Information & Ethics Committee on Oct. 20th, 2016

[Vincent Gogolek]

We would agree with the commissioner in terms of five years.

In B.C., we have a six-year term. I believe that this committee recommended a five-year review for the Access to Information Act, and I think one should be reviewed the way you have been doing it this year. They should be looked at on the same time frame.

[The Chair, Conservative, Blaine Calkins]

We now move to Mr. Blaikie for up to seven minutes.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you.

I want to return to the question of order-making power.

Mr. Karanicolas, I think you made a distinction between—and I don't want to be putting words in your mouth—the appropriateness of order-making power for the public sector and the appropriateness of order-making power for the private sector.

I wonder if you could speak a little more to that and answer the question of whether it would be possible, and furthermore advisable to.... I mean, if there are issues with order-making power with respect to the Privacy Commissioner's obligations under PIPEDA, could you have order-making power under the Privacy Act for the public sector and a different model for the private sector? Does that make sense? Can you kind of flesh out some of the details?

[Michael Karanicolas]

I'll reiterate that we're not opposed to order-making power. We're on the fence about it, and to me it seems like an issue of efficacy more than anything else. I'm inclined to defer it to the Privacy Commissioner, if they think it will help them to do the job better.

I don't think the argument that if one commissioner has it, therefore the other commissioner has it holds a lot of water with me. It's more that you look at the commissioner's specific mandate, you look at their success in implementing their recommendations, and you look at the tool kit they have available to them and the needs they have. You design particular powers around that. These commissioners are structurally similar in a lot of ways, but have very different mandates, so I do think they require different considerations. That was the way I was trying to frame it.

With the divide between public sector and private sector, there are enhanced procedural considerations if you want to talk about an organization that is levying fines, and potentially large fines. There have been a lot of pushback complaints from the private sector about the anti-spam mechanism, about CASL, and the way fines have been levied there. I think people in the private sector are a bit concerned about that.

I have heard from private sector people on the argument I made about private sector interests being less likely to co-operate with an agency that has order-making powers. You hear that from people in the private sector. You have to take it with a grain of salt because, of course, they don't want to be overseen by an organization that has power to fine them. They would prefer an organization that doesn't have those powers to be overseeing them. There's an obvious interest there, but I also don't think it can be entirely discounted. I would defer to the Privacy Commissioner if the question is framed specifically on efficacy.

When you're limiting the order-making powers so that they only apply to government, I think if you did it in that way, then it would certainly limit some of the concerns, and that would make the argument for parity a little bit better. If you look at the Privacy Commissioner's role specifically with regard to interacting with public bodies, you see it is quite similar to the Information Commissioner's role.

However, the Privacy Commissioner also needs to have the tools available to properly protect Canadians' privacy, particularly in the private sector, particularly when you look at the failures of the consent-based model, which I went into a little bit before. I do think there need to be stronger rules in place. Whether that's done through orders from the Privacy Commissioner, whether it's done through legislation or regulations, or whether it's done through recommendations, I'm not sure, but I do think there needs to be greater clarity.

[Vincent Gogolek]

I have a brief point about the private sector, but it relates to all of it.

In the private sector, of course, we have two different sets of regimes. We have PIPEDA, which is the federal regime, and then we have substantially similar regimes in a number of other provinces, including British Columbia, which we're familiar with. You have the unusual situation of the commissioner making recommendations under PIPEDA, while in British Columbia, our commissioner issues orders.

We were involved in a case in which an insurance company had been ordered to get explicit consent from their customers for use of their credit information to determine the level of their premiums, so we had an actual order. Eventually another complaint was brought under PIPEDA from Ontario, a PIPEDA-level resolution was reached, and the organization ended up doing this at a national level.

It could create an interesting situation. You could have one substantially similar jurisdiction where there's an order in place and an organization or a company is required to do something, but not in the PIPEDA jurisdiction.

This is another reason we are in favour of order-making power for the Privacy Commissioner, both public and private.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Do I have a bit more time?

[The Chair, Conservative, Blaine Calkins]

You have one minute left.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

In terms of providing a public education and research mandate for the office, I didn't hear disagreement with that recommendation in either of your presentations.

I'm wondering if you have a sense of what exactly you take that to mean and what you think would be a reasonable implementation of that mandate, so that we can try to get a sense of the resources involved for something like that.

[Michael Karanicolas]

This also parallels a recommendation that we made for the Information Commissioner.

To me, it's about a gap in understanding among Canadians about what privacy is and about the changes that have occurred as a result of digitization, which have dramatically changed people's relationship with personal information. It's about giving the Privacy Commissioner a stronger role in promoting privacy. They do that in the private sector. I think that because there are greater concerns among the public sector, it's important to extend it to that sector.

In terms of specifically how that would work, I imagine it would be parallel to the way it currently works in private sector promotions. They could be sponsoring research, sponsoring conferences, in order to promote engagement by public agencies—or via academics or NGOs—with the public in terms of getting them to understand their privacy rights.

It's generally a parallel, I think, to the way it works currently.

[The Chair, Conservative, Blaine Calkins]

I have to cut it off right here, right now, but keep the thought. We'll have an opportunity.

Mr. Massé, I believe the floor is yours.

You have seven minutes.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

I'd like to pick up on your discussion with Mr. Jeneroux and talk about the evolution of technology and the measures needed to make sure the legislation keeps up with new technologies. Obviously, it's a very likely scenario.

Mr. Gogolek, you piqued my curiosity earlier when you were talking about data mining. It's increasingly being used to make much more specialized decisions a lot more quickly. You said there was a genuine concern when it came to data mining. It's possible to take a black box, fill it with a bunch of data, and have it make more specific decisions.

How would you recommend we take that reality account, to make sure the legislation sets out a better framework and to give individuals access to what's inside that black box? I'd like you to elaborate on that.

[Vincent Gogolek]

That's a very technical question. As far as the technology inside the black box goes, governments or companies sometimes argue that the information is proprietary and therefore confidential, that it would reveal business practices. According to them, competitors could benefit from disclosure of the information.

It essentially comes down to replacing or supporting decisions made by humans with recommendations that are practically decisions in and of themselves. In a number of cases, in fact, it would be very tough for an individual to challenge what the computer has deemed a good decision. In order to challenge what comes out of the black box, a person has to be very confident in themselves and their expertise. That's key.

When people make decisions, they normally have reasons for making them. The data they used to arrive at their decision are known. It's important to keep that option open It's not a good idea to create a situation where it isn't possible to reconsider what the decision-maker did. If the decision came out of the black box, it's important to know that.

That doesn't necessarily mean knowing exactly how the circuits are connected, technology-wise. Rather, it means knowing which data were part of the data mix. It's actually a matter of knowing, overall, how the data were organized to arrive at decision x or y.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

Absolutely.

There's something I find a bit troubling with this. But it's not a concern I have vis-à-vis the federal government, since it's always a bit behind the private sector when it comes to technology or technology development, in my view.

Mr. Karanicolas said that the consent model was so broad and vague that just about any information could be collected without the user even knowing it. The private sector bases its collection of data on consent that is provided initially.

Given that vast quantities of information can be collected, with consent, and fed into a black box, how can we protect Canadians in the future, through the amendments to the act?

[Vincent Gogolek]

The commissioner made two recommendations, one being the introduction of a necessity test, which isn't in the current legislation. It is, however, in our public sector act here, in British Columbia. It's very important because it raises the requirement level. The data collection has to be necessary. Information can't be collected simply because it would be beneficial to have. That isn't permitted; the information has to serve a purpose. That is why, then, the recommendation is important.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you. That's much appreciated.

Mr. Chair, I'm going to give the rest of my time to Mr. Long, who also has some questions.

[The Chair, Conservative, Blaine Calkins]

You have a minute and a half, Mr. Long.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Mr. Karanicolas, I want to talk to you about some of your tweets on Twitter. I want to talk about Hadas Gold.

Hadas Gold is the journalist who has come under some public scrutiny, I guess, and I think some very bad things are happening to her. You made some comments saying that you don't believe it's Twitter's responsibility to police that. Can you elaborate on that situation? Obviously there has been a threat made against her. What do you think the solution is to that? What regulations would you put in to control something like that?

[Michael Karanicolas]

That's going to be very tough to do in one minute.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

It is. I know. I'm sorry.

[Michael Karanicolas]

What I will say is that situations like this need to be taken more seriously by the police, and the reason I phrased it the way I did is that I think that when threats are made against journalists, it is a threat to democracy, and I think that these need to be taken more seriously.

In terms of Twitter's specific role in it, I think companies need to be given the freedom to manage the platforms the way they want to. If a company wants to say that they're a family-friendly platform and they're going to moderate very heavily, I think that's a fair point. If a company wants to say that people can say whatever they want and the only time they're going to take material down is if it's specifically illegal and they are ordered to do so by the state, I think that's also a fair position for them to take.

As long as there's a multiplicity of different platforms available and people can choose how and where they want to engage, I think that's a fair point in terms of the specific regulations.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

You would agree that right now that it's a free-for-all.

[Michael Karanicolas]

It depends on the platform. Twitter has traditionally taken a much lighter hand, and now they're engaging more heavily because of the pressure they've come under. Facebook has always engaged more heavily, but again, they're coming under pressure. They recently have faced some criticism for deactivating certain Palestinian sites under pressure from the Israeli government. Facebook has faced criticism for deactivating Kurdish websites under pressure from the Turkish government.

It's a very challenging political situation once you expect these intermediaries to be the arbiters of acceptable content. It can also be problematic because in some cases you don't really have a proper appeal mechanism. If the government orders you to make a particular decision—if it says, “This content is illegal, so don't publish it”—you can appeal it. There are all these procedures in place. However, if Facebook is the one that's telling you what is or is not acceptable, there aren't the same kinds of procedural protections there.

This is why I'm leery of governments off-loading that responsibility. Specifically, you see cases—I'll point to South Korea as one—of the government doing this as basically a way to impose censorship indirectly, cases of the government leaning very heavily on tech companies to do the content moderation for them. There are very abusive content controls as a result.

[The Chair, Conservative, Blaine Calkins]

Sorry, Mr. Long, but—

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Maybe we'll continue that discussion next time.

[The Chair, Conservative, Blaine Calkins]

Yes. I don't mind going a bit over the time when we're talking about stuff relating to the Privacy Act, but when we're going over time talking about things related to PIPEDA, it makes me excited about the upcoming study on PIPEDA, notwithstanding the fact that the dialogue is actually very informative. Let's try to keep it on the Privacy Act if we can, please.

Mr. Kelly, you have up to five minutes. We'll start the five-minute round right now.