masse, NDP, Windsor West, ON]

Do you have anything to add there, Professor Giasson?

[Prof. Thierry Giasson]

I agree with what Dr. Bennett said.

[Brian Masse, NDP, Windsor West, ON]

What's your opinion with regard to third party use of accumulated data by political parties? One of the things I have a concern about, and I think Canadians do as well, with regard to Facebook and other data accumulation models, is the unknown fact of where data can go and how it can be used. It would require a major policing effort to try to even enforce such laws.

At any rate, how egregious do you think that is for democracy, the fact that political parties can either bring in third parties or use third parties to augment, support, and use the data they have?

[Prof. Colin Bennett]

To your first point about transfers of data, I think this is where the rules concerning the GDPR are so relevant. Europeans are insisting, of course, that for any data transferred to Canada there be strong onward transfer restrictions. Facebook and other private sector organizations have to comply with those rules. That's point number one.

With respect to the rules about consent and political parties, I think that bringing the entire ecosystem, if you like, into a similar set of rules would allow an organization like the Privacy Commissioner to see the entire picture in the way that the Information Commissioner in the U.K., at the moment Elizabeth Denham, is able to do.

[The Chair, Conservative, Bob Zimmer]

You have 30 seconds.

[Brian Masse, NDP, Windsor West, ON]

You mentioned spying. Spying is more of a proactive approach, as opposed to a recipient approach in terms of data. Can you maybe highlight where you think the political parties might be spying? My interpretation is that it requires more of an overt effort, as opposed to just accumulating data and using it.

[Prof. Thierry Giasson]

Go ahead, Colin.

[Prof. Colin Bennett]

These words get thrown around in the media and, of course, they're not necessarily accurate. I think it's the lack of transparency and trust that creates that kind of discourse. I believe that political parties have a fundamental and important role in our democracy, and they need personal data in order to reach out to Canadians, but there needs to be a balance struck. The PIPEDA principles, I think, provide exactly the right set of standards by which that balance can be effectively struck. Moreover, when they were developed back in the 1990s—and I was part of that process—the application of those flexible principles to situations exactly like this one was anticipated. Then they became part of PIPEDA.

That would be my answer to your question, sir.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Masse.

Next up is Mr. Saini, for seven minutes.

[Raj Saini, Liberal, Kitchener Centre, ON]

Good morning to both of you, gentlemen. Thank you very much for appearing.

Mr. Giasson, I want to start with you.

I was very interested in a study you did, which you published in the Canadian Journal of Communication. It was done during the 2011 election campaign. You put McGill students through different political ads, both negative and positive, and you measured their response physiologically and cognitively.

I am wondering if you could review the results of the experience, and the specific difference you found between a positive and a negative ad.

[Prof. Thierry Giasson]

Okay.

We conducted an experiment to see if negative election ads evoke different reactions from people, as compared to the ads that we researchers call “promotional advertising” and that you just called “positive advertising”. Instead of attacking its adversaries, the party promotes its platform, record or team. We found that people responded to negative advertising with heightened attention. Their pulse quickened.

We measured people's pulse, as well as cutaneous sweating. We also asked people to spontaneously indicate their first impression after each ad. We refer to that as “spontaneous cognitive responses”. This method is very commonly used in social psychology to measure people's level of cognitive engagement.

We realized that election ads, especially ads that attacked the party that the elector supports, triggered cognitive processes to protect the ego. People tried to find arguments to destroy the negative argument that was presented. Based on the increase in skin conductance and pulse, we realized that people responded more intensely to negative ads.

In short, that is what we concluded from that work. The type of ads people are exposed to triggers different physiological and cognitive reactions.