Information & Ethics Committee on Nov. 1st, 2018

[Scott Hutton]

In our case, we don't regulate the fast pace of the social media platforms. We deal with broadcasters on that front. On our front, all I would add is that one tool we would need is administrative monetary penalties in the Broadcasting Act, to be able to enforce various matters quickly. They are not available to us at this point in time.

[The Chair, Conservative, Bob Zimmer]

Okay. Thank you, everybody. Thanks for appearing at committee today. I apologize for the brevity of the presentations. There are a lot of questions to be asked still, but thank you.

We'll wait for the next witnesses to come up. We'll give them about five minutes.

[The Chair, Conservative, Bob Zimmer]

I call the meeting back to order.

Again, this is the Standing Committee on Access to Information, Privacy and Ethics, meeting 124, pursuant to Standing Order 108(3)(h)(vii), the study of the breach of personal information involving Cambridge Analytica and Facebook.

This is the second round. We'd like to welcome back Commissioner Therrien, the Privacy Commissioner of Canada; Brent Homan, deputy commissioner, compliance sector; Gregory Smolynec, deputy commissioner, policy and promotion sector; and Julia Barss, general counsel and director of legal services, legal services directorate.

Welcome back, Mr. Therrien. Go ahead for 10 minutes.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair and members of the committee. Thank you for the invitation to appear before you today.

Last week, I attended the 40th international conference of data protection and privacy commissioners, in Brussels. The conference confirmed what I had explained in my last annual report: There is a crisis in the collection and processing of personal information online. Even tech giants, attending the conference in person or through video, are recognizing that the status quo cannot continue.

Apple CEO Tim Cook spoke of “a data industrial complex” and warned that “[o]ur own information, from the everyday to the deeply personal, is being weaponized against us with military efficiency”. He added, “This is surveillance.” Facebook's Mark Zuckerberg admitted that his company committed a serious breach of trust in the Cambridge Analytica matter. Both companies expressed support for a new U.S. law that would be similar to Europe's General Data Protection Regulation or GDPR.

When the tech giants have become outspoken supporters of serious regulation, then you know that the ground has shifted and we have reached a crisis point.

Your committee clearly senses this ground shift and has supported our recommendations for legislative change. The government, however, has been slow to act, thereby putting at continued risk the trust that Canadians have in the digital economy, in our democratic processes and in other fundamental values.

Let's examine, for a moment, the impact of online platforms on privacy and the integrity of elections.

As Canadian artificial intelligence researcher Yoshua Bengio recently said in Le Monde: Our data fuels systems that learn how to make us press buttons to buy products or choose a candidate. Organizations that master these systems can influence people against their own interest, with grave consequences for democracy and humanity....The only way to restore balance is to ensure that individuals are not left alone when interacting with businesses. What is the role of governments if not to protect individuals. Nothing prevents regulating against excess and the concentration of power in certain sectors.

In my opinion, these are not uniquely Canadian threats, but global ones.

Aside from the misuse of personal information to influence elections, we have also seen hostile states interfering in elections by deliberately targeting personal data.

ln the words of Giovanni Buttarelli, the EU Data Protection Supervisor:

Never before has democracy been so clearly dependent on the lawful and fair processing of personal data.

Recent investigations in various countries have demonstrated that political parties are harvesting significant amounts of personal information on voters and adopting new and intrusive targeting techniques.

ln July, the UK Information Commissioner released her interim report on Facebook/Cambridge Analytica which found very serious shortcomings in the way digital players are operating.

For example, despite significant privacy information and controls on Facebook, they found users were not told about political uses of their personal information.

The UK Commissioner also raised concerns about the availability and transparency of the controls offered to users over what ads and messages they receive.

Significantly, the UK office found that political parties are at the centre of these data collection and micro-targeting activities. These activities would not take place without political parties.

None of this is encouraging for voters; when we last polled Canadians on this issue, 92% wanted political parties to be subject to privacy law. That's as close to unanimity that one can get in such polling.

ln September, privacy commissioners from across Canada put forward a resolution calling on governments to ensure that political parties are subject to privacy law.

Academic experts, civil society and the Canadian public all agreed with this position; and so does the Chief Electoral Officer.

The government, on the other hand, maintains that while the application of privacy laws to political parties is an issue that deserves study, the next federal elections can take place without them.

Canadian political parties' lack of oversight is unfortunately becoming an exception compared to other countries, and it leaves Canadian elections open to the misuse of personal information and manipulation.

The bottom line is that without proper data regulation, there are important risks to a fair electoral process; and this applies to the next federal election in Canada.

This brings me to updating you on our investigative action. I will be quick here, because I'm conscious of time.

As you are aware, we are proceeding—with our colleagues in British Columbia—with an investigation of Facebook and AggregateIQ. The work is advancing well, but we have not yet made our determinations. We continue to gather and analyze information.

For obvious reasons, I'm limited in what I can report due to confidentiality obligations under PIPEDA. I will remind you that we are investigating, among other things, the access to personal information provided to third parties by Facebook, in particular sharing friends' information with app developers. This was an issue we raised with Facebook in 2009. Since May, we've had many extensive requests for information. We received submissions from Facebook, and we will engage in another round of discussions very shortly.

Our investigation of AIQ focuses on whether it collected or used personal information without consent, or for purposes other than those identified or evident to individuals. Since my last appearance, OPC investigators have issued additional requests for information. They've conducted a site visit. They've undertaken sworn interviews with both Mr. Massingham and Mr. Silvester, and they have reviewed hundreds of internal records from AIQ, including AIQ electronic devices.

In order to make our conclusions public as soon as possible, our plan is to proceed in two phases: one at the end of this calendar year—next month—and a second phase in the spring.

The time for industry and political party self-regulation is over. The government can delay no longer. Absent comprehensive reform, Parliament should ensure the application of meaningful privacy laws to political parties. It should also give my office the same inspection and enforcement powers that most of Canada's trading partners enjoy.

Individual privacy is not a right we simply trade off for innovation, efficiency or commercial gain. No one has freely consented to having their personal information weaponized against them, to use Tim Cook's term. Similarly, we cannot allow Canadian democracy to be disrupted, nor can we permit our institutions to be undermined in a race to digitize everything and everyone simply because technology makes this possible.

Here, we go to the heart of the issue. Technology must serve humankind—that is, all individuals. Without individuality and privacy, it is a philosophical and practical truism that we cannot have a public democratic life, nor can we enjoy other fundamental rights we cherish, including equality, autonomy and freedom. Privacy is the prior condition for the enjoyment of other rights, including democratic rights. Without privacy, the social environment we have in Canada—democracy, political harmony and national independence— is also at real risk, including risks posed by hostile states.

As to the specifics of the legislative amendments that, in my view, might be required, while there are several excellent elements in the GDPR of the European Union, we should seek to develop an approach that reflects the Canadian context and values, including our close trading relationships within North America, with Europe, and with the Asia-Pacific region. A new Canadian law should reserve an important place for meaningful consent. It should also consider other ways to protect privacy where consent may not work, for instance in the development of artificial intelligence. The GDPR concept of legitimate interest may be considered in that regard.

Our law should probably continue to be principles-based and technologically neutral. It should also be rights-based, and drafted not as an industry code of conduct, but as a statute that confers rights while allowing for responsible innovation. It should empower a public authority—it could be my office or another public authority—to issue binding guidance on how to apply general principles in specific circumstances, so that the general principles do not remain pious wishes but receive practical application.

A new law should also allow different regulators to share information.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Therrien, for your testimony.

We'll go first to Mr. Baylis for seven minutes.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Thank you, Mr. Therrien.

It's a pleasure to see you back.

Let's go right into the issue of political parties.

We had some arguments made to us that the PIPEDA laws have penalties that are so strict that they would put a chill on political parties' ability to get volunteers, because the volunteers would be subject to these laws and might be fined for inadvertently doing something they shouldn't have.

Is this a concern for you? Have you seen evidence of this? The B.C. laws, for example, have very strict fines. Have you seen this anywhere else, where political parties have been subject to privacy laws? Has there been a so-called chill factor?

[Daniel Therrien]

That comment surprises me because, as this committee well knows, I've talked at length about the absence of enforcement powers of the OPC.

Yes, there are some penalties for certain conduct, and as of today, with the new breach regulations coming into force, if political parties were subject to PIPEDA they would be subject to penalties for not disclosing breaches that have occurred.

As a general rule though, as you know, PIPEDA suffers from lack of enforcement, so I was surprised to hear that comment.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

As it stands right now, then, that comment does not hold water, in your view.

You were asking for stronger enforcement laws. Let's say that happens and the government gives you the inspection and enforcement powers you seek. Would that chill factor be a concern for you, as the person enforcing those laws?

[Daniel Therrien]

Possibly.

First, when I recommend that PIPEDA be applied to federal political parties, it is implicit that context would matter. PIPEDA has a number of principles, such as the right to access information and the right to be clear on the purposes for which information would be used by an entity subject to PIPEDA. The fact that we would be dealing with political parties that have legitimate interests, if not rights, to engage in political discussion with electors would be part of the context.

As we would eventually look at the application of PIPEDA to political parties, certainly there could be an examination of enforcement mechanisms, the amount of penalties and what would make sense for the various entities that are subject to it.

I would end with this. In British Columbia, which is the only jurisdiction in Canada where political parties are subject to privacy law, I believe that the enforcement mechanisms are the same for parties as for other entities subject to that law.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Has there been any chill on volunteers there, that you know of?

[Daniel Therrien]

Not that I know of.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Let's compare that to other jurisdictions outside of Canada.

For example, does the GDPR apply to political parties?

[Daniel Therrien]

Yes, the GDPR applies to political parties in the EU.

What is the penalty for a political party breaching the GDPR? I must confess I have not looked at that question specifically. We could get back to you.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

The argument we're hearing is that political parties are different, that we don't understand and it's a very different world. Political parties say they need to do data differently.

As far as you've seen, you don't agree with that argument. In British Columbia they don't do it. In Europe they don't do it either. Is there any jurisdiction in the world that has privacy laws and has taken an approach where they've said, okay, we have general privacy laws, but we're going to do a whole new set of them, specific ones just for political parties?

[Daniel Therrien]

Not to my knowledge, but again I want to emphasize that I recognize that there is a difference in context with the relationship between political parties and electors versus commercial entities and clients. There is a difference in context, but that does not mean that the privacy laws, including PIPEDA, cannot apply having regard to context, as is occurring in Europe or in British Columbia.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

That would be within the confines of one law, not two.

[Daniel Therrien]

Yes.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

I have one more quick question, and then I'll pass it over to my colleague.

Have you looked at the terms of use for all these so-called free applications? I'm talking about free services that I have no choice but to subscribe to. If I want to buy a phone, I have to agree to let them spy on me. I use that word deliberately: spy on me.

If I want to use a company's search engine, so many of the terms of use, which I cannot negotiate, implicitly force me to allow the company to do things I don't want them to do. Then they come in front of us and say, “Don't worry about it. You can just click this button and we won't do it,” but that's not true. What they show you changes, but they do it, and they collect information.

Is any jurisdiction finally coming in with laws that override any company's right to put certain terms of use into the contracts that we have to sign, so we have an overriding one that controls our privacy?

[Daniel Therrien]

The short answer is no. What exists in other jurisdictions is rules that have stricter requirements on the conditions for consent, explicit or not, meaningful or not, but not laws that override terms of use of the company. In Europe, for instance, if there are stronger standards requiring explicit consent in many cases, then the consumer, the individual, is better informed of the uses that will be made, but they do not go as far as you're suggesting. Of course, we're looking at this issue on the facts from Facebook in our investigation.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Okay, but I have rights. Say I don't consent. Then they say, okay, you bought your phone, but it can't work. I say that I don't consent to Facebook. Then it says I can't use it. Then I'm blocked out. So I'm looking and I'm saying, as a consumer, as a user, that I want to use these services, but I don't want them spying on me. I don't want them following my data, and I don't want them saying, “Well, you can go and...”, as we had with Google or all these other ones that “tweaked” the wording so carefully.

They have been changing their terms of use all along to give themselves greater leeway to take our data and to use it. I, as a consumer, have zero bargaining power with them, so I must rely on the government.

[The Chair, Conservative, Bob Zimmer]

We're at time, so could we have just a quick answer, please?

[Daniel Therrien]

I'll just say there are certain things that are truly required for the service to function. For instance, your location must be given to a phone operator so they can reach you. Of course, the issue, from a privacy perspective, is the conditions that are suggested or imposed by companies beyond what is truly required, and there are a lot of them.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

If they track me for one year, they don't need that. They need to know where I am today to use it.

Thank you, Chair.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Baylis.

We'll go next to Mr. Kent for seven minutes.

[Peter Kent, Conservative, Thornhill, ON]

Thank you, Chair.

Thank you, Commissioner, for appearing before us again today.

Earlier this year, we learned in our study of the scandal with Cambridge Analytica, Facebook and AggregateIQ—as you did in your investigation, and as did the Privacy Commissioner of B.C. and the Privacy Commissioner of the United Kingdom—that millions of pieces of personal data, including that of hundreds of thousands, perhaps more, Canadians, was improperly harvested from Facebook, handled by a number of bodies, and moved back and forth in the digital world across national borders, and we have no assurance that this original improperly harvested data, this mass of data, has been destroyed.

We learned just in the last few weeks that your former Ontario counterpart, Ann Cavoukian, resigned from a Google sibling in Toronto, Sidewalk Labs, because Google could not assure her that highly personal data within Toronto could be effectively de-identified, which Google said was their objective.

Just in the last few days, a Conservative Order Paper question was responded to by the Liberal government regarding recent hacks of the Canadian government: 800 pages, representing perhaps 10,000 hacks or improper access to various government departments and agencies' websites.

This week we learned that you have launched an investigation into Stats Canada's demand or request to Canadian financial institutions for deeply personal information on at least 500,000 Canadians without their knowledge or consent—again, I know that consent is a major concern of yours—to develop a new institutional personal information bank. The claim here by Statistics Canada is that it would be anonymized.

Certainly, after seeing Cambridge Analytica, Facebook and AggregateIQ, and after hearing the very legitimate concerns of a well-recognized authority like Ann Cavoukian over the impossibility or the unlikelihood of de-identification being achieved, I'm also deeply skeptical about Statistics Canada's ability to guarantee that all of the information they're harvesting will be anonymized.

I know you've just begun your investigation, but is consent a paramount consideration in situations like this? Could we have your comments, please?