Information & Ethics Committee on May 10th, 2018

[The Chair, Conservative, Bob Zimmer]

I call the meeting back to order. My apologies for the quick changeover and the limited time to get settled.

I especially want to thank our witnesses today. Colin McKay is Head of Public Policy and Government Relations for Google Canada. We've met before. From the Council of Canadian Innovators, we have Mr. Jim Balsillie.

Welcome.

Due to our limited time, opening statements are five minutes.

We'll start off with Mr. McKay from Google.Thank you.

[Colin McKay, Head, Public Policy and Government Relations, Google Canada]

Mr. Chair, and members of the committee, thank you for the invitation to appear today. It's a pleasure to be speaking with you again about these important topics.

I'd also like to acknowledge that today is a particularly emotional day for Parliament. I had the good luck to spend time with Gord Brown both on and off the Hill, and I know he will be missed.

Google works hard to provide choice, transparency, control, and security for our users, and we appreciate the opportunity to tell you about how we protect Canadians and our billions of users around the world. I thought it might be a helpful context for this conversation to quickly touch on Google's presence in Canada.

For a company that is just 20 years old, we have some deep Canadian roots. Sixteen years ago, Google selected Canada as the location of its first international office. Since then, we have steadily grown to over a thousand employees in Canada, with over 600 programmers and AI researchers in Montreal, Waterloo, and Toronto. Our mission is to organize the world's information and make it universally accessible and useful. Google services provide real benefits to Canadians, whether it's Search, Maps, Translate, Gmail, Android, Cloud, or our hardware devices, our products help people get answers, organize their information, and stay connected.

Our advertising products help Canadian businesses connect with customers around the globe, and our search tools help Canadians find information, answers, and even jobs. Just a few weeks ago, we rolled out new ways for Canadians to find jobs using Google Search.

As you may know, Google has invested significantly in Canada's burgeoning artificial intelligence ecosystem, not only through the funding of organizations like MILA in Montreal and Vector in Toronto, but also by establishing research labs that have helped Canada attract and retain world-leading talent.

Our engineers work on significant products like Gmail, the Chrome browser, and Cloud, products used by billions of people around the world. We have a Canadian team developing safe browsing technology that prevents malware attacks and phishing scams, keeping the open web safe and secure.

This brings me to how Google has long thought about privacy and security. Google has been investing in tools and teams over the past five years to provide users with industry-leading transparency, choice, and security regarding their data. We offer tools such as My Account, Security Checkup, Privacy Checkup, Takeout, Google Play Protect, and more, all with the aim of protecting users' data, allowing users to make easy and informed privacy decisions, and affording users the opportunity to easily take their data with them to other platforms.

In 2015, we launched My Account, or myaccount.google.com, which provides Canadian users with quick access to a centralized, easy-to-use tool to help manage their privacy and security. This is used extensively. There were over two billion visits globally to this tool in 2017, including tens of millions by Canadians. While we continue to promote the use of this tool, it's clear that awareness is growing and that Canadians are using it to make informed choices.

Google promotes Privacy Checkup to users on a recurring basis so we can help our users keep their privacy choices up to date as their use of Google services changes over time. Users can see the types of data Google collects, review what personal information they're sharing, and adjust the types of ads they would like Google to show them. In addition, we have a tool called Security Checkup which helps users understand what devices and apps are accessing their data.

On our Google-licensed Android platforms, we've developed Google Play Protect, which monitors devices for potentially malicious apps. We design our products and implement product policies that prioritize user privacy. It's part of our commitment to ensuring our users understand how we use data to improve their experience with Google products and services. It's hard to keep data private if it's not secure, which is part of the reason we have built such a strong security team at Google. It's also why we have not only focused on the security of Google and our services, but have helped the entire Internet industry bolster security through our leadership with projects like Safe Browsing, HTTPS Everywhere, email encryption in transit, and our leadership on promoting two-factor authentication security keys.

We know that our users are people. They are family members, friends, and neighbours. Some are relying on our products to build their company, and they're non-profit. Others just need help finding a product, an address, or opening hours, but every one of them is putting their trust in us, and we recognize the enormous value of the trust Canadians put in us.

Thank you again for the opportunity to be here today, and I look forward to answering your questions.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. McKay.

Next up, for five minutes, is Mr. Balsillie.

[Jim Balsillie, Chair, Council of Canadian Innovators]

Thank you.

Mr. Chairman, and committee members, I have closely followed your committee because I believe Canadians are facing the most important public policy issue of our time: data governance.

Canada's innovators know that data flows have transformed commerce and made data the most valuable asset in today's data-driven economy. Businesses use data to create as well as access new markets and to interact globally with both customers and suppliers. Control over data and networks allows dominant firms to hinder competition and extract monopoly rents from their customers and to deceive consumers via their data collection strategies. Vast troves of data are collected and controlled by foreign unregulated digital infrastructures. This is why the Council of Canadian Innovators called on our governments to design a national data strategy to ensure that cross-border data and information flows serve the interests of Canada's economy.

A national data strategy should codify explicit treatment of competition in the data sections of free trade agreements, including the right to competitive access to data flowing through large data platforms that have de facto utility status. If Canada doesn't create adequate data residency, localization, and routing laws that protect Canadians, then our data is subject to foreign laws, making Canada a client state.

While the Facebook scandals instigated the recent set of testimonies before this committee, I urge you to arm yourself with the facts about the data-driven economy, which is completely different from the knowledge-based economy that proceeded it and the production-based economy of the 20th century.

Intangible commodified data does not function the same way as tangible goods. The data-driven economy gets its value from harvesting, identification, commodification, and then use of data flows.

What we have heard from companies such as Facebook, including at this committee, is an inaccurate picture of what is happening. The Cambridge Analytica and Facebook scandal is not a privacy breach, nor is it a corporate governance issue. It's not even a trust issue. It's a business model issue based on exploiting current gaps in Canada data governance laws.

Facebook and Google are companies built exclusively on the principle of mass surveillance. Their revenues come from collecting and selling all sorts of personal data, in some instances without a moral conscience. For example, in Australia, Facebook was caught selling access to suicidal and vulnerable children.

Surveillance capitalism is the most powerful market force today, which is why the six most valuable companies are all data driven. Their unique dynamics require a made-for-Canada strategic and sovereign policy approach, because data and intellectual property are now key determinants of prosperity, well-being, security, and values.

Data underpins all aspects of our lives, as you can see from the illustration I gave you as a framework. As an intangible asset, data has critical non-commercial effects. With this in mind, I make the following recommendation: implement GDPR-like provisions for Canada. GDPR offers valuable lessons and a point of departure for Canada's legislators and regulators. It is a universally acknowledged advance in privacy protection and control of data.

European policy-makers recognize that whoever controls the data controls who and what interacts with that data, today and into the future. This is why they ensured that EU citizens own and control their data. Similarly, Canadians should own and control their data. Canadians need to be formally empowered in this new type of economy, because it affects our entire lives. For our democracy, security, and economy, Canadian citizens, not unaccountable multinational tech giants, need to control the data that we and our institutions generate.

By focusing only on individual privacy, Canadians can find themselves plugging just one of many holes, which is, in effect, plugging nothing. We need a horizontal lens to legislation and policies. Privacy and digital public and private services aren't opposing forces. For example, Estonia shows that better data governance leads to increased privacy in digital services.

Economists consistently show that the data-driven economy is unfolding at a speed that outpaces the creation of evidence-based policy-making. I urge you to work with Canadian innovators and experts who understand open technologies, data sciences, competition, standard-setting, strategic regulations, trade agreements, algorithm ethics, IP, and data governance.

We need them to help craft detailed policies that are technical in nature. By working with experts, we can advance our country and ensure Canada doesn't miss participating in the data-driven economy, like it missed prospering in the knowledge-based economy over the past 20 years.

On a personal level, as a Canadian, I am deeply worried about the effect mass surveillance-driven companies have on both Canadian society and individual Canadians. Personal information has already been used as a potent tool to manipulate individuals, social relationships, and autonomy. Any data collected can be reprocessed, used, and analyzed in the future, in ways that are unanticipated at the time of collection. This has major implications for our freedom and democracy.

I am concerned that without the design and implementation of a national data strategy, our politicians are moving ahead with initiatives with foreign companies that are in the business of mass surveillance. Some of these companies have a proven track record of using data for manipulative purposes. Unfortunately, history offers sobering lessons about societies that practise mass surveillance.

It is the role of liberal democratic government to enhance liberty by protecting the private sphere. The private sphere is what makes us free people. There is no individual consent to, or opting out of, a city or a society that practises mass surveillance, and this is the path Canada is currently on. Therefore, in addition to putting in place appropriate economic incentive structures and regulatory frameworks, I also urge you and fellow elected officials to act boldly to preserve our liberal democratic values, to promote the public interest, and to assert our national sovereignty.

I thank you for considering my recommendations and for the opportunity to present here today.

[The Chair, Conservative, Bob Zimmer]

Thank you, both Colin and Mr. Balsillie, for your testimony.

We'll go to Monsieur Picard for seven minutes.

[Michel Picard, Liberal, Montarville, QC]

Thank you, Mr. McKay and Mr. Balsillie.

Mr. Balsillie made a few pointed remarks about Google, so I invite Mr. McKay to react to the allegations Mr. Balsillie made in his testimony.

[Colin McKay]

Mr. Balsillie has made some very constructive recommendations around the need for a data strategy for Canada, to enable Canadian businesses and businesses competing in Canada to understand the data they have at hand and the business opportunity that is presented to them by capitalizing upon that data. The government certainly has an opportunity to create a nuanced strategy that helps Canada differentiate itself from the rest of the world, not just in the tech sector but in health, where we already have quite a lead in terms of dealing with health information, as well as agriculture, mining, and manufacturing.

A data strategy does not need to be as restrictive or prescriptive as Mr. Balsillie has suggested. In fact, a strategy that tries to box Canada in or creates obligations that are not either parallel or similar to those available elsewhere in the world will actually limit the opportunities available to Canadians to innovate, both in Canada and internationally. There needs to be consistency and predictability in any regulatory framework that's set up.

On a final point, I'd just like to underline that despite what Mr. Balsillie said, we do not sell the personal information of our users. We've built a business model that delivers services and products to users, relying on a personal relationship that uses the information they share with us to provide personalized services for them.

We support that broad array of services that are provided free to Canadians and everyone else in the world through advertising. It's advertising that's targeted at aggregated groups, not at individuals, and there's no exchange of personal information between Google and advertisers. It's simply recognizing that there's an economic transaction that needs to happen to provide those services, and advertising is the most common and convenient way to deliver that right now.

[Michel Picard, Liberal, Montarville, QC]

That is exactly what I am getting at.

I would like to see an approach that is not directed at insiders, but rather an approach in layman's terms, if I may say, so people or the general public who are following the committee's proceedings can understand.

To really understand all the ins and outs of all this entails, I will pick up on what you said last. Let's try to have a discussion that focuses exclusively on the commercial aspect and not on broad policies and broad philosophical concepts.

When someone registers with Google, they do not have to fill out a special form, do they?

[Colin McKay]

Are you talking about a special form for the services offered by Google?

[Michel Picard, Liberal, Montarville, QC]

I do not have to fill out a form that includes various personal information in order to use the Google browser.

[Colin McKay]

No.

[Michel Picard, Liberal, Montarville, QC]

Since you have little or no information about me, my first reaction is that there is no information about me that could be at risk.

[Colin McKay]

That is true.

There are levels of expertise related to individuals. If you register for a service offered by Google, you are given the service and it is assumed you are a man of a certain age who works in Ottawa. When you use our service, we can see what you do with the search results about a hockey game, for instance. While you are using the service, we make assumptions about your preferences and what you frequently search for.

[Michel Picard, Liberal, Montarville, QC]

Okay.

The fact that I prefer a type of book or a sports site, for instance, is that not a personal preference that becomes private information? Unbeknownst to the user, their use of the browser is recorded and assumptions are made about their behaviour.

If I understand this correctly, you turn to the private market and tell ad buyers that you have targets for them. Nice to provide a free service, but it does not pay the grocery bill at the end of the month.

[Colin McKay]

The point to make would be to distinguish that we don't provide a service that allows advertisers to target individuals. What we do say is that we have identified users who search for results for hockey games and might search for results for hockey games by a particular team or in a particular province.

[Michel Picard, Liberal, Montarville, QC]

You provide the service of identifying the individual because you have the information from the IP address.

[Colin McKay]

We do not identify the individual.

For the advertiser, all we'd say is, “You would like to deliver an advertising campaign towards people who have these qualities. We will deliver that advertising campaign.” They do not know who is seeing the ads. They don't get information about who is seeing the ads. They have an idea of the number of people and the attributes of the people who have seen the ads.

[Michel Picard, Liberal, Montarville, QC]

But you do know.

[Colin McKay]

We do that.

[Michel Picard, Liberal, Montarville, QC]

You do that, but you do know who used that, because you have the IP address. You know the person related to the IP address, although you'd have to prove that the person who keyed in the information is the same one who is registered on the IP, but still there is no computer contacting any site. Someone does, and therefore you have in hand the missing link of personal information with any third party interest.

[Colin McKay]

I mentioned My Account. If you have an interest in understanding how we've used that information and how we've provided services to you, if you go to My Account, you can see a listing of those attributes and those qualities that we've associated with you. In terms of understanding what information we've exchanged in the course of our relationship, we make that clear in My Account.

It is not in our interest to engage in any type of transaction with a third party that exchanges that information. The exchange we have is that in the course of providing that information to you, we might learn more about your need to find parking near a hockey game because of your preference to go to hockey games. We will therefore, in Maps, tell you where the nearest available parking is.

[Michel Picard, Liberal, Montarville, QC]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Picard.

Next up for seven minutes is Mr. Gourde.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you, Mr. Chair.

My question is for Mr. McKay.

On Tuesday, Google announced that it will soon be possible to use artificial intelligence to converse on the phone in our place. That means that my Google virtual assistant will be able to make a hair appointment for me and record it in my personal agenda. I will simply have to ask it to do so.

What worries me about this is that, if it is possible to find information about a third party and enter it in someone's personal agenda, those same robots could ask a multitude of questions to 100,000 people. Do you like blue, for example. The robots could ask seven, eight, nine, ten, eleven or twelve questions, and then analyze the answers.

In terms of data, we are now in the wild west. It is changing so quickly. Companies like Google and Facebook can get personal information about people. After that, there will be a void. They will be able to do anything they want with the data, data that people voluntarily gave them.

With these tools, Google's strategy is to sell services and to give services to the public. How will you protect the data you can record? Can you use this kind of robot to get data that you will then resell to third parties later on?

[Colin McKay]

I'll start by replying to your last observation, which is we don't resell information, so that is not in consideration.

In speaking about the specific project Duplex that was discussed at our developer conference this week, that's a project. It hasn't rolled out into implementation. It's an attempt to explore how to provide you with a service. At the moment you can speak to your phone and ask for the phone number for a restaurant and then dial the restaurant and try to schedule an appointment. We're trying to explore how we can use artificial intelligence to get through the entire transaction of making a reservation for you.

That project Duplex is very limited in scope. I think three or four examples were provided during the conference. Those are the three or four examples that it can conduct. It's meant to provide a service to the individual. It's not meant to collect information. It's meant to be supplementary to the relationship we have with a Google user in terms of what information they are looking for to search, how they are trying to slot information into their calendar, and how they are trying to identify places to eat on Google Maps.

In terms of your question about broader surveys, that's not even under consideration right now. Broad-based surveys that drive voter interest or user interest are not something we conduct at the moment, so that wouldn't be an implementation of this tool.

I have to underline that this is using artificial intelligence in a way to conduct mundane tasks that provide a benefit to the user, provide time to them, and make that interaction as efficient as possible while providing a clear-cut service for the user.