Information & Ethics Committee on Jan. 29th, 2019

[Dr. Ann Cavoukian]

Improving service levels to citizens is, of course, extremely important and not everyone, as [Technical difficulty—Editor], has equal access to the Internet and different levels of technology. I think improving services to individuals, to citizens, is a very valid pursuit. It's the means by which you do it. This is always the question mark that arises. How do you reach out to individuals and direct more services in their direction without invading their privacy, without looking into what additional needs they may have? If they provide you with that information, then by all means, that's wonderful. That's positive consent. You can then direct additional services to them. But I don't want the government fishing into the data they already have about citizens to find out if some additional services might be of value to them.

I think you need to ask citizens if they would like to pursue these additional services, and then by all means direct them to work with you, etc. I don't think we should do it by means of digging into drifting databases of information on our citizens.

[Dr. Michael Geist]

I'm glad you raised again the issue of access. As I've been writing for some time, I've long believed that one of the real reasons that governments.... This is not a partisan issue at all. We've had successive governments struggle with this issue. One of the reasons that there's a need to make real investments in ensuring universal, affordable access is that the cost savings in being able to shift to more and more e-services from a government perspective, I believe, depends upon ensuring that you have universal, affordable access.

Until you reach that point, I think you're quite right that you basically have to run parallel service sets to ensure that everybody does have access. You can't have certain kinds of government services that some people are effectively excluded from being able to access because they don't have access to the network. It makes sense to invest where the private sector has been unwilling to do so, and for a myriad of reasons. One of them is that there is a payoff from a government perspective, because I think it better facilitates the shift to some of those more efficient electronic services.

We are clearly not there yet. Studies repeatedly have found that we do not have universal, affordable access on the broadband side, and on the wireless side we continue to pay some of the highest wireless fees in the world. That tells us that we continue to have a significant policy problem when it comes to affordable communications in Canada.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

My last question is also quite simple.

Do we have the required level of programming expertise in Canada? I believe the industry is experiencing a crisis, a shortage of programmers. We have to look outside Canada. It seems that finding very competent people is quite complicated. The new generation does not seem to like this kind of work.

Would it be difficult to implement such services for and by Canadians?

[Dr. Michael Geist]

Well, speaking as a proud father of two kids who are doing engineering at the University of Waterloo, I'm not so sure that's true. I think we do see a lot of people increasingly move in that direction. When I take a look at my own campus at the University of Ottawa, and frankly at campuses across the country, there is an enormous interest in the STEM fields and the like. If there is a shortage of that expertise, I think it only serves to highlight just how in demand these skills are. It's not that we don't have people developing and moving into that area. I think we unquestionably do.

[Dr. Ann Cavoukian]

I agree with Michael. I think we have very strong resources here in Canada. Perhaps they will be insufficient in the future, but certainly in terms of the younger generation, I mentor a lot of students and I always tell them, “Make sure you learn how to code.” You don't have to become a coder, but learn how the technology works. Learn how you can use various coding techniques to advance your interests in completely different areas, etc. The fundamentals are associated with understanding some of the emerging technology. I think that's pretty widely accepted now.

[The Chair, Conservative, Bob Zimmer]

Thank you, Monsieur Gourde.

Next up is Mr. Baylis for five minutes.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Thank you, Chair.

I'd like first of all to follow up on a bit of clarification that Nate did with respect to what Peter was asking in regard to Estonia. I think that's the foundation. If we're going to go to a digital government, we need a digital identity.

Are you in agreement with that, Ms. Cavoukian, or do you have a concern with starting off with a digital identity?

[Dr. Ann Cavoukian]

Forgive me, but I'm going to say it depends, because it depends on how it's constructed.

A digital identity, if it's strongly protected and is unique and encrypted and has very restrained access, may facilitate greater access to services, etc., but identity theft is huge. It's the fastest-growing form of consumer fraud ever. If you have a digital identity, that can also be subject—

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Yes, but the new digital identities have biometrics. In the end, you can never stop a thief, but for someone finding my number, my SIN, say, versus finding that I have a properly encrypted digital identity that has biometrics and my eye scan and all of this, the likelihood of them stealing that is an order of magnitude less than what they can do today. I would say that —

[Dr. Ann Cavoukian]

As long as the biometric is a strong biometric or uses biometric encryption, which encrypts the data automatically in a way that only the individual with their own biometric can decrypt it.... Unfortunately, there's a lot of association of biometrics with risk, so it's not a slam dunk that your biometrics are linked to your digital identity. You have to use biometric encryption and you have to ensure that it's properly kept. It's not that I'm disagreeing with you, sir. I'm just saying that the devil is all in the detail, and that's what we have to answer here.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

I understand.

Would you like to weigh in on that, Dr. Geist?

[Dr. Michael Geist]

Yes. I guess I would use the opportunity to again reiterate that for me the policy frameworks around the technology are in some instances just as important as the technology itself. Even in the way you phrased your question, you made a compelling case for why those technologies—

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Let's assume that we're going to use the latest technology. The latest technology has all these things built into it—

[Dr. Michael Geist]

Precisely.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

—versus, say, my social insurance number. If I give it to you today, it's done.

[Dr. Michael Geist]

I get that, so that notion of using best of breed technology makes a whole lot of sense, but there is still a full policy layer that comes around that. I think there certainly will be many who will voice some amount of concern given that our previous experience is that sometimes there are assurances that we are going to use certain kinds of encryption or other sorts of technologies, so “don't you worry, there will be no access”. Until you come across a particular use case where you say it would be really great if law enforcement had access just under this circumstance or under that circumstance—

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

I think I understand. We're skating a little further ahead.

Let's say we start today. Estonia's benefit is that they were a new country and they were starting fresh, so they wouldn't have to convert. They're a small country with a small number of people, relatively speaking. Let's say we start today. It seems to me that the first step we have to do.... I agree with Ms. Cavoukian that we can keep the silos, and I agree that it's the safer approach. What Estonia does is they have a backbone so you can come in and go here or you can come in and go there, but it's not all one big database.

I also believe it will be a lot easier to build out from our existing silos, as opposed to trying to do it.... I'm in agreement with that, but it seems to me that if we're going to do it, we have to start off with a digital link, okay? Let's say I'm Frank Baylis and I just showed up on the system. “Okay,” it says, “prove to me you're Frank Baylis.” Right now, it says to type in my SIN, that number, and that's pretty easy to rip off, right? Whereas if it says, “Let's get a scan of your eyes” or “Let's get some biometrics” and some questions asked and all of that, it seems to me that, to your point, you could have privacy and security.

I think that was the first statement you made, Ms. Cavoukian. Can we not start there and have an agreement on that before we get into all the other stuff?

I'll pass it back. I cut you off. I'm sorry.

[Dr. Michael Geist]

At the risk of saying that this is a chicken or egg kind of issue, I'm not comfortable giving you my biometric information unless we have a legal and privacy framework established in Canada that meets current privacy standards.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Okay, so you're saying that before we get there, before we start down that path, we better be darn sure that the privacy is just locked hard.

[Dr. Michael Geist]

It's not just a matter of locked hard. We have a decades-old set of rules that effectively apply to that system.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

It doesn't work.

[Dr. Michael Geist]

I don't think you can make an argument to say we're as modern and as digital as can be while using 1980s laws that provide the safeguards around the system that you've just created.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Do you want to weigh in, or am I out of time?

[The Chair, Conservative, Bob Zimmer]

If she can answer in 20 seconds that would be great.

[Dr. Ann Cavoukian]

I just want to say, Mr. Baylis, that I agree with you. We have to explore these new technologies. There's no question. We just have to ensure that in addition to what Michael said, we have to update our laws. They're so dated. We have to ensure the technology is such that we can truly safeguard the information and it won't be accessed by others.

I gave the example of biometric encryption. There's now a lot of concern about facial recognition technologies that are happening everywhere, obtaining your facial recognition, and using it for purposes never intended. I'm working with an amazing company out of Israel, an Israeli company called D-ID, which can actually obscure the personal identifier so it's not picked up by facial recognition.

There are a number of complexities. I'm sure we could address them as long as we address them up front, proactively, to prevent the harms from arising.