Information & Ethics Committee on April 26th, 2018

[The Chair, Conservative, Bob Zimmer]

We'll call to order this morning's meeting of the Standing Committee on Access to Information, Privacy and Ethics, meeting number 102. Pursuant to Standing Order 108(3)(h)(vii), we're doing a study on the breach of personal information involving Cambridge Analytica and Facebook.

This morning, as individuals, we have Colin J. Bennett, professor in the department of political science at the University of Victoria, and Thierry Giasson, professor in the department of political science at Université Laval. In our second hour, we have Marshall Erwin with the Mozilla Corporation.

We'll start off this morning with Mr. Bennett.

[Prof. Colin Bennett, Professor, Department of Political Science, University of Victoria, As an Individual]

Thank you, Mr. Chair.

Can you hear me okay?

[The Chair, Conservative, Bob Zimmer]

Yes, we can hear you very well.

[Prof. Colin Bennett]

Good morning. I'm delighted to be with you again today and to appear with my colleague, Professor Giasson.

I am a professor of political science at the University of Victoria. I have been studying and publishing on privacy protection issues for around 30 years in Canada and internationally. In 2012, I co-wrote a report for the Office of the Privacy Commissioner on the use of personal data by Canadian political parties. Since then, I have been researching the nature and influence of data-driven elections in Canada and overseas, and I have been warning about the implications for privacy and other democratic values.

The current controversy that you are investigating raises a range of interrelated issues, and it is important to carefully distinguish them. There is the monopoly power of companies like Facebook in the platform economy, the harvesting of data on one's social network through third party applications, violations of campaign spending limitations, issues concerning the accountability of targeted political ads, cyber-threats to election integrity, the larger role of big data in our elections, and what I really want to talk about today, which is the role political parties play in data-driven elections and their relationship with our regime of privacy protection.

Cambridge Analytica and AggregateIQ are part of a larger voter analytics industry. There are many other companies, mainly American, that have taken advantage of more flexible privacy standards in the U.S. and the ability to process vast amounts of personal information from public and commercial sources, used to micro-target consumers in an increasingly granular manner.

There has been a lot of hype about the importance of big data in elections and recent scholarly work that sheds a skeptical light on the extent to which data analytics do indeed influence election outcomes. Nevertheless, the competitiveness of current elections continues to place enormous pressure on major political parties in most democracies to continue to use data analytics to gain any edge over their rivals. Thus, more data on voters are being captured, and those data are increasingly shared through a complicated and dynamic network of organizations involving some quite obscure companies that play important roles as intermediaries between the voters and their elected representatives.

This industry is not as extensive in Canada, but there is still a large variety of businesses that offer various services on polling, data analytics, software development, digital ad placement, social media outreach, and so on. We lack a comprehensive understanding of the role that personal data plays in the political process in Canada, and we lack an accurate picture of this industry. I'm going to let my colleague, Professor Giasson, speak more about this.

I have followed your hearings very carefully. The investigation is an important beginning, but it is only a beginning, and we need a lot more analysis. I would like to make three general points about policy development going forward.

My first point is the critical importance of bringing Canadian privacy law in line with the GDPR. The recent decision of Facebook to move the data on all its non-European users from Ireland to the United States is motivated in part by a desire to escape some of the more stringent rules inherent in the GDPR. To discourage this kind of jurisdiction shopping, it is critically important that Canada raise its privacy standards to make it more difficult for companies to engage in this kind of behaviour. Your February report is an excellent start.

Particularly critical for these issues about the processing of information on political opinions, which is defined as sensitive to data in the GDPR, is the need, first, to strengthen PIPEDA’s consent provisions; second, to implement provisions for algorithmic transparency, as you advise; third, to make privacy by design and default central legislative principles in PIPEDA; fourth, to strengthen the Privacy Commissioner’s audit and enforcement powers; and last, to clarify those categories of sensitive personal data, including those on political opinions.

My second point is that there is a pressing need to bring our political parties within Canada’s regime of privacy protection law. I have testified about this to you before. One of the keys to preventing the kinds of abuses we've seen in other countries is to establish some clearer and consistent rules on the kinds of data that political parties may use for campaigning purposes. We need to establish a level playing field that essentially prevents companies like Cambridge Analytica from engaging in the same practices in Canada that have been witnessed elsewhere.

We are one of the only advanced democratic countries where privacy protection law does not cover political parties. For the most part, they are not covered by PIPEDA. They are not government agencies. They are not covered by the Privacy Act. They are also largely and expressly exempt from the anti-spam legislation, as well as from some of the do-not-call list regulations administered through the CRTC. There are privacy and security rules within the Canada Elections Act, but these apply to the voters lists, not to other sources of personal information.

Thus, with respect to political parties, Canadians do not have the legal rights that they have with respect to both government agencies and commercial operations.

Moreover, whereas the Privacy Commissioner can investigate Facebook, he cannot investigate the practices of our political parties, so he cannot get the full picture in the way that the Information Commissioner in the U.K. can, and is, under her current investigation.

There are four legislative options with respect to regulating federal political parties: the Privacy Act, the Canada Elections Act, PIPEDA, and stand-alone legislation. There is a need for serious legal and constitutional analysis about the various legislative options, because each approach has its pros and cons. I could go into this in the Q and A, if you'd like.

However, it does appear to me that the status quo in this respect is untenable. First, there is going to be continuing publicity about the use of personal data in elections, which will only increase leading up to the federal election of 2019, particularly with respect to political micro-targeting on Facebook.

Second, it should be noted that political parties do have to comply with B.C.'s privacy law, the preferred Personal Information Protection Act. The commissioner in B.C. is currently investigating the practices of B.C.'s provincial parties. I believe, as do many, that federal political parties are also governed by this legislation to the extent that they are capturing information on voters in B.C. If federal parties have to comply with B.C.'s privacy legislation, which is consistent with PIPEDA, then there is no sensible reason why they should not extend those same good practices across the country.

Third, I do sense a growing recognition among parties that pursuing good privacy management practices is in their interests, as well as those of citizens.

Finally, therefore, my third point is that political parties should self-regulate as far as they can to improve their privacy policies and practices. Legislative change might take some time. In the meantime, though, there is much that parties can do to self-regulate and restore public confidence.

I have analyzed the privacy policies of federal and provincial political parties, and the commitments that have already been made. I've shared this paper with the committee, and I understand it's being translated.

There have been some improvements since our 2012 report, but they are still incomplete and, in my view, inadequate. None provide clear commitments against all 10 principles contained in the national privacy standard, which is at the heart of PIPEDA.

I don't see why all parties can't publicly endorse these principles and adhere to a common privacy code that comprehensively addresses the protections for all personal information under their control. It's not enough, but it would create a more level playing field. In 2013, the Chief Electoral Officer recommended that adherence to such a code be a condition for receiving the voters list. It's unlikely that one party would pursue such a course on its own, so leadership will be necessary, involving the CEO and the Privacy Commissioner.

In my view, in terms of what should change, there should be greater transparency on the sources of data, captured directly or indirectly, that enter parties' voter relationship management systems; a common commitment that parties do not and will not purchase commercial sources of personally identifiable information; an agreement on how social media platforms should, and should not, be used for electoral purposes, particularly with respect to automated bots; commitments to privacy accountability, including designated chief privacy officers, and better training of staff and volunteers on privacy and security; stronger commitments to provide rights of access and correction to individuals; better management and updating of internal do-not-call lists; a common commitment to provide unsubscribe options for email and text messages; better management of the access to party databases; and clearer policies about how to respond to data breaches.

None of this should be difficult or contentious, and I don't think it should be a party-political issue. Political parties have a responsibility to educate and mobilize the electorate, but there should also be an appropriate balance between their important interests and roles and the privacy rights of Canadians.

No organization likes data breaches—just ask Facebook. Just think of the ramifications of a major data breach for any political party in the course of an election campaign.

Thank you very much for your attention.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Bennett.

Next up is Mr. Giasson, for 10 minutes, please.

[Prof. Thierry Giasson, Full Professor, Department of Political Science, Université Laval, As an Individual]

Thank you, Mr. Chair and members of the committee.

My name is Thierry Giasson. I am a full professor in the department of political science at Laval University. I am also the director of the Groupe de recherche en communication politique.

To start, I would like to thank you for your invitation to share with you the findings of some of my work on how political parties collect and use data from digital tools and media. I would like to recognize the importance of the study you began a few weeks ago further to the media reports about Cambridge Analytica and possible ramifications for Canadian citizens.

To avoid going over the same information that my colleague Colin Bennett will be sharing with you, I will limit my remarks to how political parties in Canada and Quebec currently collect and analyze digital data.

Many of you are of course familiar with these practices. However, as your proceedings are public, and the average Canadian citizen is less familiar with these practices, I thought it was worth explaining them for the benefit of the general public.

My presentation focuses on three areas.

First, I will talk about some of the current practices for collecting personal information that political parties use for electoral marketing purposes or political communications. I will then examine what types of personal data political parties use, and how they compile it.

Second, I will introduce the objectives associated with analyzing this data and the analysis methods preferred by the parties. I will examine why political parties analyze data on Canadian voters.

Last, I will go over some of the implications for Canadian democracy associated with using Canadians’ personal digital data.

To begin, what data is compiled by political parties, and how is it collected?

First of all, it is important to mention that collecting and analyzing Canadians’ personal data has been part of the political marketing process that political parties have used for more than 30 years, but it has increased dramatically in the last 15 years or so.

Political marketing involves an in-depth analysis of segments of the population so that election decisions can be made that will help the party identify the electoral districts and segments of the electorate to focus on during the election campaign in order to generate votes. The entire process is intended to help the party gain votes.

The purpose of political marketing is to create more targeted voter messaging and, ultimately, to win elections. The more accurate and extensive the data, the higher the quality of the analysis will be. For many years, election marketing was based on survey data and discussion groups. In the past 10 years, however, parties have also been using personal data collected online, primarily because that data is geotagged.

When a person has an account on a social media platform, they often provide their postal code, for instance, which pinpoints their location very accurately. This gives political parties a very precise, almost granular level of detail on voters. All these forms of data are added to analysis platforms and run through various mathematical procedures or algorithms. We will come back to this in a moment.

The political parties collect personal information in three main ways. First, several months before an election is called, Elections Canada and the other provincial election bodies give the parties access to all the personal information on the voter registration list. These lists provide citizens’ names and addresses and so forth. To this initial data, the parties then add aggregate data from national surveys carried out for the parties by market research firms, and from research reports produced by organizations such as Statistics Canada. In addition, for the last decade, parties have been mining citizens' personal information online. This data may be volunteered or it may be provided to political parties without the citizen’s knowledge.

Political parties collect information when voters provide their email address, postal code or phone number on the party website, when they attend a partisan event, or when they sign an online petition sponsored by the party on a specific issue.

This information is given willingly to the political parties by citizens. However, most people don’t know what the parties do with it. Moreover, as my colleague Colin Bennett pointed out, the parties are not required to tell them what exactly they will do with that information.

Next, parties can collect information on voters by studying users’ social media usage. All the major social media companies such as Facebook, Google, and Twitter offer their corporate clients various forms of aggregate data on how people react to the messages that political parties post on social media platforms. These companies also offer consulting services to political parties to develop targeted communication campaigns for specific sub-groups of users.

Lastly, and this is rarer in Canada, political parties can also purchase personal digital information on Canadians through companies specializing in that field. Those companies sell data on the consumption habits or debt levels of customers, for example. These data brokers are commercial intermediaries that generate databases using various methods, more or less legally, and sell the information, almost always without users knowing it.

For example, that is what AggretateIQ, the Cambridge Analytica intermediary, was doing. It harvested personal information on users through a digital application linked to Facebook, which Cambridge Analytica then resold to its clients to be used to target voters and certain segments of the population.

Why do parties collect data in this way, and how is the data analyzed?

As parliamentarians and active members of your respective political parties, you are well aware that Canadian political parties are seeing a drop in membership and funding, while at the same time voters are more flexible in their party loyalties and more critical of our political institutions.

Many of the strategists I interviewed as part of my research told me that the leaders of Canadian political parties now have to overcome major organizational hurdles to win an election. In the last 20 years, they have turned to political marketing and digital communication to try to generate new human and financial resources.

As political marketing integrates into contemporary campaign development in Canada, it does so in a context of major technological change. Election preparations and political marketing combine traditional approaches to political organization and emerging approaches that, as you know, involve a variety of online and offline platforms.

Influenced by the technological innovation used in the American presidential elections in 2008, 2012, and 2016, political parties now make digital tools a central part of their election preparation process. This has led to the emergence of a new category of political strategists specializing in social media, computer scientists, mathematicians, and software engineers, a whole cohort of data analysis specialists. These people did not work for political parties 15 years ago, or were responsible for creating websites or disseminating content at that time. They were not necessarily responsible for focusing specifically on election campaigns. These digital strategists are now at the centre of organizational processes and election campaigns.

In 2004, the Conservative Party of Canada was the first party to use a voter analysis system linked to a database with personal information on Canadian voters. Leading up to the 2015 election, the NDP and the Liberal Party also developed their own databases to target voters, and collected and analyzed citizens' information. Segment profiling is done using computer-based algorithms that identify the co-occurrence of socio-demographic and political characteristics among voters, whose information is aggregated in databases.

The parties now collect this information on voters in a permanent database, particularly through online advertisements and social media applications such as Twitter and Facebook. Political parties pay these companies to access the metadata of their subscribers. Geotagged information from social media provides the parties with information on users’ socio-demographic characteristics, how often they visit that social media platform, and what they like or share.

Using political marketing leads the parties to develop election platforms that are more targeted and tailored to individuals. The party’s position addresses the priorities of a select group of voters, their targets, who are identified during the market study and selected based on their potential for a positive reaction. For example, this targeted approach led the federal Conservatives to make niche commitments, such as the tax credit for tools for people in the trades, the universal child care benefit, and eliminating the federal long-gun registry.

Once again, digital technology is used for communicating these hypertargeted messages. Targeting election communications ensures that party messaging reaches the micro-audience that it is exclusively intended for.

Everything done online, including collecting and analyzing Canadians’ personal digital information, has the end goal of putting the parties in direct contact with individual voters and persuading them to get out and vote. You can appreciate that the obsession with winning the election will always be the driving force behind what political parties do, and that includes collecting and using personal information.

In conclusion, this brings us to the risks to Canadian democracy that these practices may pose. While they do help political parties overcome the strategic challenges I mentioned earlier, in my opinion and in that of various other Canadian researchers, these emerging election organization practices compromise the quality of our democracy and our civic duty. The growing use of political marketing and voter analytics is largely taking place behind closed doors, unbeknownst to Canadians. This restricts both the representation of interests and information sharing, thereby progressively eliminating the concepts of the common good and public debate.

Exercising citizenship and election choices...

[The Chair, Conservative, Bob Zimmer]

Mr. Giasson, we are one minute over. Are you just about done?

[Prof. Thierry Giasson]

I'm just about done.

[The Chair, Conservative, Bob Zimmer]

You have 30 more seconds, and then we'd better move to questions. Thank you.

[Prof. Thierry Giasson]

That's perfect.

Despite growing media interest in the role of voter analytics and algorithms in election campaigns, everything that is going on, including the Cambridge Analytica affair, is being done without Canadians' knowledge, and most Canadians are largely unaware of the extent and effect of the parties' use of their private data. This has a major impact on our democracy.

So I call upon you, members of the committee who are examining these issues, to try to provide serious food for thought for the government to consider in order to establish a better framework for the use of this information and to ensure that Canadians fully understand how their information is being used.

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you.

First up, we have Mr. Erskine-Smith, for seven minutes.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thanks to you both.

I want to start with transparency in advertising. My question is for Mr. Bennett, or for you both, actually. When it comes to the targeted nature of ads, we've always had targeted ads in politics in different ways. People advertise in specific magazines because they think that this readership is more likely to respond to a message, as indicated in your opening comments. If there is a particular issue that Canadians might be interested in because they have kids or because they own a gun, or whatever the case might be, messages get targeted, and really always have been. It's often information that is not collected digitally, but collected at the door. A real issue seems to be the transparency in the targeted nature of these ads.

I don't know if you're aware, but Mr. Wylie was just before Congress and proposed some recommendations for transparency in political advertising. Perhaps you could both speak to the importance of transparency and what that transparency actually looks like in practice.

[Prof. Colin Bennett]

Perhaps I'll defer to Thierry first on that.

[Prof. Thierry Giasson]

Thank you for your question.

I think that is the crux of the matter and what is of interest to the entire population, I would say. There is no transparency right now. Can you hear me?

Do you hear me?

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I don't have translation.

[Prof. Thierry Giasson]

I'll say it in English. That's fine.

The core question of the debate we are having right now is that there is no transparency. People are not aware of what parties are doing. The fact that parties are doing targeting is not necessarily a huge issue. As you say, advertising and electoral communication are, and always have been, a targeted business. However, the fact that citizens are not aware of what parties are doing with the data they're collecting is a problem, and that's the core problem. Parties need to ensure that whenever citizens grant access to any form of data that could be used for a political targeting purpose, they must be made aware of that.

[The Chair, Conservative, Bob Zimmer]

Sorry, Mr. Giasson. You can go back to French. Your English is very good, but our translation should be working now.

[Prof. Thierry Giasson]

As I was saying, transparency is the crux of the matter. There has in fact always been targeted communication.

Are you not hearing anything?

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

It's not working for me. I'm not sure why.

With respect to transparency, I'll propose two solutions. One solution is that, when political parties put out ads online, there be a central repository that's accessible to the public to see all ads that have been posted. Individual campaigns can submit them in a public fashion to Elections Canada, which would then have them posted in a central repository. There are different solutions to this, but all ads must be made publicly available to individuals who are concerned about the targeted nature of these ads.

Second, if I receive a targeted ad on Facebook or otherwise, I should be able to see the underlying characteristics that made up that targeting: whether it's because I'm between the ages of 30 and 40, or I am a white male, or I have an interest in baseball or whatever the case might be. I should be able to see the specific characteristics that the campaign has selected to reach me.

Do you think those two solutions are sufficient, and if not, what else should there be?

[Prof. Colin Bennett]

I'll speak to that. My understanding is that Facebook has started that process in an experimental manner in Canada to identify the sources of ads that are targeted in Canada. Yes, I agree with that. It's also worth noting that those kinds of procedures would pretty much have to be in compliance with GDPR if this is done, and it is done in Europe. That's an important note.

I'll just add one other thing concerning the social implications of the lack of transparency. That creates, of course, an incentive for candidates to say one thing to one group of voters and another thing to another group of voters, because it is not transparent. That has also been shown to contribute to the phenomenon called the filter bubble, in which there is no common discourse across a political system about solutions to public problems.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

This is my last question, and then I'm going to pass it over to my colleague Ms. Fortier. Which one of you is most expert in PIPEDA?

[Prof. Colin Bennett]

That would probably be me.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

We had representatives from Facebook before us, and they indicated that 272 Canadians gave consent to an application that shared the personal information of over 600,000 Canadians, including possibly private messages.

In your view, given your understanding of PIPEDA, is that in compliance with the existing law?

[Prof. Colin Bennett]

No, I don't think it is. Furthermore, Facebook has been under investigation by the Office of the Privacy Commissioner since 2009. This whole issue about access to people's personal information through third party applications was investigated back then. Audits were ordered back then, and still the problem persists. I personally don't believe it is in compliance. It is non-consensual capture of data on Canadians, and my own view is that it would be in contravention of PIPEDA, although we would have to see what the Privacy Commissioner says. It would certainly be in contravention of the GDPR.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Thank you.

I have a quick question.

In the by-election that I won last year, in Ottawa—Vanier, a situation arose between a third party and one of my opponents who wanted to bring forward a certain issue.

Do you think this kind of conduct could pose a risk in an election campaign? Do you think third parties will make greater use of online platforms during their campaigns or is it hard to track that kind of coordination?