Information & Ethics Committee on May 7th, 2019

[Kelly McCauley, Conservative, Edmonton West, AB]

My follow-up question to that is that I'm wondering how much of Facebook's actions are maybe due to a perceived weakness among our position. One of the things I find very disturbing in all of this—and this comes out of another committee I serve on—is government is moving all of our advertising out of local Canadian newspapers and radio and pushing a large share to Facebook. I have to wonder about the laughs they might be having in their head office knowing they're fighting with you over PIPEDA, but at the same time the government is pushing taxpayers' money to them.

Then I look through your departmental results and I look at how we, as a government, take privacy rather less seriously. I'm looking at a National Post report. When a National Post reporter asked a question of PSPC and DND, within an hour and a half they got a threatening phone call from the president of Irving, threatening a lawsuit because PSPC and DND gave away private information for the third time. The government gave away private information to a corporation.

I look at your departmental results and look at the percentage of government organizations that are informed and guided to protect privacy rights. Our target is only 60% of government organizations to actually follow our own rules. I wonder if Facebook looks at this and just thinks that if you guys aren't serious about privacy anyway, why should they be? Oh, and by the way, at the same time they'll take taxpayers' money from us.

I'm outraged, frankly, at the stupidity of it all. The same time that you're fighting against them, the government's handing them cheques, and at the same time—

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Billions of people use Facebook.

[Kelly McCauley, Conservative, Edmonton West, AB]

Yes. Could I add another one?

[Daniel Therrien]

My answer would be this: A number of actors in society could take action to move away from companies that violate their privacy. The government has spending powers for advertising, but often the case is made that individuals also have a choice and could decide not to be on that platform. The fact remains that Facebook has two billion users and it's not easy for an individual to withdraw from that service. It's possible, but it's not obvious.

[Kelly McCauley, Conservative, Edmonton West, AB]

We could switch back—

[Daniel Therrien]

This leads me to the solution. I do not think it is for individuals to have all of the responsibilities. Perhaps government could take some action by refusing to do business with a certain company that may have more impact, but that's not the true solution either. The true solution is to ensure that companies that meet a need in society—and clearly there's a need for people to communicate—do that in a way that respects the rights of Canadians. That means legislation.

[Kelly McCauley, Conservative, Edmonton West, AB]

There seems to be a lack of outrage over it. There was a blip with Cambridge Analytica, which was very serious. Do you get the sense that, day to day, Canadians are just saying that it's a free service and if people don't want their privacy taken, don't use it? Is there just a lack of understanding of how serious this is or a lack of concern?

[Daniel Therrien]

I think people use these services because they have a need to function in a modern society. Modern society includes social media and relying on digital services. They would rather do that in a way that does not put their privacy at risk, but they feel they have to do that. Again, I think our task is to ensure that Canadians can have the benefits of the digital economy, but in a way that does not create harm for them, which brings me back to legislation.

[Kelly McCauley, Conservative, Edmonton West, AB]

Thanks.

[The Chair, Conservative, Bob Zimmer]

Next up, we'll go to Ms. Vandenbeld for five minutes.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

I think the previous question goes to the heart of the problem, which is the dilemma when you have these big data-opolies and choice is really not a real choice in terms of users or anybody else.

When you started this investigation, of course it was Cambridge Analytica and Facebook and the data breach. We, on the committee, have found that AggregateIQ was an integral part of that. Is that study still ongoing?

[Daniel Therrien]

It is, jointly with RBC colleagues, and we hope that later this spring we will be able to announce our conclusions.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Without pre-empting the conclusions, is there anything you anticipate coming out of that study that would add to your recommendations on what this committee—

[Daniel Therrien]

—on legislation?

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Correct.

[Daniel Therrien]

It's difficult to say, and if I say, I may disclose the conclusions prematurely.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

We'll wait in great anticipation for the report.

[Daniel Therrien]

Okay.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

The concern I have, and you mentioned this a little bit earlier when you said that Facebook has millions of apps, is that Cambridge Analytica is just one app.

[Daniel Therrien]

Yes.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

We've been told in this committee that this is just the tip of the iceberg, and we know there are many other data platforms and social media platforms. Do you have concerns beyond Facebook of other data platforms? If so, given that you don't have the proactive ability to investigate, how would you recommend that we make sure we are able to investigate when these kinds of breaches may be happening in places that we are not even aware yet?

[Daniel Therrien]

Of course I'm concerned. Right now under the current law, we largely investigate based on complaints. We initiate a few complaints ourselves, but that's truly the tip of the iceberg.

Proactive inspection powers have to be seen in the following light. We will never, as a regulator, be able to monitor the activities of all companies. That's not the point, but if we have the authority to proactively inspect practices where we think there might be something untoward happening, and then find in some cases that something untoward is happening that carries consequential penalties, that sends a message to the whole industry that, if they violate the law, they are at risk of being inspected by the Office of the Privacy Commissioner and of incurring these fines.

With a system like that, there are much greater chances that behaviour across the sector will be improved.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

They are intricately intertwined, the ability to proactively investigate and be able to impose penalties.

[Daniel Therrien]

Yes.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

With regard to Facebook, the fact that they didn't implement the recommendations in 2009 and that they have rejected and not even acknowledged that there was wrongdoing in this case, do you believe that the kind of thing that happened with Cambridge Analytica, when people in Canada today are on Facebook, could still happen today?