Information & Ethics Committee on May 7th, 2019

[Daniel Therrien]

They raised the jurisdictional question. We've answered it in our report. They never acquiesced to our jurisdiction. They pursued a discussion with us as though we had jurisdiction but never conceded that we had jurisdiction. That's the state of affairs. If Facebook raises this issue in the Federal Court when we file our application, the court will decide whether we have jurisdiction.

[Charlie Angus, NDP, Timmins—James Bay, ON]

When we began our hearings, and I first wrote to you, it was the spring of 2018 when the Cambridge Analytica scandal had just blown up and we had found that 620-some thousand Canadians had their information taken. Facebook was made aware of that in 2015 and made no effort to tell Canadians.

They said at the time when they came to our committee in 2018 that they had a very robust response. I'm flabbergasted that a company would look at a finding of law and say they simply don't recognize their jurisdiction.

Are you aware of other examples of companies saying that in Canada?

[Daniel Therrien]

I'm not. There may be other regulators that don't have the authority to make binding orders, but nothing comes to mind.

[Charlie Angus, NDP, Timmins—James Bay, ON]

I was trying to think of a comparison. I was imagining when we have automobile recalls because of numerous accidents, that if an automobile company came back to you and said there are multiple accidents in Brazil, in the United States, in Britain, however, since you couldn't prove that anybody died on the highways of Canada, they don't recognize your role as a regulator to make them fix the fundamental problems in their vehicles.

I want you to correct me if I'm wrong, because they said it would cost too much for them to comply with the laws respecting the rights of Canadians.

Would that be a fair comparison?

[Daniel Therrien]

It's a good analogy. We were in discussions with them as to whether their privacy policies led to meaningful consent. They disagreed that they did not obtain meaningful consent but moreover, part of their arguments was, in any event, there was no harm. No Canadian was harmed.

You haven't found evidence that Canadians were harmed, which is a good analogy to your car accident example.

Because we did not demonstrate harm to Canadians, we have no jurisdiction. Point one, the legal foundation leading to risk and potential harm to Canadians we found was unsound, contrary to PIPEDA. Point two, we have seen harm in the U.S. and in the U.K. based on the same weak legal foundation. The same risk that manifested itself in the U.S. and the U.K. could very well occur in Canada.

We looked at the terms and conditions. Cambridge Analytica was one manifestation of one third party app. Facebook has millions of third party applications. Clearly, there is harm for Canadians.

[Charlie Angus, NDP, Timmins—James Bay, ON]

I'm not a lawyer but I'm thinking the basic concept of jurisdiction—and correct me if I'm wrong—means the country of Canada for which you are a regulator, and 620-some thousand Canadians had their data taken because of this breach. Facebook was aware for it for three years and made no effort to tell Canadians. Within the jurisdiction of Canada, they broke the law because they did not make any efforts to let any Canadian know they had been a subject of this breach.

Is Facebook putting forward the position that jurisdiction only counts, only exists if you can prove that Facebook physically caused harm by its actions?

[Daniel Therrien]

It's pretty close to the position we heard from them. They're not challenging our jurisdiction on the basis that they're in the U.S. or anything of the kind. They're challenging our jurisdiction on the basis that the terms and conditions we were examining did not, in their view, result in harm, and the absence of harm led to the absence of jurisdiction. We think that we have jurisdiction because we have jurisdiction to look at what I call the legal foundation, i.e. terms and conditions—

[Charlie Angus, NDP, Timmins—James Bay, ON]

You have jurisdiction because you're there to protect the rights of the citizens of our country as mandated by Parliament. Is that not how jurisdiction works, and your obligation is to protect our citizens whether—

[Daniel Therrien]

Facebook is engaged in commercial activity that is subject to PIPEDA, which gives us jurisdiction.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Next up for seven minutes we have Monsieur Picard.

[Michel Picard, Liberal, Montarville, QC]

Thank you.

Did you see the two-part documentary about Facebook?

I don't know if it was on HBO or the Fifth Estate.

[Daniel Therrien]

No. I'm sure my colleagues saw it, but I didn't.

[Michel Picard, Liberal, Montarville, QC]

Fine.

Both parts of the documentary talk about fake news, as well as Cambridge Analytica.

Obviously, the questions that were put to Facebook's former executives give us to understand that there was extreme naïveté among all of the executives, so much so that no one was aware of consequences or of the legal repercussions of using the information they collected from people.

In parallel, one of the important defences Facebook used rested on the famous Safe Harbor Rule in America. In fact, under that rule, you cannot criticize a business for the type of actions we are discussing here, to the extent that the nature of the company means that it cannot be caught under the terms of the law.

Does that mean that the structure of Facebook or the nature of its activities allows it to take advantage of a type of legal void and consequently, to not get caught?

Otherwise, is that hypothesis not applicable because the company is defined like that, it has activities that are also defined a certain way, and it claims to be providing a given service?

Does that exclude it from any legal proceedings?

[Daniel Therrien]

The arguments about jurisdiction put forward by Facebook did not concern the territory, the location of the data on a given territory. The notion of Safe Harbor potentially calls that scenario into play.

According to the company, since we had not demonstrated any real prejudice to Canadians, we did not have the legal jurisdiction to speak out. I don't think the notion of Safe Harbor is an obstacle in this case.

You referred to the lack of awareness. It's quite possible that at a certain point in the evolution of this company, the executives were relatively naive and may indeed have lacked awareness to some degree.

However, my concrete experience leads me to think that this is not a matter of the lack of awareness. The executives say that they want to do better. The regulatory agency says to the executives' representatives that they must do better because according to that agency, they have broken the law. The executives are then aware of that fact, and yet they still decide not to act.

[Michel Picard, Liberal, Montarville, QC]

In the documentary, Mr. Zuckerberg says, verbatim, that he will co-operate in order to comply with government requirements. But according to other former directors, he did not walk the talk.

Is the nature of the service provided by Facebook, if I compare it to a highway, simply that of a paved highway on which there is personal and commercial traffic, and advertising, and so on? There is free circulation on the highway, which the company has paved widely, so as to have as much traffic as possible.

Anyone who wants to watch the traffic on the highway can sit on the sidelines and watch it go by. The third party looks at what is going by on the platform, so that the very nature of Facebook's activities--in its eyes--frees it from any responsibility we would like to attribute to it.

I am trying to eliminate the arguments in its favour so that we may have all the necessary tools to consider even more coercive means than the ones we have at present.

[Daniel Therrien]

The analogy between Facebook's platform and a highway is not a bad one, but I would say that one of Facebook's positions is to say that it is a company that does business with consumers, on the one hand, but also with other companies, on the other hand, and it is these other companies that collect information from users.

Facebook says that it is not responsible for what the other companies do, and it asks to be held accountable only for its responsibilities, and not for the activities of other companies. That might hold, if not for the fact that Facebook has a commercial interest in having an enormous amount of traffic on its highway and in having other companies collect information.

It's not a sin for Facebook to make money, but the fact of developing business relationships from which it derives profits, and thus do business that is increased by the presence of third-party apps, is accompanied by legal obligations.

[Michel Picard, Liberal, Montarville, QC]

The legal obligations apply because of the nature of the agreement with a third party and not as a consequence of the bad behaviour of the third party itself, correct?

[Daniel Therrien]

With regard to PIPEDA, it's one of the basic questions we are going to submit to Federal Court.

What's going on in our opinion is disclosure by Facebook to the third party. The user provides information to Facebook. Facebook has the information and communicates it to the other company.

The disclosure is an activity that is accompanied by legal consequences for Facebook. Facebook must see to it that the user provides informed consent for that activity.

We believe that this sets aside the argument according to which Facebook is not responsible for what its neighbours or business partners do.

[Michel Picard, Liberal, Montarville, QC]

I have a hypothetical scenario which may not be very likely, but I will present it to you, nevertheless.

The Canadian Facebook market is about equivalent to the California market, if one takes population into account.

There are more than a billion Facebook users. I think that one person out of three in the world is on Facebook.

If we bother it too much, the company will simply leave Canada. Is that a consequence we can consider, and can we deal with it?

Are we now in a dead end that prevents us from acting to suit ourselves?

[Daniel Therrien]

I would approach the question in the following way.

Facebook is very successful because people want to communicate with their friends and family. It's a real need. Does that need have to be met by a company called Facebook, or would there be other companies that could provide social networks that could meet the needs of Canadians?

It would be more complicated. There would be fewer people on that social network, but I think that is how we have to look at it.

If a company, no matter how important it is, decides to leave because it does not want to comply with the law, I believe there will be other players that will take its place. There is a real need, and other players will want to meet it while complying with the law.

[Michel Picard, Liberal, Montarville, QC]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Next up for five minutes is Mr. McCauley.

[Kelly McCauley, Conservative, Edmonton West, AB]

Thank you, gentlemen, for your rather honest and sometimes disturbing testimony.

I'm a guest today on the committee, so I'll ask you to bear with me.

What recourse, in the absence of stronger legislation, do we have to deal with what you've stated, that Facebook has violated PIPEDA? Is there any?

[Daniel Therrien]

Legally, there is nothing in terms of privacy violations.