Information & Ethics Committee on May 28th, 2019

[Daniel Therrien]

In terms of protecting data or privacy, you have put your finger on concepts that are fundamental, in my opinion; they are responsibility and accountability. We live in a world where there is massive information gathering and where the information is used by companies for a number of purposes other than the first purpose for which they had been obtained.

The companies often tell us that the consent model is not effective in protecting the privacy of the public, the consumers. They are partly right. Their suggestion is to replace consent, when it is ineffective, by increased accountability for the companies. I feel that that proposal must come with a real demonstration that companies are responsible and they cannot simply claim to be. That is why it is important for regulatory organizations to ensure that companies are really responsible.

[Ellen Weintraub]

It seems to me that they are occupying a sort of hybrid space. They say they're not broadcasters. They say they're just the platform and they're not responsible for any of the content, yet they do seem to feel that they have some responsibility, because they are taking steps. People may feel the steps are inadequate, but they are taking some steps to provide greater transparency.

Why are they doing that? I think it's because they know they can't quite get away with just ignoring this entire issue. They do bear some responsibility in a broader sense, if not in a particular legal sense in any particular jurisdiction. Whether they would have stronger responsibilities if particular jurisdictions, either on an individual basis or on a global basis, decided to say, “No, no, you really are broadcasters and you have to start acting like it”, that is a question for legislators, not regulators.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Is there, anywhere in the world…

Mr. Cannataci, did you want to add a comment?

[Prof. Joseph A. Cannataci]

Yes. Thank you.

I certainly share Mr. Therrien's opinion, but I would like to add something else.

If I could in this questioning just pick out one thing, it is to say that for whoever is going to control whether something should be taken down or not, or whether it's true or not—whatever—it requires effort, and that requires resources. Resources need to be paid for, and who is collecting the money? It's largely the companies.

Of course, you can have somebody for whom you can genuinely say, “Okay, this was the party, or the sponsor, or whoever who paid for the ad.” Otherwise, when push comes to shove, I think we're going to see a growing argument and a growing agreement in a lot of jurisdictions, which will say that they think the companies are collecting the money and, therefore, they have the means to control things. We've seen that to be the case when, for example, Facebook needed to have people who spoke the language of Myanmar in order to control hate speech in that country. I think we're going to see an increasing lead in many national jurisdictions and potentially probably international agreements attributing accountability, responsibility and fiscal liability for what goes on the platforms to the people who collect the money, which is normally the platforms themselves, to a large extent.

Thank you, Mr. Chair.

[The Chair, Conservative, Bob Zimmer]

Thank you.

We'll go to you, Mr. Angus, for five minutes, with Mr. Collins following you, and then me.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Mr. Chair.

We heard an extraordinary statement from Google today that they voluntarily stopped spying on our emails in 2017. They did that in such a magnanimous manner, but they wouldn't agree not to spy on us in the future because there may be nifty things they can do with it.

I can't even remember 2016—it's so long ago—but 2018 changed our lives forever. I remember our committee was looking at consent and whether the consent thing should be clear or it should be bigger with less gobbledygook.

I don't ever remember giving Google consent to spy on my emails or my underage daughters' emails. I don't ever remember that it came up on my phone that, if I wanted to put my tracking location on so I could find an address, they could permanently follow me wherever I went and knew whatever I did. I don't remember giving Google or any search engine the consent to track every single thing I do. Yet, as legislators, I think we've been suckered—Zuckered and suckered—while we all talked about what consent was, what consumers can opt in on, and if you don't like the service, don't use it.

Mr. Therrien, you said something very profound the last time you were here about the right of citizens to live free of surveillance. To me, this is where we need to bring this discussion. I think this discussion of consent is so 2016, and I think we have to say that they have no consent to obtain this. If there's no reason, they can't have it, and that should be the business model that we move forward on: the protection of privacy and the protection of our rights.

As for opt-in, opt-out, I couldn't trust them on anything on this.

We've heard from Mr. Balsillie, Ms. Zuboff, and a number of experts today and yesterday. Is it possible in Canada, with our little country of 30 million people, to put in a clear law that says you can't gather personal information unless there's an express, clear reason? It seems to me that's part of what's already in PIPEDA, our information privacy laws, but can we make it very clear with very clear financial consequences for companies that ignore that? Can we make decisions on behalf of our citizens and our private rights?

[Daniel Therrien]

Of course the answer to that is yes. I think there is a role for consent in certain circumstances where the relationship is bilateral between a company service provider and a consumer, where the consumer understands the information that is required to provide the service. With the current digital economy, we're way beyond that. There are many purposes for which the information is then used, often with the purported consent of the consumer.

While there is a place for consent, it has its limits, and that's why I say it is important that privacy legislation define privacy for what it is. It is not at all limited to the mechanical question of consent. It is a fundamental right linked to other fundamental rights. When the outcome of a practice of a company, despite purported consent, is to surveil a consumer in terms of data localization or in terms of the content of messages given by that person, then I think the law should say that consent or no consent, it doesn't matter. What is at play is a privacy violation, being the surveillance of the individual in question, and that is a violation per se that should lead to significant penalties. It is possible to do that.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

My final question is on facial recognition technology. There's a story in the Toronto Star today that the police are using facial recognition technology. San Francisco has attempted to ban it, and other jurisdictions are at least putting a pause on it.

As for the right of a citizen to be able to walk in a public square without being surveilled and without having to bring photo ID, facial recognition technology changes all that. There are obviously legitimate uses. For example, if someone on a CCTV camera has committed a crime, and there's a database, we would maybe have judicial oversight that this is a fair use; however, what about a number of people in a crowd that you can just gather in? I'm sure Facebook and Google would be more than helpful because they have such massive facial recognition databases on us.

As a Canadian regulator, do you believe that we need to hit a pause button on facial recognition technology? How do we put the rules in place to protect citizens' rights with clear safeguards for police use and for commercial use prior to abuses?

[Daniel Therrien]

I think in terms of moratoria or outright prohibitions, I would distinguish between the use of a technology—the technology of facial recognition—and the uses to which the technology is put. I find it more likely that a ban or a moratorium would make sense for specific uses of a technology than for the technology per se, because for facial recognition there might be useful public purposes including in a law enforcement domain where, despite the privacy restrictions of facial recognition, the overall public good is in favour of using the technology. I would look at it in terms, again, of specific uses for technology. In that regard, yes, it would make sense to prohibit certain uses.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Angus.

Last, Mr. Collins, go ahead.

[Damian Collins]

Thank you very much.

Ellen Weintraub, given what we've talked about this afternoon, dark money in politics and how difficult it is to have any kind of proper oversight of what happens on platforms like Facebook, are you frightened by the news reporting that Facebook is going to launch its own cryptocurrency?

[Ellen Weintraub]

Yes.

[Damian Collins]

You are. You're frightened by the prospect.

I think you're right to be frightened by the prospect. Given all the other problems we've talked about, this seems like a sort of political money launderer's charter.

Do you not think people will look back on this period of time and say we had sophisticated democracies and societies that have developed decades of rules and regulations on campaign finance, electoral law, personal rights about data and privacy, oversight of broadcast media and news and other forms of news as well, and that we were prepared to see all those decades of experience bypassed by a company like Facebook, simply because that's the way their business model works, and it's unsustainable, the position that we're in at the moment?

[Ellen Weintraub]

Whether it's unsustainable, whether it requires further regulation, I think is exactly why all of you are sitting around this table today.

[Damian Collins]

But in some ways, listening to the discussion in this last session, we're tying ourselves in knots trying to solve a problem that's being caused by a company. Actually it may well be that the solution is, rather than having to abandon lots of things that we value because they've been put there to protect citizens and citizens' rights, we actually should say to these companies, “This is what we expect of you, and we will force this upon you if we can't be convinced there's any other way of doing it”, and we're not prepared to tolerate people being exposed to dark hats, elections being interfered with by bad actors, disinformation, hate speech spreading uncontrolled, and actually, these are not the standards we expect in a decent society. We say that recognizing that platforms like Facebook have become the main media channel in terms of how people get news and information, anywhere between a third and a half of Europeans and Americans.

[Ellen Weintraub]

I think there is a real risk trying to take a set of rules that evolved in the 20th century and assuming that they're going to be equally appropriate for the technologies of the 21st century.

[Damian Collins]

The final comment from me is that I think that's right. Those rules have been demonstrated to be out of date because of new technology and the way people engage with content in the world. Surely, what should remain is the values that brought in those rules in the first place. Saying that those rules need to change because technology's changed is one thing. What we shouldn't say is that we should abandon those values simply because they've become harder to enforce.

[Ellen Weintraub]

I absolutely agree with that.

[The Chair, Conservative, Bob Zimmer]

Mr. Therrien.

[Daniel Therrien]

I totally agree.

[The Chair, Conservative, Bob Zimmer]

I would like to finish up with one thing. We've been talking about the subpoena to Mark Zuckerberg and Sheryl Sandberg for some time and, as chair of this committee, I will say we did our very best to make sure they attended today. We're limited by what's in this book and the laws of our country, and yet the platforms seem to operate in their own bubbles without any restriction within our jurisdictions, and that's the frustration for us as legislators in this place.

Again, thank you for appearing today and thank you for assisting us, especially Commissioner Therrien, for your work in assisting this committee. We look forward to keeping those conversations going in the future.

I have some housekeeping aspects of what's going to happen tonight. Dinner is going to be at 7 p.m., downstairs in room 035. This is room 225, so two floors down will be where dinner is. It's at 7 p.m.

Just to be clear, each delegation is to give a brief presentation on what your country has done and is looking at doing to fix this problem. I'll be talking with my vice-chairs about how we're going to deliver what we are doing in Canada, but I challenge you to have that ready. Again, it's going to be brief. It can be informal. It doesn't need to be a big written presentation. I see some very serious looks on faces wondering, “What did we just get ourselves into?”

More important, I see a lot of tired faces. I think we're all ready just to go back to the hotel for about an hour's rest and then we'll reconvene at 7 p.m. I think that's all I have to say for now, but again we'll see you back at 7 p.m.

[Charlie Angus, NDP, Timmins—James Bay, ON]

I have a point of order, Mr. Chair, before you try to shut us all down.

I do want to commend the excellent work of the staff, our analysts who have put this together, and Mr. Collins for what was done in England. This goes above and beyond. I think we have really set a standard. I'm hoping that in the next Parliament, and maybe in other jurisdictions, we can maintain this conversation. You've done incredible work on this. We really commend you for it.

[Applause]

[The Chair, Conservative, Bob Zimmer]

Thank you for that. For the record, we will be holding the other platforms to account tomorrow morning at 8:30.

We'll see you tonight at seven o'clock.