Information & Ethics Committee on May 28th, 2019

[The Chair, Conservative, Bob Zimmer]

We'll call to order the Standing Committee on Access to Information, Privacy and Ethics for meeting 154, an by extension, the international grand committee on big data, privacy and democracy.

I don't need to go through the list of countries that we have already mentioned, but I will go through our witnesses very briefly.

From the Office of the Privacy Commissioner of Canada, we have Mr. Daniel Therrien, the Privacy Commissioner of Canada.

As an individual, we have Joseph A. Cannataci, special rapporteur on the right to privacy for the United Nations.

We are having some challenges with the live video feed from Malta. We'll keep working through that. I'm told by the clerk that we may have to go to an audio feed to get the conversation. We will do what we have to do.

Also we'd like to welcome the chair of the United States Federal Election Commission, Ellen Weintraub.

First of all, I would like to speak to the meeting's order and structure. It will be very similar to that of our first meeting this morning. We'll have one question per delegation. The Canadian group will have one from each party, and we'll go through until we run out of time with different representatives to speak to the issue.

I hope that makes sense. It will make sense more as we go along.

I would like to thank the members who came to our question period today. I personally thank the Speaker for recognizing the delegation.

I'll give Mr. Collins the opportunity for to open it up.

Mr. Collins.

[Damian Collins, Chair, Digital, Culture, Media and Sport Committee, United Kingdom House of Commons]

Thank you.

Let me put my first question to all three of the witnesses.

[The Chair, Conservative, Bob Zimmer]

Shall we have statements first?

[Damian Collins]

Okay.

[The Chair, Conservative, Bob Zimmer]

We'll have opening statements. We'll start with Mr. Therrien.

Go ahead for 10 minutes.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

Members of the grand committee, thank you for the invitation to address you today.

My remarks will address three points that I think go to the heart of your study: first, that freedom and democracy cannot exist without privacy and the protection of our personal information; second, that in meeting the risks posed by digital harms, such as disinformation campaigns, we need to strengthen our laws in order to better protect rights; lastly, I will share suggestions on what needs to be done in Canada, as I'm an expert in Canadian privacy regulation, so that we have 21st century laws in place to ensure that the privacy rights of Canadians are protected effectively.

I trust that these suggestions made in a Canadian context can also be relevant in an international context.

As you know, my U.K. counterpart, the Information Commissioner's Office, in its report on privacy and the political process, clearly found that lax privacy compliance and micro-targeting by political parties had exposed gaps in the regulatory landscape. These gaps in turn have been exploited to target voters via social media and to spread disinformation.

The Cambridge Analytica scandal highlighted the unexpected uses to which personal information can be put and, as my office concluded in our Facebook investigation, uncovered a privacy framework that was actually an empty shell. It reminded citizens that privacy is a fundamental right and a necessary precondition for the exercise of other fundamental rights, including democracy. In fact, privacy is nothing less than a prerequisite for freedom: the freedom to live and develop independently as individuals, away from the watchful eye of surveillance by the state or commercial enterprises, while participating voluntarily and actively in the regular, day-to-day activities of a modern society.

As members of this committee are gravely aware, the incidents and breaches that have now become all too common go well beyond matters of privacy as serious as I believe those to be. Beyond questions of privacy and data protection, democratic institutions' and citizens' very faith in our electoral process is now under a cloud of distrust and suspicion. The same digital tools like social networks, which public agencies like electoral regulators thought could be leveraged to effectively engage a new generation of citizens, are also being used to subvert, not strengthen, our democracies.

The interplay between data protection, micro-targeting and disinformation represents a real threat to our laws and institutions. Some parts of the world have started to mount a response to these risks with various forms of proposed regulation. I will note a few.

First, the recent U.K. white paper on digital harms proposes the creation of a digital regulatory body and offers a range of potential interventions with commercial organizations to regulate a whole spectrum of problems. The proposed model for the U.K. is to add a regulator agency for digital platforms that will help them develop specific codes of conduct to deal with child exploitation, hate propaganda, foreign election interference and other pernicious online harms.

Second, earlier this month, the Christchurch call to eliminate terrorist and violent extremist content online highlighted the need for effective enforcement, the application of ethical standards and appropriate co-operation.

Finally, just last week here in Canada, the government released a new proposal for an update to our federal commercial data protection law as well as an overarching digital charter meant to help protect privacy, counter misuse of data and help ensure companies are communicating clearly with users.

Underlying all these approaches is the need to adapt our laws to the new realities of our digitally interconnected world. There is a growing realization that the age of self-regulation has come to an end. The solution is not to get people to turn off their computers or to stop using social media, search engines, or other digital services. Many of these services meet real needs. Rather, the ultimate goal is to allow individuals to benefit from digital services—to socialize, learn and generally develop as persons—while remaining safe and confident that their privacy rights will be respected.

There are certain fundamental principles that I believe can guide government efforts to re-establish citizens' trust. Putting citizens and their rights at the centre of these discussions is vitally important, in my view, and legislators' work should focus on rights-based solutions.

In Canada, the starting point, in my view, should be to give the law a rights-based foundation worthy of privacy's quasi-constitutional status in this country. This rights-based foundation is applicable in many countries where their law frames certain privacy rights explicitly as such, as rights, with practices and processes that support and enforce this important right.

I think Canada should continue to have a law that is technologically neutral and principles based. Having a law that is based on internationally recognized principles, such as those of the OECD, is important for the interoperability of the legislation. Adopting an international treaty for privacy and data protection would be an excellent idea, but in the meantime, countries should aim to develop interoperable laws.

We also need a rights-based statute, meaning a law that confers enforceable rights to individuals while also allowing for responsible innovation. Such a law would define privacy in its broadest and truest sense, such as freedom from unjustified surveillance, recognizing its value in correlation to other fundamental rights.

Privacy is not limited to consent, access and transparency. These are important mechanisms, but they do not define the right itself. Codifying the right, in its broadest sense, along the principles-based and technologically neutral nature of the current Canadian law would ensure it can endure over time, despite the certainty of technological developments.

One final point I wish to make has to do with independent oversight. Privacy cannot be protected without independent regulators and the power to impose fines and to verify compliance proactively to ensure organizations are truly accountable for the protection of information.

This last notion, demonstrable accountability, is a needed response to today's world, where business models are opaque and information flows are increasingly complex. Individuals are unlikely to file a complaint when they are unaware of a practice that may harm them. This is why it is so important for the regulator to have the authority to proactively inspect the practices of organizations. Where consent is not practical or effective, which is a point made by many organizations in this day and age, and organizations are expected to fill the protective void through accountability, these organizations must be required to demonstrate true accountability upon request.

What I have presented today as solutions are not new concepts, but as this committee takes a global approach to the problem of disinformation, it's also an opportunity for domestic actors—regulators, government officials and elected representatives—to recognize what best practices and solutions are emerging and to take action to protect our citizens, our rights, and our institutions.

Thank you. I look forward to your questions.

[The Chair, Conservative, Bob Zimmer]

Thank you once again, Mr. Therrien.

We're going to double-check whether Mr. Cannataci is able to stream. No.

We'll go next to Ms. Weintraub for 10 minutes.

[Ellen Weintraub, Chair, United States Federal Election Commission]

Thank you.

[The Chair, Conservative, Bob Zimmer]

I'm sorry, Ms. Weintraub.

We just heard the comments. He's available to speak.

My apologies, Ms. Weintraub. I guess we have him on, so we'll go ahead.

Mr. Cannataci, go ahead for 10 minutes.

[Professor Joseph A. Cannataci, Special Rapporteur on the Right to Privacy, United Nations, As an Individual]

Thank you very much, Mr. Chair, and members of the grand committee, for the invitation to speak.

I will try to build on what Mr. Therrien has said in order to cover a few more points. I will also make some references to what other witnesses presented previously.

First, I will be trying to take a more international view, though the themes that are covered by the committee are very global in nature. That's why when it comes to global...the previous witness spoke about an international treaty. One of the reasons, as I will be explaining, that I have decided in my mandate at the United Nations to go through a number of priorities when it comes to privacy is that the general framework of privacy and data protection in law insofar as an international treaty is concerned, who regulates this, doesn't happen to be specifically a UN treaty. It happens to be convention 108 or convention 108+, which is already ratified by 55 nations across the world. Morocco was the latest one to present its document of ratification yesterday.

When people meet in Strasbourg or elsewhere to discuss the actions and interoperability within an international framework, there are already 70 countries, ratified states and observer states, that will discuss the framework afforded by that international legal instrument. I would indeed encourage Canada to consider adhering to this instrument. While I am not an expert on Canadian law, I have been following it since 1982. I think Canadian law is pretty close in most cases. I think it would be a welcome addition to that growing group of nations.

As for the second point that I wish to make, I'll be very brief on this, but I also share preoccupations about the facts on democracy and the fact that the Internet is being increasingly used in order to manipulate people's opinions through monitoring their profiles in a number of ways. The Cambridge Analytica case, of course, is the classic case we have for our consideration, but there are other cases too in a number of other countries around the world.

I should also explain that the six or seven priorities that I have set for my United Nations mandate to a certain extent summarize maybe not all, but many of the major problems that we are facing in the privacy and data protection field. The first priority should not surprise you, ladies and gentlemen, because it relates to the very reasons that my mandate was born, which is security and surveillance.

You would recall that my United Nations mandate was born in the aftermath of the Snowden revelations. It won't surprise you, therefore, that we have dedicated a great deal of attention internationally to security and surveillance. I am very pleased that Canada participates very actively in one of the fora, which is the International Intelligence Oversight Forum because, as the previous witness has just stated, oversight is a key element that should be addressed. I was also pleased to see some significant progress in the Canadian sphere over the past 12 to 24 months.

There is a lot to be said about surveillance, but I don't have much left of my 10 minutes so I can perhaps respond to questions. What I will restrict myself to saying at this stage is that globally we see the same problems. In other words, we don't have a proper solution for jurisdiction. Issues of jurisdiction and definitions of offences remain some of the greatest problems we have, notwithstanding the existence of the Convention on Cybercrime. Security, surveillance and basically the growth of state-sponsored behaviour in cyberspace are still a glaring problem.

Some nations are not very comfortable talking about their espionage activities in cyberspace, and some treat it as their own backyard, but in reality, there is evidence that the privacy of hundreds of millions of people, not in just one country but around the world, has been subjected to intrusion by the state-sponsored services of one actor or another, including most of the permanent powers of the United Nations.

The problem remains one of jurisdiction and defining limits. We have prepared a draft legal instrument on security and surveillance in cyberspace, but the political mood across the world doesn't seem conducive to major discussions on those points. The result is that we have seen some unilateral action, for example, by the United States with its Cloud Act, which has not seen much take-up at this moment in time. However, regardless of whether unilateral action would work, I encourage discussion even on the principles of the Cloud Act. Even if it doesn't lead to immediate agreements, the very discussion will at least get people to focus on the problems that exist at that stage.

I will quickly pass to big data and open data. In the interests of the economy of time, I refer the committee to the report on big data and open data that I presented to the United Nations General Assembly in October 2018. Quite frankly, I would advise the committee to be very wary of joining the two in such a way that open data continues to be a bit like a mother with an apple pie when it comes to politicians proclaiming all the good it's going to do for the world. The truth is that in the principles of big data and open data, we are looking at key fundamental issues when it comes to privacy and data protection.

In Canadian law, as in the law of other countries, including the laws of all those countries that adhere to convention 108, the purpose specification principle that data should be collected and used only for a specified or compatible purpose lives on as a fundamental principle. It also lives on as a principle in the recent GDPR in Europe. However, we have to remember that in many cases, when one is using big data analytics, one is seeking to repurpose that data for a different purpose. Once again, I refer the committee to my report and the detailed recommendations there.

At this moment in time, I have out for consultation a document on health data. We are expecting to debate this document, together with recommendations, at a special meeting in France on June 11 and 12. I trust there will be a healthy Canadian presence at that meeting too. We've received many positive comments about the report. We're trying to build an existing consensus on health data, but I'd like to direct the committee's attention to how important health data is. Growing amounts of health data are being collected each and every day with the use of smart phones and Fitbits and other wearables, which are being used in a way that really wasn't thought about 15 or 20 years ago.

Another consultation paper I have out, which I would direct the committee's attention to, is on gender and privacy. I'm hoping to organize a public consultation. It has already started as an online consultation, but I am hoping to have a public meeting, probably in New York, on October 30 and 31. Gender and privacy continues to be a very important yet controversial topic, and it is one in which I would welcome continued Canadian contribution and participation.

I think you would not be surprised if I were to say that among the five task forces I established, there is a task force on the use of personal data by corporations. I make it a point to meet with the major corporations, including Google, Facebook, Apple, Yahoo, but also some of the non-U.S. ones, including Deutsche Telekom, Huawei, etc., at least twice a year all together around a table in an effort to get their collaboration to find new safeguards and remedies for privacy, especially in cyberspace.

This brings me to the final point I'll mention for now. It's linked to the previous one on corporations and the use of personal data by corporations. It's the priority for privacy action.

I have been increasingly concerned about privacy issues, especially those affecting children as online citizens from a very early age. As the previous witness has borne witness, we are looking at some leading new and innovative legislation, such as that in the United Kingdom, not only the one on digital harms, but also one about age-appropriate behaviour and the liability of corporations. I am broaching these subjects formally next with the corporations at our September 2019 meeting. I look forward to being able to achieve some progress on the subject of privacy and children and on greater accountability and action from the corporations in a set of recommendations that we shall be devising during the next 12 to 18 months.

I'll stop here for now, Mr. Chair. I look forward to questions.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Cannataci.

We'll go now to Ms. Weintraub.

I just want to explain what the flashing lights are. In the Canadian Parliament the flashing lights signal that votes are to happen in about 30 minutes. We have an agreement among our parties that one member from each party will stay, and the rest are clear to go and vote. The meeting will continue with the rest of us. We won't stop. It isn't a fire alarm. We're good to go.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Being the only New Democrat, as The Clash would say, should I stay or should I go?

[Voices]

Oh, oh!

[The Chair, Conservative, Bob Zimmer]

You probably should stay.

It's been cleared that we have one member for—

[Charlie Angus, NDP, Timmins—James Bay, ON]

If I leave, you're not taking one of my seats.

[The Chair, Conservative, Bob Zimmer]

I just wanted to make it clear that's what's going on.

We'll go to Ms. Weintraub now for 10 minutes.

[Ellen Weintraub]

Thank you, Mr. Chair and members of the committee.

I am the chair of the Federal Election Commission in the United States. I represent a bipartisan body, but the views that I'm going to express are entirely my own.

I'm going to shift the topic from privacy concerns to influence campaigns.

In March of this year, special counsel Robert S. Mueller III completed his report on the investigation into Russian interference in the 2016 presidential election. Its conclusions were chilling. The Russian government interfered in the 2016 presidential election in sweeping and systemic fashion. First, a Russian entity carried out a social media campaign that favoured one presidential candidate and disparaged the other. Second, a Russian intelligence service conducted computer intrusion operations against campaign entities, employees and volunteers, and then released stolen documents.

On April 26, 2019, at the Council on Foreign Relations, FBI director Christopher A. Wray warned of the aggressive, unabated, malign foreign influence campaign consisting of “the use of social media, fake news, propaganda, false personas, etc., to spin us up, pit us against each other, sow divisiveness and discord, and undermine Americans' faith in democracy. That is not just an election cycle threat; it's pretty much a 365-days-a-year threat. And that has absolutely continued.”

While he noted that “enormous strides have been made since 2016 by all different federal agencies, state and local election officials, the social media companies, etc.,” to protect the physical infrastructure of our elections, he said, “I think we recognize that our adversaries are going to keep adapting and upping their game. And so we're very much viewing 2018 as just kind of a dress rehearsal for the big show in 2020.”

Last week, at the House of Representatives, a representative of the Department of Homeland Security also emphasized that Russia and other foreign countries, including China and Iran, conducted influence activities in the 2018 mid-terms and messaging campaigns that targeted the United States to promote their strategic interests.

As you probably know, election administration in the United States is decentralized. It's handled at the state and local levels, so other officials in the United States are charged with protecting the physical infrastructure of our elections, the brick-and-mortar electoral apparatus run by state and local governments, and it is vital that they continue to do so.

However, from my seat on the Federal Election Commission, I work every day with another type of election infrastructure, the foundation of our democracy, the faith that citizens have that they know who's influencing our elections. That faith has been under malicious attack from our foreign foes through disinformation campaigns. That faith has been under assault by the corrupting influence of dark money that may be masking illegal foreign sources. That faith has been besieged by online political advertising from unknown sources. That faith has been damaged through cyber-attacks against political campaigns ill-equipped to defend themselves on their own.

That faith must be restored, but it cannot be restored by Silicon Valley. Rebuilding this part of our elections infrastructure is not something we can leave in the hands of the tech companies, the companies that built the platforms now being abused by our foreign rivals to attack our democracies.

In 2016, fake accounts originating in Russia generated content that was seen by 126 million Americans on Facebook, and another 20 million Americans on Instagram, for a total of 146 million Americans; and there were only 137 million voters in that election.

As recently as 2016, Facebook was accepting payment in rubles for political ads about the United States elections.

As recently as last year, in October 2018, journalists posing as every member of the United States Senate tried to place ads in their names on Facebook. Facebook accepted them all.

Therefore, when the guys on the other panel keep telling us they've got this, we know they don't.

By the way, I also invited Mark Zuckerberg and Jack Dorsey, all those guys, to come and testify at a hearing at my commission when we were talking about Internet disclosure of advertising, and once again, they didn't show up. They didn't even send a surrogate that time; they just sent us written comments, so I feel for you guys.

This is plainly really important to all of us. In the United States, spending on digital political ads went up 260% from 2014 to 2018, from one mid-term election to the next, for a total of $900 million in digital advertising in the 2018 election. That was still less than was spent on broadcast advertising, but obviously digital is the wave of the future when it comes to political advertising.

There have been constructive suggestions and proposals in the United States to try to address this: the honest ads act, which would subject Internet ads to the same rules as broadcast ads; the Disclose Act, which would broaden the transparency and fight against dark money; and at my own agency I've been trying to advance a rule that would improve disclaimers on Internet advertising. All of those efforts so far have been stymied.

Now, we have been actually fortunate that the platforms have tried to do something. They have tried to step up, in part, I'm sure, to try to ward off regulation, but in part to respond to widespread dissatisfaction with the information and the disclosure they were providing. They have been improving, in the United States at least, the way they disclose who's behind their ads, but it's not enough. Questions keep coming up, such as about what triggers the requirement to post the disclaimer.

Can the disclaimers be relied upon to honestly identify the sources of the digital ads? Based on the study about the 100 senators ads, apparently they cannot, not all the time, anyway. Does the identifying information travel with the content when information is forwarded? How are the platforms dealing with the transmission of encrypted information? Peer-to-peer communication represents a burgeoning field for political activity, and it raises a whole new set of potential issues. Whatever measures are adopted today run the serious risk of targeting the problems of the last cycle, not the next one, and we know that our adversaries are constantly upping their game, as I said, and constantly improvising and changing their strategies.

I also have serious concerns about the risks of foreign money creeping into our election system, particularly through corporate sources. This is not a hypothetical concern. We recently closed an enforcement case that involved foreign nationals who managed to funnel $1.3 million into the coffers of a super PAC in the 2016 election. This is just one way that foreign nationals are making their presence and influence felt even at the highest levels of our political campaigns.

These kinds of cases are increasingly common, and these kinds of complaints are increasingly common in the United States. From September 2016 to April 2019, the number of matters before the commission that include alleged violations of the foreign national ban increased from 14 to 40, and there were 32 open matters as of April 1 of this year. This is again an ongoing concern when it comes to foreign influence.

As everything you've heard today demonstrates, serious thought has to be given to the impact of social media on our democracy. Facebook's originating philosophy of “move fast and break things”, cooked up 16 years ago in a college dorm room, has breathtaking consequences when the thing they're breaking could be our democracies themselves.

Facebook, Twitter, Google, these and other technology giants have revolutionized the way we access information and communicate with each other. Social media has the power to foster citizen activism, virally spread disinformation or hate speech and shape political discourse.

Government cannot avoid its responsibility to scrutinize this impact. That's why I so welcome the activities of this committee and appreciate very much everything you're doing, which has carryover effects in my country, even when we can't adopt our own regulations when you all adopt regulations in other countries. Sometimes the platforms maintain the same policies throughout the world, and that helps us. Thank you very much

Also, thank you very much for inviting me to participate in this event. I welcome your questions.

[The Chair, Conservative, Bob Zimmer]

Thank you, Ms. Weintraub.

First of all we'll go to Mr. Collins.

[Damian Collins]

Thank you. My first question is for Ellen Weintraub.

You mentioned dark money in your opening statement. How concerned are you about the ability of campaigns to use technology, particularly blockchain technology, to launder impermissible donations to campaigns by turning them into multiple, small micro-donations?

[Ellen Weintraub]

I'm very concerned about it, in part because our entire system of regulation is based on the assumption that large sums of money are what we need to worry about and that this is where we should focus our regulatory activity. On the Internet, however, sometimes very small amounts of money can be used to have vast impact, and that doesn't even get into the possibility of Bitcoin and other technologies being used to entirely mask where the money is coming from.

So yes, I have deep concerns.

[Damian Collins]

Have there been any particular examples that have come to the awareness of your commission?

[Ellen Weintraub]

The problem with dark money is that you never really know who is behind it. There has been about a billion dollars in dark money spent on our elections in the last 10 years, and I cannot tell you who is behind it. That's the nature of the darkness.

[Damian Collins]

I just wondered whether any particular allegations had been made, or whether there had been cause for any further investigation about what might be considered to be suspicious activity.

[Ellen Weintraub]

We have a constant stream of complaints about dark money. The case I just described to you is one of the foremost examples we've seen recently. It can be money that comes in through LLCs or 501(c)(4)s. In this case, it came in through the domestic subsidiary of a foreign corporation.

[Damian Collins]

Do you have any concerns about the way technologies like PayPal could be used as well to bring money in from sources trying to hide their identity or even from abroad?