Information & Ethics Committee on Oct. 23rd, 2018

[Colin McKay]

Earlier this year, at the same time that the Facebook and Cambridge Analytica story came out, we launched an internal process to verify that our APIs and internal data protection processes weren't allowing similar lapses in information sharing.

Through that process, what we discovered is that in Google Plus there was a bug, not a breach. The bug allowed apps that had access to a user's public data—data they had chosen to share on their profile—to access elements of that data that the user hadn't necessarily granted permission to. It also allowed the app to access information that the user had shared with a friend in that same subset of data.

Because Google Plus was designed as a privacy-protective tool, we have very limited logs about what is available in terms of behaviour on Google Plus. We don't keep a record of what our users do on Google Plus. We had a two-week window to evaluate whether or not developers were aware of that bug within the API and that they could access this additional information, whether they had acted on it, and whether any information had been collected. Our internal data protection office reviewed that and could find no evidence that there was an awareness that the bug existed or that the data had been accessed or misused.

Once that had been identified, they then went through the evaluation of harm and whether or not they should notify users that this bug existed and that the potential had existed for this to happen. What they determined was that there was no sign that the information, that bug, had been accessed by developers. There was no sign that any information had been shared in a manner they did not expect. Also, there was really no way to notify developers of how to change their access to data, because as soon as we noticed the bug, we closed it.

Also, in notifying users, neither could we identify a set of users that had been affected by the bug, because there were none in the data available to us. Therefore, we couldn't notify them on any behaviour that would change any possible harm from that bug. That was the rationale behind the decision.

[Peter Kent, Conservative, Thornhill, ON]

Let's look now at another member of the Google family, the controversial Sidewalk Labs project with Waterfront Toronto.

Less than a week ago, Ann Cavoukian, who is recognized as a world-leading authority on privacy and vulnerabilities to privacy, resigned as an adviser. She said that the commitment from Sidewalk Labs that personal data would be de-identified in its various projects.... We still don't know much about what those projects may or may not be. She didn't believe that the data would, in fact, be de-identified and that personal data would be protected.

Can you speak to that?

[Colin McKay]

Unfortunately, I'm here on behalf of Google Canada. Sidewalk is an independent company under Alphabet, so I can't speak to their plans or announcements.

[Peter Kent, Conservative, Thornhill, ON]

Certainly, within the same larger company, the ownership of that company you would speak to....

Obviously, there must be similar data protection commitments. Those commitments have been made in Sidewalk Labs, as you've made with us here again today.

[Colin McKay]

I can't speak to their thought process on how they're identifying data protection in the project they're developing. While we have similar ownership, they are independent, and they're tackling a very different project from what Google Canada undertakes.

[Peter Kent, Conservative, Thornhill, ON]

You understand the concern that has been raised at this committee meeting since the Cambridge Analytica, Facebook, AggregateIQ scandal first broke. There's a great deal of discussion about the fact that the so-called data-opolies, the massive tech companies, are mostly American and that their subsidiaries around the world are very often subject to the operating policies of these companies.

I'd come back again to your sister company, Sidewalk Labs. Jim Balsillie, who is no minor player in the rapidly evolving digital world, has called Sidewalk Labs not a smart city. He says,

It is a colonizing experiment in surveillance capitalism attempting to bulldoze important urban, civic and political issues. Of all the misguided innovation strategies Canada has launched over the past three decades, this purported smart city is not only the dumbest but also the most dangerous.

Surely you must have some corporate comments to a statement like that.

[Colin McKay]

There's a specific reason that Sidewalk is an independent company with a very different mandate and behaves in a very different way. That's because it operates independently from Google, both on data protection as well as the way it's working through the product development in Toronto.

I don't have an opinion on how Sidewalk is conducting their business. The parallels that exist only exist because there is a broader global conversation around data protection and privacy, as well as development of both urban and rural areas.

[Peter Kent, Conservative, Thornhill, ON]

How would Google Canada feel about the creation of legislation to embrace some of the elements of the European Union's general data protection regulations?

[Colin McKay]

This is something that we covered in my earlier meeting.

From Google's point of view, we've already implemented the steps necessary to be compliant with the general data protection regulations. We have internally gone through the hundreds of years of engineers' time to make that transition.

If you were to make those proposals and legislation, we would participate in that legislative process. We would provide our comments. In the end, we would be looking at a landscape that we are already familiar with and that we already comply with in Europe.

The challenge that is presented in Canada is that the extension of GDPR, to a broad extent, would create greater compliance obligations on smaller and medium-sized businesses. They're already feeling that stress, and not just here in Canada, the United States and Asia, but also in Europe, in terms of understanding their obligations under the GDPR, so that's something to keep in mind.

From our point of view, as I said, it's a broader data protection conversation.

[Peter Kent, Conservative, Thornhill, ON]

A year ago, a Facebook executive told this committee that regulation, in fact, would discourage further investment by Facebook in Canada.

Would that be a similar case with Google?

[Colin McKay]

For us, we're extremely happy with the opportunities that are available in Canada, not just in terms of the business but in terms of growing the engineering teams and making an investment in Canada's innovation ecosystem. Regulatory conversations are nuanced, but we wouldn't make a blanket statement like that.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Kent.

Next up for seven minutes is Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

Thank you, Mr. McKay, for coming back.

The Prime Minister, when Sidewalk Labs was announced, did say that he had been discussing this idea of a smart city with Google for a number of years. How did the conversations begin between the Prime Minister's Office and Google about moving forward on a smart-cities initiative?

[Colin McKay]

I'm not sure. I think those conversations.... He must be referring to the leadership of Alphabet when he referred to Google, and to Alphabet itself. Sidewalk Labs was explicitly built to pursue projects like this.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Eric Schmidt has said that Google had been looking for someone to “give us a city” for some time and “to put us in charge”. Would Sidewalk Labs fit that model of a city that Google could be in charge of?

[Colin McKay]

I heard those comments from Eric Schmidt as well, and I think he was generalizing a broader intent to see how technology could be used to improve and develop an urban area by integrating technology.

[Charlie Angus, NDP, Timmins—James Bay, ON]

He also said that for this project to succeed, they would need “substantial forbearances from existing laws and regulations”. I've never seen developers of a waterfront real estate development plan come and say they wanted to be exempt from Canadian law. Given Eric Schmidt's comments, could you tell us what Google would think is important enough to exempt them from law in order to make a smart-cities project go through?

[Colin McKay]

I can't speak to the details of what Sidewalk Labs is intending. I can make observations around the development of telecommunications in Canada and railway and Internet access where—

[Charlie Angus, NDP, Timmins—James Bay, ON]

We're not talking about that. We're talking about Eric Schmidt, founder of Google, who said that for this project to succeed, they expect that this government will exempt them from existing laws and regulations. What would those laws and regulations be? Everyone else has to follow the laws. Why not Google?

[Colin McKay]

I'm not privy to Sidewalk Labs' plans and conversations, so I can't speak to that.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Okay, but this is Eric Schmidt saying this, right?

[Colin McKay]

I think I read the same newspaper article you read.

He was CEO, not the founder.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Sorry. I'm never good with my corporate structure.

I want to ask more about this idea because you talk about transparency. If the Prime Minister had been speaking with Google for a number of years on this plan, was the idea that this would ever be put up to competitive bidding, or was this going to be a project and experiment for Google on the Toronto waterfront?

[Colin McKay]

Once again, I can't talk to the Prime Minister's process, but I thought that Waterfront Toronto actually had a request for information that was a competitive process.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Right now, Toronto real estate is more expensive than Brooklyn's. Sidewalk Labs gets 12 acres of some of the most prime real estate in North America. People will be chomping at the bit for this, yet the request for directions for this project said 40 days. Nobody could compete in a 40-day turnaround to get this, but if Google had long prior conversations, it would suggest that the fix was in. It would be in Google's corporate interest certainly to get access to this major real estate development, would it not?