Evidence of meeting #135 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was going.
A video is available from Parliament.
4:25 p.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you, Mr. Angus.
Next up for seven minutes we have Mr. Erskine-Smith.
4:25 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Thanks very much.
I want to start with something really simple. I have a social insurance number. I'm not entirely sure what it's for most of the time. Now I'm going to attach a password to that social insurance number and then the government is going to issue me an RSA key with a rotating number to ensure that there's a two-factor system to it. Now I can access CRA immediately. When my wife is on maternity leave and needs to access EI, she could use that same system. When I'm reapplying for my password, I could use that same system. Why is that so hard?
Mr. Eaves.
4:25 p.m.
Lecturer in Public Policy, Digital HKS, Harvard Kennedy School, As an Individual
It's a question of what the implications are of making that choice.
We could say, okay, your social security number is now your unique identifier, so let's start putting your unique identifier against every piece of information that the government collects about you, maybe at the federal level, but maybe also at the provincial level and the local level. Someone could come along and say, well, let me see if I could query a whole range of databases and start pulling together information that I know is specific to you and then use that to create a profile of you that may be helpful, but I may chose to do things with that information that are not helpful.
4:25 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Great. That's really useful.
Let's add another layer. Now there's a population register with my basic information: name, address, phone number, and perhaps email address. Hopefully the government is able to communicate with me by email in the way that I used to be able to communicate with my clients. It's bizarre that I can't get my blood results by email when I could certainly deliver legal advice, which is as sensitive oftentimes, by email.
Now there's a population register with my basic information. Now the only information that every department, except for that population register, has about me is my SIN. Now there's an additional layer where they don't know anything about me except for a connection of my information. If it's a health care system, they know my blood results in relation to a SIN but not in relation to my name. If they have to access that, then they're accessing the population register first, so now we add that layer.
Then we add another layer, which is the Privacy Act or whatever data governance piece we want to layer on this to govern the queries that these databases can make of one another. Those are the moving parts of this system, and if we get those layers right, the system presumably can function effectively.
4:30 p.m.
Lecturer in Public Policy, Digital HKS, Harvard Kennedy School, As an Individual
I agree.
I get very torn. I love this subject because this is the future I teach about. This is the endgame that we want to drive towards. Everything I'm trying to talk to you about today is the questions that I ask myself.
What happens if we win? What happens if we succeed? What happens if we get to that world? What are the things we want to be thinking about to mitigate the possible negative outcomes?
I would put forward that probably people such as you and me have not experienced the worst violence the state can bring upon an individual. If you were someone for whom the state has not always been a friendly and helpful person, you might be deeply concerned about what I would call a very hyper-powered state and its ability to use this information against you.
4:30 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Yes, I appreciate that.
You've laid out in your article four concerns. Your first concern is the social contract. Say, as a starting point, when we're rolling this out—if we were to roll such a thing out—it begins voluntarily. Someone such as me or you, who has trust to at least try out the system, can do so, and those who are concerned don't have to.
Would that not meet the social contract concern, at least in the first instance?
4:30 p.m.
Lecturer in Public Policy, Digital HKS, Harvard Kennedy School, As an Individual
It may, in the first instance, but there are two concerns that I would have following on that.
The first is that people who are most likely in need of state assistance tend to be those who are most likely to be marginalized. I can actually imagine a two-track system, where those who are wealthy, who really don't need to engage with the state very much, end up contributing very little information into the state and the state knows less about them, whereas those who are most in need or those who are most marginalized actually end up putting a lot of information into the state. Therefore, we almost have a state that's capable of large amounts of surveillance on the people who are maybe the least prepared to protect themselves.
4:30 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
If it is opt-in, and then there's the system as it is for those who don't have trust in the system, these data challenges already exist for governments. The challenge that you just laid out already exists for governments. Governments do share information among agencies. There are pathways for doing so within the Privacy Act, within the Security of Canada Information Sharing Act.
What changes when it's digital?
4:30 p.m.
Lecturer in Public Policy, Digital HKS, Harvard Kennedy School, As an Individual
A lot changes, such as the scale at which you can do things.
Right now, things may be digital, but my ability to share information between ministries and identify who exactly is David Eaves, and figure out which file is about that David Eaves versus possibly another David Eaves, requires someone who is a motivated actor piecing that story together, whereas in a world in which everything is connected to a unique identifier, where I'm going to identify exactly who I am and all the information connected to me, I can do that at scale. I can do that for all 33 million Canadians simultaneously.
Maybe I can throw a machine learning algorithm against that and figure out what services I offer people, figure out who's Muslim and who's Christian. I could be doing all of that in a way that I could never do in the world in which we exist right now.
I'm deeply in favour of going to this world, but I really want to make sure we figure out the governance models before we do it.
4:30 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
That's right.
I guess the question then is that we already have a governance model in place. We have been told multiple times that it is insufficient as it relates to the Privacy Act. However, that would be the governance model that we're looking at.
Is it so insufficient as of today? It governs data sharing between institutions already. Just by virtue of the fact that I'm now allowing these agencies to interact, and let's say the population register is a starting point, it doesn't seem that worrisome to me, given that these agencies all have this information and it will allow me to access these services in an easier way.
As a starting point, say we didn't even update the Privacy Act—although I think we should make recommendations on that front again. I don't really understand how the governance challenge is different, because we already have a data governance framework in place—the Privacy Act.
4:30 p.m.
Lecturer in Public Policy, Digital HKS, Harvard Kennedy School, As an Individual
My fear is that the Privacy Act is actually impeding certain types of activities and innovation that we would want to have, and not necessarily preventing certain types of activities that we don't want to have. That's why I worry about the current state of the Privacy Act. I don't think it's far from perfect, but I think it probably needs a little bit of reworking.
Then, more importantly, are we setting expectations among the public about what they want? Even an opt-in world.... You know, in India, they did an opt-in; in theory, their unique identifier was opt-in as well. However, the alternative has become so poorly done that, really, if you don't opt in, the service level is so terrible that everybody ends up opting in. So, are you really opting in because you're happy to give this information over to the government and you actually believe that it's going to use it in good faith, or is the hassle level simply so high that you don't really feel like you have a choice anymore? I would really want to make sure that I answer that question carefully.
4:30 p.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you, Mr. Erskine-Smith.
One thing I would just challenge Ms. Clarke with is this: If you see a point to inject your opinion, feel free to do so. It's up to the members to decide whom to include in their question and who answers that question, but if you see a gap, feel free to jump right in.
4:35 p.m.
Assistant Professor and Public Affairs Research Excellence Chair, School of Public Policy and Administration, Carleton University, As an Individual
That's right.
I just wanted to—
4:35 p.m.
Voices
Oh, oh!
4:35 p.m.
Conservative
The Chair Conservative Bob Zimmer
We'll go to Mr. Gourde next, for five minutes, and then maybe you'll have a shot.
Go ahead.
4:35 p.m.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
That works for me, Mr. Chair.
My question goes to Ms. Clarke.
In Canada, digital services are currently provided by each department, and they evolve constantly.
Redefining digital services for Canadians implies either keeping what currently exists or throwing the baby out with the bathwater.
Who will get the benefit? Will the project help Canadians, or the government that will be able to provide more services? Will it make for better connections between certain departments? Do Canadians want departments to be talking to each other about their files, if they have not asked for it?
None of my constituents has come to tell me that they want an official from the Canada Revenue Agency to be communicating with someone from Citizenship and Immigration, for example. No one is asking for that, and I do not get the impression that Canadians have asked the government to redefine what digital means in Canada. Let us not kid ourselves, if we start focusing on going digital again, we will not be talking about spending millions, but billions. The project will take a very long time, for ever, in fact.
Ms. Clarke, in your opinion, who will get the most benefit from redefining the digital world in Canada?
4:35 p.m.
Assistant Professor and Public Affairs Research Excellence Chair, School of Public Policy and Administration, Carleton University, As an Individual
That's a great question. The question of what citizens even want in this space has come up a number of times. I don't think we have very strong data on that question right now.
To speak directly to your point—“Do people want this?”—there are two things. On the one hand, sometimes people don't know what they want until they are.... They're not even aware how good things could be. Your constituents may not be asking for this, but if they were shown how easy it could be to apply for a service and see their information already populated, or how the organization of services around what we call life events could make their interactions with the state much more seamless, they might be much more supportive of the kinds of transformations we're talking about in data governance.
What do I mean by "organized around life events"? This is something the Government of Canada has led on for quite a while. It might have come up in your discussions that we used to be kind of the darling of e-government. That was because of early work we did, following the same principles that Estonia follows right now, which is to say that when citizens interact with the state, they don't care which department does what. They're not very interested in navigating a whole bunch of siloed websites. They're going because they just had a baby and they need to figure out all the things they have to do when that happens.
They also don't care about levels of government, and often don't understand who's responsible for what, which can create a lot of inefficiencies in our interactions with the state. I think the model of horizontal, platform government begins with an appreciation of user needs. That's the driving force behind this, when you look at the jurisdictions that have really led on it.
I think that's the endgame we could be going for, to make it a purely time-and-resource question, so that when you go to transact with the state, it's fast. I think that, on a bigger level, this has democratic implications, because when I interact with the state and it doesn't work well, I question where my taxes are going. I wonder what is going on in all those bureaucracies. It fuels narratives of the gravy train, and it allows governments to say they're going to show up and clean up all the inefficiencies.
Those narratives rest, in many cases, on people's very personal stories of bad transactions with the state. I've heard Canadians say to me a number of times, “Phoenix is such a disaster. If they can't even run a pay system, how can we trust them to solve climate change, administer a carbon tax, handle child welfare benefits or run the school system?” The list goes on, and I think we have to be really thoughtful about the larger stakes at play here.
I take Mr. Angus's point that there is some blurring here of jurisdiction and mandate between what you're focused on, which is privacy and ethics, and what other committees would look at around government operations. I think this reflects exactly what we're talking about, which is that policy issues are porous. There are problematic silos between parliamentary committees, in many ways. The decisions you make and the recommendations you put forth on privacy will have deep implications for how well we can structure government services and how well governments can operate. The endgame that unites the work of, say, the government operations committee and your committee is delivering government services that citizens have faith in and that underpin a strong trust in the state.
Yes, I definitely think that even if people aren't asking for this, it could do a lot to make your constituents happy.
4:40 p.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you. That is your time.
The next five minutes will be split between Ms. Vandenbeld and Monsieur Picard.
4:40 p.m.
Liberal
Anita Vandenbeld Liberal Ottawa West—Nepean, ON
Thank you. I'll be quick.
My question is for Dr. Clarke. First of all, it's nice to see this kind of expertise right here in Ottawa, at Carleton University.
I'm a bit alarmed, as an MP who represents a lot of public servants, about what you said in regard to public servants being unable to download tools or access websites or even Wi-Fi. I just wanted to get a little commentary on that. How widespread is that?
The other question I have is this. You did your studies on the U.K., and you mentioned something in the beginning about Westminster democracies. Does the form of government—in our case, Westminster-style—have implications for how we can actually do digital democracy?
4:40 p.m.
Assistant Professor and Public Affairs Research Excellence Chair, School of Public Policy and Administration, Carleton University, As an Individual
On the question about Westminster, I'd say that one of the clearest potential tensions is around our vertical accountability structures and this horizontal model that we're increasingly pushing towards, when we think about platform government or the Estonian model.
Right now, the way we allocate praise and blame in our system is through the notion of ministerial responsibility. When a service fails or when funds are spent irresponsibly, the minister is the one who's called to account. In a really practical sense, they field those questions in the House. Who will be responsible—very practically speaking, in a concrete way, before Parliament—when there is a failure in one of these horizontal systems?
I want to be clear that there are ways to overcome this, and the beauty of the Westminster system is that it's inherently evolutionary. It is built to adapt to the times. I think we really could explore what are often called models of horizontal accountability or shared accountability. Essentially, it's the point we've been discussing. This is not so much a technical question as it really is a governance question—laying out, ahead of time, which parts of the bureaucracy and then, ultimately, which ministers will be responsible for how these systems are rolled out. I fear that right now a lot of the enthusiasm around platform governance has actually ignored that question, in part because we're often just dealing with pilots to show how this might work. If we're going to scale this, we need to be thinking about those questions.
I think the second piece of work that might be done around here is not just on the question of ministerial responsibility, but also getting into some of the data governance questions. Earlier on, the point was raised about whether the Privacy Act is fit for this purpose. The Privacy Act is one of the tools we need to look at to address these data governance issues, but it's actually not the only one, and it doesn't address a lot of the questions we're talking about.
Mr. Erskine-Smith mentioned the point about how this data could be used and combined to, say, tailor services to me in particular to say, “By the way, we know you had a baby. Now you're eligible for this tax credit.” Those kinds of questions have privacy implications, but they also have other questions around how data can be combined, when we feel comfortable with the state contacting us directly, and how we want different ministries to be able to access data. Privacy is one lens, but there's a whole other lens around ensuring we don't disadvantage certain groups over others, and those sorts of questions.
Again, it's the bleeding edge nature of the issues you're looking at. It's about privacy, but we also need to maybe develop entirely new regimes, not necessarily in legislation, but in principles of data use. Again, that's why I pointed you to the work that's being done on artificial intelligence. There, I think, we have a great example of the federal government being really progressive and open in talking about some of the very real ethical questions that are going to arise when we apply artificial intelligence to policy-making. The same thing can be done for a lot of the questions you're talking about.
February 7th, 2019 / 4:40 p.m.
Liberal
Michel Picard Liberal Montarville, QC
Thank you.
I've been hearing about this Estonian model for weeks and weeks. Who worked on this model, who tested it, and on what basis do you support your probably overrated appreciation of the model? This is for anyone.
4:45 p.m.
Assistant Professor and Public Affairs Research Excellence Chair, School of Public Policy and Administration, Carleton University, As an Individual
David, you wrote the article, so I'd say it's you who's going to field this one.
4:45 p.m.
Voices
Oh, oh!
4:45 p.m.
Lecturer in Public Policy, Digital HKS, Harvard Kennedy School, As an Individual
One of the things about the Estonian model is that it emerged after the Soviets left Estonia. They really had very few services, very few business processes in place, almost no infrastructure in place, and they really needed to build a state from scratch.
I think the Estonians were lucky in that they started to do this at the very same time the Web was emerging. Rather than trying to simply replicate the way state services had been built in other types of governments, they looked at how people were building software on the Web—distributed systems with canonical datasets—and so they started to simply say, we're going to do something really different. They were actually forced by the fact that they had very little money, so they said, we can't afford to replicate all of these systems in every single ministry.
You had a very specific point in time with a very specific history, with a relatively young leader who was willing to give political cover to people who were trying something very different. Those are the historical roots of how Estonians ended up doing what they did. One of the reasons why I think they're a wonderful model to look at—but probably not a wonderful model to try to emulate—is that their situation was so unique.