Information & Ethics Committee on Nov. 1st, 2018

[The Chair, Conservative, Bob Zimmer]

Welcome, everyone, to the Standing Committee on Access to Information, Privacy and Ethics, meeting number 124. Pursuant to Standing Order 108(3)(h)(vii), we are studying a breach of personal information involving Cambridge Analytica and Facebook.

Today we have two sections. Each will be about 45 minutes, slightly shortened based on the votes we just had. From Elections Canada, we have Stéphane Perrault, Chief Electoral Officer; and Anne Lawson, deputy chief electoral officer, regulatory affairs.

From the CRTC, the Canadian Radio-television and Telecommunications Commission, we have Rachelle Frenette, legal counsel; Scott Hutton, executive director, broadcasting; and Neil Barratt, director, electronic commerce enforcement. We'll start with Mr. Perrault.

Go ahead.

[Stéphane Perrault, Chief Electoral Officer, Elections Canada]

Thank you, Mr. Chair.

In the interest of time, I will use a slightly truncated version of my speech. If you see me skipping paragraphs, it's to save time.

Thank you for the opportunity to speak with the Committee today.

Today I would like to address four subjects that have drawn Elections Canada's close attention and that relates to your study: foreign interference, the digital information environment, cybersecurity and privacy.

I am grateful for this opportunity to explain to the Committee what role Elections Canada is playing to preserve trust in our electoral process, and to outline where we are collaborating with others, on the understanding that no single solution and no agency working alone can address these threats.

Let me first start with the issue of foreign interference, which overlaps in part with the other topics that I have identified.

In Canada, recent concerns about foreign interference have been primarily around issues of foreign funding of third parties—entities that seek to influence the electoral debate without participating directly as parties or candidates.

Bill C-76 would significantly expand the third-party regime and include measures that aim to eliminate opportunities for foreign funds to be used in Canadian elections. This includes an anti-avoidance clause and a ban on the sale of advertising space to foreign entities.

As you are aware, foreign interference can take other forms, including disinformation campaigns and cyberattacks.

The expansion of the web and social media has transformed our information environment. Citizens are no longer simply struggling to determine who is a journalist; they are unlikely to know whether a given social media post or ad was sent by a bot or a human, or whether it is a genuine expression of belief or part of an influence campaign, domestic or foreign.

There is no simple solution to this, but elements of a response are emerging. Efforts to increase digital literacy are, in my view, a key element. It is reassuring to know that Canadians are increasingly cautious about what they see or read on social media. I would add that they generally trust the conventional media.

Bill C-76 would include a requirement for social media platforms to publish and preserve archives of election and partisan ads. This is a positive step that supports transparency and aids enforcement.

Bill C-76 would also clarify and expand existing provisions against some kinds of online impersonation, as well as false statements about candidates.

Elections Canada's specific and essential role is to ensure that Canadians have easy access to accurate information about the voting process, including information about where, when and how to register and to vote.

In preparation for the next election, we plan to launch a voter information campaign starting next spring. We will also be monitoring the social media environment throughout the election period, which will enable us to rapidly correct any inaccurate information about the voting process. And we will create an online repository of all of our public communications, so that citizens and journalists can verify whether information that appears to be coming from Elections Canada actually is. This is something that I have encouraged political parties to consider doing regarding their own communications, to have a central repository of their communications.

Together with the Commissioner of Canada Elections, we have also engaged representatives from social media platforms to better understand how they operate and to establish channels of communication to rapidly respond to incidents during the election.

A third area of concern is cybersecurity. While we continue to rely on hand-counted paper ballots, Elections Canada is increasingly delivering online services to voters, the candidates and the parties. One of my key responsibilities is to protect Elections Canada's digital assets, based on the advice and expertise of our federal security partners.

Over the last two years, we have made significant investments to renew our IT infrastructure and to improve our security posture and practices. As part of this effort, we are also providing security awareness training to staff at headquarters and to all 338 returning officers in the field.

Other participants in the electoral process, including media and parties, must also protect themselves against hacking. The Canadian Centre for Cyber Security offers excellent resources and advice to everyone. Some measures are inexpensive and can be quite effective. Other measures, however, may require considerable investments.

In this context, the committee may wish to consider the need in the future for parties to receive a special subsidy to help them upgrade and improve the security of their IT systems and explore ways in which such a subsidy could be fairly achieved. I recognize from my own investments at Elections Canada the cost of these investments. I believe it is a matter of public interest, not personal or private interest of the parties, to have the resources as the cost to ensure cybersecurity increases.

The last point I want to address is the issue of privacy. This committee has recommended that political parties be made subject to basic privacy rules and oversight by the Privacy Commissioner of Canada. This is a recommendation that I also support and have made in the context of Bill C-76. I was disappointed that it was not accepted at committee.

Parties, as you know, increasingly rely on voter data to support fundraising and campaigning activities. This data may include, in addition to the information that we provide to parties and candidates, information about a person's political affiliation or support, volunteer activities, or other information that the party believes to be relevant to its purposes.

Bill C-76 would require parties to publish their own privacy policy. This is a small step in the right direction, as the bill provides no minimal standards and no oversight.

Bill C-76 is also silent on whether a party's policy should include a mechanism allowing Canadians to validate and correct any information that the parties hold on them. Of course, nothing prevents parties from doing so, or from taking other steps to reassure Canadians about the collection, use and protection of their information.

It has been observed that parties have much to gain in having robust privacy policies and practices, and I believe that to be the case. Above all, more importantly, I believe that electoral democracy has much to gain.

Mr. Chair, I would like to conclude by emphasizing the importance of the work undertaken by the committee. I would be happy to answer any questions the members may have.

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Perrault.

Next up we'll have Mr. Hutton, for 10 minutes.

[Scott Hutton, Executive Director, Broadcasting, Canadian Radio-television and Telecommunications Commission]

Thank you, Mr. Chair, for this opportunity to participate in the committee's valuable examination of how to better protect the private data of Canadians.

I will spare you the introductions, to save a bit of time.

As the committee members know, the CRTC derives its mandate from various pieces of legislation. The Broadcasting Act authorizes the CRTC to regulate the industry in pursuit of specific objectives, including to encourage the creation and promotion of content made by Canadians and that reflects Canadians in all their facets.

Similarly, the Telecommunications Act assigns the CRTC the mandate to regulate the telecommunications industry in pursuit of particular goals. For instance, ensuring that Canadians in urban and rural areas have access to reliable, affordable and high-quality telecommunications services.

The Telecommunications Act also gives the CRTC the authority to regulate unsolicited telecommunications and to take enforcement action against non-compliant telemarketers.

For its part, Canada’s anti-spam legislation authorizes the CRTC to regulate specific types of electronic communications. These include the transmission of commercial electronic messages, the alteration of transmission data in electronic messages and the installation of programs on another person’s computer system.

Of course, the CRTC, like all other federal departments and agencies, abides by Canada’s Privacy Act.

Moreover, the Telecommunications Act requires that the telecommunications sector contribute to the protection of the privacy of individuals. The CRTC’s policies in this area are limited to the protection of confidential consumer information held by telecommunications service providers.

The CRTC appreciates the committee's work on digital platforms. Earlier this year, we published a report titled “Harnessing Change: The Future of Programming Distribution in Canada”. The report's perspective is informed by CRTC's mandate, of course. As such, much of the report focuses on the creation, distribution and promotion of Canadian audiovisual content.

In a digital age, users can now access a growing wealth of content and platforms. As a result, the traditional regulatory approach is less and less able to obtain the objectives set out in legislation such as the Broadcasting Act. To address this reality, the report suggests innovative approaches to policy and regulation, approaches that would engage digital platforms that provide audiovisual content to Canadians.

We proposed that three principles should guide any new approaches.

First, future policy approaches should not only focus on the production and promotion of high-quality content made by Canadians, but also on its discoverability.

Secondly, all players that benefit from participation in the broadcasting system should contribute in an appropriate and equitable manner. New policies and regulations must recognize that the social and cultural responsibilities that come with operating in Canada extend to digital platforms.

And finally, future legislation and regulation must be nimble and capable of easily adapting to ever-changing consumer behaviour and technologies.

The report also identifies some of the opportunities created by the evolution of digital technologies. For example, data on how people find, select and interact with content could inform how to develop and distribute content in ways that support Canada’s broader policy objectives.

That being said, we recognize that digital communications technologies pose particular risks to the protection of personal information. The report describes the problem as follows:

The development of these online services has also given rise to new ways of misusing data—for example, to infringe on the privacy of Canadians—particularly when services collect data without users’ knowledge or informed consent. Data can also be used to misinform and manipulate through fake [news] or misleading news and information, affecting democratic processes, relationships with others and the way Canadians view the world.

The CRTC firmly believes that protecting the personal data of Canadians and preventing abuses must remain the overriding consideration. The legislative and regulatory frameworks that govern the protection of privacy and the use of personal data, however, are not part of CRTC's mandate on the broadcasting side.

Thank you.

We'll do our best to answer your questions.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Hutton.

We'll go to the first round, beginning with Ms. Vandenbeld for seven minutes.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Thank you very much.

Most of my questions will be for Elections Canada and Mr. Perrault. Considering that I was on PROC when we were reviewing the Chief Electoral Officer's recommendations after the last election, this is an area of significant interest to me, as I think it is to all members of this committee.

You testified before PROC, and again in your remarks this morning, that political parties should come under privacy rules. Now, PIPEDA, of course, is where commercial entities fall. The Elections Act is another potential tool that could be used. We've heard testimony before this committee that there's a need to ensure that political parties can access voters without interference, that they're different, and that for political campaigns, for instance, the do-not-call list doesn't apply. You can enter apartment buildings during campaigns so that you can reach all voters.

Are there specific, unique qualities of an election campaign such that you think the regular PIPEDA rules would not apply to political parties? Would it be better for us to do this under the Elections Act or under PIPEDA?

[Stéphane Perrault]

There are a lot of elements in that.

I do think parties should have access to information that allows them to reach out to voters. That's a fundamental aspect of our system, and that should remain.

I do think we have now reached a point where concerns over the use of personal data on the Internet require some measure of protection and some minimal standards. Whether they be in the Elections Act or the other pieces of legislation, I do think this is an area of expertise for the Privacy Commissioner. My preference is that it be under his area of jurisdiction.

I also recognize that there are unique realities to parties. I think the basic principles of privacy can accommodate those realities. If you look at areas of consent and how you obtain consent—i.e., whether it has to be prior consent or the right of a person to seek to erase information rather than give up-front consent—these are areas where the principles, I believe, allow for some flexibility, but I do not believe there should be no minimum standards applicable to parties. That to me is a basic element. There should be some form of oversight.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Of course, one thing we've been concerned about on this committee is the data breach and Cambridge Analytica. There are third party entities that are global in nature and that are gathering huge amounts of data. This allows for very specific targeting of people who are on social media platforms, which has, as we've seen, influenced different campaigns.

Beyond the things you were talking about in terms of third parties and voter awareness, is there a role for Elections Canada in monitoring the kind of targeting that is happening on Facebook? For instance, let's say a third party entity that is not spending money—they may be a foreign source or they may be domestic—is targeting particular groups of voters for voter suppression. An ad goes to, for instance, young men between 20 and 25 who are of a particular racial minority. It tries to get people not to vote.

Is there a role for Elections Canada, or in the Elections Act, even legislatively, to be able to prevent that kind of voter suppression?

[Stéphane Perrault]

Again, this is not a simple area. The premise, at least in organic content, is that we don't regulate what's being said. There are exceptions to that in the legislation. There are exceptions in Bill C-76, such as when there is specific impersonation, for example. There are areas of legitimate intervention. If we see offences under the act, we will report them to the commissioner. He's the one to enforce that.

We do have an Elections Canada electoral integrity office. We've had that now for two cycles. That office is concerned with looking at malpractices that emerge in other jurisdictions to see whether there may be trends, to be prepared to at least alert either the commissioner or the person who may be caught in those situations and to react.

Our basic role is really to make sure that people have correct information about the voting process. Really, that's the core of our mandate, and that's where we have to focus our attention.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

We know that this is not a uniquely Canadian problem. This is something that is happening around the world. Is Elections Canada working with other electoral bodies around the world to look at best practices, at how other bodies are handling this or at how to coordinate in responding to those that are across boundaries?

[Stéphane Perrault]

We certainly have regular exchanges with other electoral management bodies, both in Canada and in other jurisdictions. I think it's fair to say that nobody has found a silver bullet to deal with these issues, but we are looking at similar approaches.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

I'd like to go back to the actual cybersecurity of the Elections Canada voters list. We have heard in this committee that it isn't necessarily the actual institutions, Elections Canada, or the process of voting...particularly with the paper ballots, which is something that I think we want to keep as a country so that we have the manual counting of ballots. At the same time, we do have voters lists in the hands of political parties, and parties have voluntary measures in terms of privacy.

I noticed that you said there should be a subsidy for political parties on cybersecurity. Is there more that political parties need to do in order to ensure that these voters lists or any other information isn't getting into the wrong hands, even inadvertently?

[Stéphane Perrault]

I think that's a very good point. When we issue the lists, we provide with the lists some guidelines, which you have probably seen. If you look at the guidelines, you can see that part of them relate to the legal obligations under the act—the purposes for which this data may be used and so forth—but a number of recommendations are just best practices that we have no authority to enforce.

They are about how you keep track of who in your campaign has those lists, making sure that you recover the lists after the campaign, and safeguarding them when they're not being used by your volunteers. There are important things that campaigns can do and should be doing over and above any legal requirement.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Who owns the data? Who owns that voters list?

[Stéphane Perrault]

I don't know that there's a proprietary right. There are certainly legal obligations to use it only for certain purposes under the Elections Act. That's all I can say.

You also mentioned the subsidy. I don't necessarily recommend the subsidy. I think it's something that needs to be examined. I honestly don't know whether parties have the kinds of resources that the evolving threats to cybersecurity require. It's an open question, and I think it's worth considering.

[The Chair, Conservative, Bob Zimmer]

Thank you.

Next up for seven minutes is Mr. Kent.

[Peter Kent, Conservative, Thornhill, ON]

Thank you, Chair.

Thanks to both of you, Mr. Hutton and Mr. Perrault, for your opening statements. In the interests of time, though, I would like to focus on Mr. Perrault.

Several meetings ago, the investigative journalist and researcher Vivian Krause testified before committee and addressed particularly the millions of American charitable dollars with a stated political objective in the last Canadian election. Those charitable American dollars were sent to Canadian charitable groups, which then transformed the money into legitimate Canadian dollars. They were then distributed in many cases to third parties to be used, presumably, to help further those political objectives of the original American donors.

I wonder if you could address your inability to contain, track and penalize such obvious unacceptable interference with the Canadian electoral process.

[Stéphane Perrault]

I won't speak to the specifics of that case. I understand that your question was not about that. As we all know, money is hard to track and limit. Things can be done. The current rules under the act have a number of weaknesses. A number of recommendations have been made in the past, and they're part of Bill C-76.

Bill C-76 goes beyond that. Two main weaknesses are being addressed. The first is that in the past, contributions were made six months prior to the writ period. Because of the way the law is drafted, they were treated as belonging to the entity, so it's their own resources, even though they may come from abroad. The second weakness is that the current law regulates election advertising, which is a narrow category of expenditures. We've seen an expansion of the activities in recent years.

On both fronts, Bill C-76 improves that by expanding it to all partisan activities and requiring a reporting of all contributions. It also has a number of additional measures. One of them I recommended at committee, which is having an anti-avoidance clause precisely to deal with the kind of situation where money is being passed from one entity to another and claims are made Canadian in the process.

The rules are there. They may be difficult to track and enforce, and we'll be working with the commissioner and inviting people who see these things to report these matters to the commissioner so that investigations can take place.

[Peter Kent, Conservative, Thornhill, ON]

Another area of constant concern involves the ability of charitable groups to spend 20% of their revenues, their funds, on political activities. As Ms. Krause testified, the problem isn't political activity. The problem is political activity that doesn't serve a charitable purpose. She recommended removing that completely and saying that charities can spend as much as they want on political activity to support their charitable purpose. However, should it get into partisan politics and support of partisan positions and campaigns in politics, the allowable percentage should be zero.

Could you comment on that?

[Stéphane Perrault]

I don't know that I can go very far on that because that's an area beyond my area of responsibility.

[Peter Kent, Conservative, Thornhill, ON]

I think you'd like to be able to.

[Some hon. members]

Oh, oh!

[Stéphane Perrault]

I'll take a pass, if you allow. It may be difficult from a practical point of view. I think whatever the percentage is, it sometimes makes it easier to draw lines for what is partisan, what is political and what is not. I think if you offer some buffer, it may be useful from a practical point of view. I'll keep it at that.

[Peter Kent, Conservative, Thornhill, ON]

Ms. Krause also testified that after a six-month investigation on her part, she filed a report with Elections Canada. Elections Canada representatives went to Vancouver to discuss the contents of that report, which suggested that of 42 charitable organizations investigated by the CRA, 41 were found to be less than compliant, and recommendations were pending that five of them be disqualified entirely as charitable agencies.

Her testimony was that Elections Canada effectively communicated that the agency's hands are tied because the CRA would shut down those investigations, or never report on those audits, and does not share that sort of information with Elections Canada.

[Stéphane Perrault]

I want to make a distinction here between the Chief Electoral Officer and the Commissioner of Canada Elections. As members may know, we operate completely independently, and the commissioner is not allowed to share any information with me or the general public on his ongoing investigations unless there's a need to do so. There are exceptions. I'm not privy to the nature or extent of the investigations, the conclusions, or the challenges he would have faced in those investigations.