Evidence of meeting #155 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was apple.

A video is available from Parliament.

On the agenda

MPs speaking

Also speaking

Mark Ryland  Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com
Marlene Floyd  National Director, Corporate Affairs, Microsoft Canada Inc.
John Weigelt  National Technology Officer, Microsoft Canada Inc.
Alan Davidson  Vice-President, Global Policy, Trust and Security, Mozilla Corporation
Erik Neuenschwander  Manager of User Privacy, Apple Inc.
Sun Xueling  Senior Parliamentary Secretary, Ministry of Home Affairs and Ministry of National Development, Parliament of Singapore
Hildegarde Naughton  Chair, Joint Committee on Communications, Climate Action and Environment, Houses of the Oireachtas
James Lawless  Member, Joint Committee on Communications, Climate Action and Environment, Houses of the Oireachtas
Damian Collins  Chair, Digital, Culture, Media and Sport Committee, United Kingdom House of Commons
Ian Lucas  Member, Digital, Culture, Media and Sport Committee, United Kingdom House of Commons
Jo Stevens  Member, Digital, Culture, Media and Sport Committee, United Kingdom House of Commons

11:20 a.m.

Vice-President, Global Policy, Trust and Security, Mozilla Corporation

Alan Davidson

I would just say that I work at a company that in some ways has its roots in a reaction to a dominant player in the market, which at the time was Internet Explorer. I think we do believe that antitrust law provides some really important guardrails in the market. We want what everybody wants, which is a level playing field of competition.

We think there are a lot of concerns out there about size. With size comes responsibility. We also think that there are a lot of very powerful tools in the hands of antitrust regulators today. We probably need to think about how to give them more information, more tools and a better understanding of things such as APIs and the power of data in their analysis. That's really where the upgrade needs to happen first, even as we think about how to expand the roles. This is a very important area.

11:25 a.m.

Conservative

Peter Kent Conservative Thornhill, ON

To contemporize digitally...?

11:25 a.m.

Vice-President, Global Policy, Trust and Security, Mozilla Corporation

Alan Davidson

A contemporized digital antitrust enforcer is what we need out there.

11:25 a.m.

Conservative

Peter Kent Conservative Thornhill, ON

Thank you.

11:25 a.m.

Conservative

The Chair Conservative Bob Zimmer

Thank you, Mr. Kent.

Last in the line of questions is David. Go ahead, Mr. Graham.

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

Thank you.

I got everybody else earlier, so I want to go to Mr. Ryland from Amazon for a bit.

Earlier you were talking to Mr. Lucas about whether Alexa has ever been compromised. As I recall, you said that it has not. Is that correct?

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

That's right.

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

Are you not familiar with the Checkmarx hack of only a year ago that did a complete compromise of Alexa and could cause Alexa to stream live audio in an unlimited amount?

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

I wasn't familiar with that particular.... I'll get back to you on that.

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

Are you not the director of security engineering?

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

What's that?

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

Are you not the director of security engineering?

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

I am, at Amazon Web Services, yes.

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

You're at Amazon Web Services; so we weren't sent someone from Amazon proper. I just wanted to get that clear.

Amazon has an integrated marketing system. If I go and search for something on Amazon, and then I go onto another computer on another website, I will have ads pop up for me from Amazon saying, “Hey, do you want to buy this thing that you searched for on a different device on a different day at a different time with a different IP address?” How does Amazon know that? What kind of data exchange happens between Amazon and other sites like Facebook and other websites all across...? For example, National Newswatch does that to me.

What is the information exchange there? How do you know who I am on another device?

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

We do participate in ad exchanges. We have a whole privacy site on our website that allows you to opt out of advertising. Again, that's not personal data. That's anonymized data. It's based on demographic profiling.

Again, it's straightforward to opt out of that on our website, or you can use some of the industry's tools, such as AdChoices, to opt out from participating in ad networks.

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

It's anonymized data, but it knows exactly that one thing that I looked for three hours ago.

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

I can't speak to the very specific experience you had, but we're not using your personal data for that type of use case.

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

Okay.

At the very beginning of the meeting, you had some interesting perspectives on consent for the use of data. It caused a very good intervention from Mr. Angus. In Amazon's opinion or in your opinion, what is the limit of consent for the sharing of data? Is it explicit? If something is advertised on the box as a “smart” device, is that enough for consent to share data?

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

We think context awareness makes sense. The reasonable consumer consuming a certain experience will have some idea of what is involved. If that is not there, then we want that to be more explicit. It's very contextual.

It also depends, obviously, on the type of data. Some data is much more sensitive than other data. As one of the other panellists mentioned, using an online gaming platform is different from using a health care site, so it's being context aware and content aware. Context-based consent makes a lot of sense.

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

Okay.

You mentioned earlier that you're a customer-oriented company. Are you also a worker-oriented company?

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

Yes. We very much try to be very worker-oriented.

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

Do you not get engaged in anti-union practices?

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

Again, it's not my area of expertise, but I would say that we treat our workers with respect and dignity. We try to pay a solid wage and give them reasonable working conditions.

11:25 a.m.

Liberal

David Graham Liberal Laurentides—Labelle, QC

Do you engage in any data collection from your own employees?

11:25 a.m.

Director, Security Engineering, Office of the Chief Information Security Officer for Amazon Web Services, Amazon.com

Mark Ryland

Like all companies, we collect data around things like web access and an appropriate use of our technology to protect other workers in the workforce.