Information & Ethics Committee on Jan. 31st, 2019

[Daniel Therrien]

The short answer is yes, in two respects.

When the British parliamentary committee published the documents from Six4Three, we saw references to the Royal Bank, and we considered whether to look at this particular aspect in the context of our investigation into Facebook and AIQ. As we were doing this, we received complaints from individuals on whether or not the Royal Bank was violating PIPEDA in some way in receiving information in that way. So that question is the subject of a separate investigation.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Just to be clear, you received complaints about RBC violations—

[Daniel Therrien]

About RBC's alleged role in receiving information from Facebook, allegedly in violation of PIPEDA.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Okay. From your knowledge of this back channel that was given to certain preferred customers with Facebook, would it have been possible to read the private messages of Facebook users if you had access to that?

[Daniel Therrien]

I can't comment on that. We're investigating. We'll find out for sure.

[Charlie Angus, NDP, Timmins—James Bay, ON]

You're investigating. Okay, fair enough.

Thank you very much for that.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Angus.

We're going to go to Ms. Vandenbeld for two and a half minutes, and then....

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

She'll take it all.

[The Chair, Conservative, Bob Zimmer]

Okay.

Go ahead.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Thank you, Mr. Chair, for your indulgence on my getting the last question. It's very important and interesting testimony.

I'd like to pick up on this idea of ownership and consent in the context of government. If I go on Air Canada, and they ask me for my email and cellphone number so they'll text me when my flight is delayed or anything, I have a choice to do that. However, there are things in government where you don't have a choice. You have to provide information. Your taxes are required. The idea of consent immediately has a different implication when something has to be provided.

In that context, how do you see consent, or even who owns that data? If I go to Air Canada, I can take my profile off. I have a choice. But with government, if there's a criminal record, you can't say you want to delete this or change that. The information no longer really belongs to the person.

Where does ownership and consent go when you're dealing with government?

[Daniel Therrien]

You're absolutely right that in a government context, consent is not always required for a government to collect information. The situation doesn't arise in quite the same way. We have rules already in the Privacy Act for this.

One rule is that, as it stands, government should collect information, to the extent possible, directly from the person interested in the information, either with or without consent, say, in a law enforcement situation. The principle is to collect directly from the individual, which then leads to questions around what's on social media or potentially publicly available. That's a difficult area to navigate under the current act. But the first principle is to collect normally from the individual concerned, with or without consent. That's not the quite the same situation as for the private sector. I agree that consent is not always required.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Given that, we heard that government is using things like predictive analytics and could also use more in the future. I think the example that was given is that CRA can even use some form of AI with predictive analytics to determine where fraud is more likely to be occurring, so they can target and look at those sorts of things.

However, if you think of the concept of privacy by design, that is specifically saying that data is used for the purpose for which it's collected. If you're providing information to CRA about your taxes, but CRA has a mandate to investigate tax fraud, it may not necessarily be the purpose for which it was collected, but it might be a legitimate use of the information by government. That's just one example.

In this world of more predictive analytics and more AI, where does the idea of privacy by design fit with that?

[Daniel Therrien]

In a tax context, there is information that CRA obtains directly from the taxpayer. It is possible that the CRA looks at social media and other environmental information to gather intelligence and may put all of this information towards artificial intelligence. It's important. Data analytics is a new reality and it has many advantages.

However, AI systems need to be implemented in a way such that the information that feeds the system is reliable and has been lawfully obtained, so that leads to certain consequences. If CRA looks at information on social media, and let's assume for a second that it is truly publicly available, that says nothing about the reliability of the information.

To answer your question, in an AI context, privacy by design ensures that AI is implemented in such a way that the information that feeds the system, first, has been lawfully obtained, second, is reliable, and third, does not discriminate on the basis of prohibited grounds of discrimination, but is based on objective factors of analysis.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

It's also been suggested that for many purposes we would de-identify data before you would go through this. Is that something you think is feasible?

[Daniel Therrien]

That is preferable but not always possible. It's conceivable that AI could work with personal information, but the preference would be to start with anonymized information.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, all.

Thanks to the commissioner and his staff for appearing before us today. It's always thoughtful and this issue seems to be ever growing, so again, thanks for coming today.

[Daniel Therrien]

You're welcome.

[The Chair, Conservative, Bob Zimmer]

For the rest of the committee, we're going to stay for a minute, just to address the motion that was presented prior to Mr. Therrien's testimony.

We'll go back to Mr. Kent, first, and then to Mr. Angus.

[Peter Kent, Conservative, Thornhill, ON]

Thank you, Chair.

I understand the Liberals would like 48 hours to consider the request, so in the interest of collegiality, I would accept that 48 hours.

However, I would put forward a motion saying that this original motion from today be dealt with as the first item of our next meeting.

[The Chair, Conservative, Bob Zimmer]

Go ahead, Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

I am absolutely outraged by my colleague's collegiality, so I am going to have to talk to my colleague beside me to decide if we are going to filibuster.

[The Chair, Conservative, Bob Zimmer]

It sounds like it's been a discussion that's been rather loud during the committee meeting, so next time, I would ask that it be a little quieter. It sounds like we're going to deal with this on Tuesday, so have a good weekend, everybody.

Yes, Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

I have one other element. We were supposed to discuss my motion today, which is that we are going to have to plan for a parallel study to happen. Nathaniel has asked to be able to work on the language of my motion in advance of a public meeting.

Just in the interest of being really collegial—you get one out of the whole four years in Parliament, and this is it and you can put it in your pocket.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

We can put that on Twitter.