Evidence of meeting #117 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was vote.
A recording is available from Parliament.
11:05 a.m.
Chief Executive Officer, AggregateIQ
Not at that time, no. He had not started then.
11:05 a.m.
Chief Executive Officer, AggregateIQ
I think it was almost a year and a half after that.
11:05 a.m.
Conservative
11:05 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
Thank you, Chair.
Thank you for being with us this morning, Mr. Massingham.
To cut to the chase, are there any remarks you made to this committee earlier this year that you wish to correct before the committee today?
11:05 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
That would be with regard to the relationship of AggregateIQ to SCL.
11:05 a.m.
Chief Executive Officer, AggregateIQ
No, I'm perfectly comfortable with my statement.
11:05 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
With regard to Mr. Wylie's testimony that AggregateIQ was in effect a shell company to process data that had been acquired by other means....?
11:05 a.m.
Chief Executive Officer, AggregateIQ
No, we don't process data. We're modellers. We don't do anything like that.
11:05 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
An awful lot has happened since you testified before us.
In July, the Information Commissioner's Office in the United Kingdom issued an enforcement notice ordering the company to stop handling data belonging to British citizens. At the same time, although unnoticed until the last couple of weeks, the Information Commissioner's Office accused AggregateIQ and issued the first violation notice under the European Union General Data Protection Regulation, accusing AggregateIQ of violating articles 5, 6, and 14 of the GDPR “because [it]...processed personal data in a way that the data subjects were not aware of, for purposes,” as they say, “which they would not have expected, and without a lawful basis for that processing.”
I understand AggregateIQ is appealing that notice of violation. What can you tell us about that?
11:10 a.m.
Chief Executive Officer, AggregateIQ
We have appealed that issue. We've had a very good dialogue with the ICO. They have recognized that the notice was far too broad, saying that “on further consideration, the Commissioner accepts that the terms of the notice were overly broad”. Accordingly, she has invited the tribunal to substitute a notice with annex 1, basically saying that once we have completed the Office of the Information Commissioner and Office of the Privacy Commissioner investigations, we will simply delete the 1,000 or so email addresses that we had.
11:10 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
In your earlier testimony with Mr. Silvester, you were asked whether or not you sought legal counsel with the knowledge that you may have violated the new GDPR rules or the previous U.K. data protection rules.
You denied that you'd sought legal counsel at that time. Do you still hold that position?
11:10 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
Well, it is in the testimony. I think the concern of the British Information Commissioner is that in disregard of the rules and because you still possessed the data at the time after the GDPR came into effect, in effect you were violating the section that says that collection of data from European residents, from British residents, without consent for the manipulation, the processing, and the handling that might later occur—data that is transferred to foreign locations and then reintroduced to electoral processes—is in fact a violation of the new law.
Were you aware of that?
11:10 a.m.
Chief Executive Officer, AggregateIQ
We have an ongoing dialogue with the ICO. That data was never used. It was simply backed up and in that repository by mistake.
Once we have concluded everything with the OIPC and OPC, then that will be removed.
11:10 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
Do you still deny that you knowingly or unknowingly worked with data that had been improperly harvested from Facebook?
11:10 a.m.
Chief Executive Officer, AggregateIQ
Sorry, can you repeat that question?
11:10 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
There were various denials in your earlier testimony with Mr. Silvester about AggregateIQ ever handling improperly harvested Facebook personal data.
11:10 a.m.
Chief Executive Officer, AggregateIQ
AggregateIQ has never received any raw Facebook data.
11:10 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
We're not saying “raw”. It may have been boiled down, but I knew you could—
11:10 a.m.
Chief Executive Officer, AggregateIQ
I couldn't tell you where the sources of all the data came from, from SCL.
11:10 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
Did it not concern you at the time that you were dealing with data that was as personal, as we all know it is, that certainly other jurisdictions have—
11:10 a.m.
Chief Executive Officer, AggregateIQ
What we saw of that information wasn't totally personal, no.
