Information & Ethics Committee on Oct. 20th, 2016

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thanks, Mr. Chair.

I as well was intrigued by Mr. Gogolek's discussion of the automated algorithmic decision-making.

My first thoughts when you raised this issue were not around the public sector but the private sector, where the type of decision-making I'm most familiar with from my own career before being elected was in terms of credit. Credit-rating agencies have used algorithmic decision-making...well, not decision-making, but they assign scores to establish probabilities for certain behaviours that are then used to make decisions.

Just so I know what we're talking about, can you give me an example in the public sector, in government departments, and tell me how similar the type of information is that you're concerned about. What departments use these tools, and what decisions are made this way?

[Vincent Gogolek]

As for where this would come in, a primary example would be—this is perhaps more provincial than federal—in terms of various types of social benefits or things like training programs.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Let's try the federal one, so that my chair doesn't nudge us back on track.

[Vincent Gogolek]

Employment training is one of these jurisdictional areas where there are federal and provincial programs. Obviously, government wants these programs to work well. They want the public funds that are allocated to them to be used efficiently and to get the right people the right training so they can be productive employees and productive citizens. An algorithm is developed such that it can take all kinds of different information about a person and say how likely they are to actually succeed if provided this training.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

What you've described sounds more like.... You've mentioned the issue about a human making a decision versus a black box doing it, or about having the courage to second-guess the answer the computer provides, but is that a privacy concern or is that a decision-making methodology concern?

I look back at the situation I'm more familiar with. The fact that a computer assigns a credit score is not where the privacy concern exists. It exists in this: did the person consent to disclosing the information? If they consented to disclosing the information, then decision-makers are free to either sort it out themselves or to plug it into a computer. That's not where the privacy issue comes about. It comes about through either a data leak, which is a separate issue....

Explain the privacy component to your concern around electronic decision-making.

[Vincent Gogolek]

The privacy aspect relates to the collection of personal information, the data mining, whereby information is taken from various sources, some of which may be publicly available and some of which individuals or perhaps all Canadians are required to provide to government. Generally, it's provided for a purpose. We provide our income and things to ensure compliance with the tax regime or for other reasons. We provide our information to government, and this is where the requirement for a necessity test comes in.

This is probably also where the commissioner's recommendation about information sharing agreements comes in, because there would have to be some of this if information is being drawn from across government in order to determine eligibility for programs, and it would be important for us to know where this is coming from. We don't have a consent element, really, in the public sector, because there's only one provider and we're normally providing information under compulsion. That's required.

[Michael Karanicolas]

Can I just add something?

[The Chair, Conservative, Blaine Calkins]

Sure.

[Michael Karanicolas]

In terms of collating different types of information, I just want to point out that there can be data sets that used by themselves are relatively innocuous, but when you combine them with another data set, the impact on privacy can be escalated dramatically, so the use does make a big difference in how people's privacy is impacted.

[The Chair, Conservative, Blaine Calkins]

Good.

We'll now move to Mr. Lightbound for around five minutes, please.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Good morning.

Thank you, gentlemen, for joining us today. Thank you, as well, for the work you do every day.

My first question is for you, Mr. Gogolek. Earlier, you talked about B.C.'s domestic data storage requirement. What is it trying to prevent?

I believe Quebec has similar provisions, requiring that data remain in the province. The objective is to keep the data from ending up under the jurisdiction of another act. Is that correct?

[Vincent Gogolek]

That's precisely it. It's a bit of a long story, but we had an extensive debate on the subject in British Columbia around the turn of the century. The provincial government contracted private organizations to provide certain government services, including the medical services plan and the pharmacare plan.

The information in the databank is obviously very personal and sensitive in nature. The company the provincial government hired was American, Maximus. It was also around the time when the USA PATRIOT Act came into force. It sparked a big controversy. Our privacy commissioner at the time, Mr. Loukidelis, was very concerned about what could happen to this kind of personal information and about the possibility of it being subject to American laws, specifically, the USA PATRIOT Act.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

That brings me to another question, while I have two experts in front of me.

Earlier, we were talking about the Five Eyes group. Under Canadian law, spying on Canadians is prohibited without a judicially authorized warrant. However, just about anything goes when it involves foreigners. We are part of an alliance where countries share intelligence. Isn't that a way of getting around what is prohibited under the act?

I'd like you to explain how it works, to the best of your knowledge. I know that all the agreements may not be public. Am I interpreting that correctly?

[Vincent Gogolek]

I will answer first, and then, I will leave some time for Mr. Karanicolas to answer.

It's a bit complicated. It is clear that Canadian laws apply in Canada and, in some cases, elsewhere. One of the problems, however, is that the origins of these agencies, the Five Eyes alliance, can be traced back to the Cold War. They were mandated to spy on the communications of foreign militaries in the Soviet bloc, China, and other countries. That was their objective and their job. Obviously, privacy and the protection of personal information wasn't a consideration.

Over the years, the activities of these agencies changed. They undertook other types of surveillance, not just spying on foreign militaries. They now monitor organizations and individuals considered threats to Canada. Their activities are beginning to have a much bigger impact on Canadians and their interests, given the digital world we live in.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Mr. Karanicolas, where do you stand?

[Michael Karanicolas]

Yes, absolutely, it is a loophole that can be exploited, and it has been exploited.

To give you a parallel example, which I think spells the issue out more clearly, you have the United States signing information surveillance agreements with Denmark. They signed an agreement with the Danish intelligence agency and they said, “You can use our networks to spy on anybody outside of Denmark, but you can't spy on Danish citizens with them.” Then they made an agreement with the German government and they said, “You can use our networks to spy on anybody outside of Germany, but you can't spy on Germans.” It's the same network, so if they're on both points in it, then they effectively get access to everybody's information. It's a neat trick to say, “We're not using your network to spy on you”, but obviously it's a loophole that allows the system to be subverted.

As for how the system has functioned, my understanding is that previously Canadians traditionally have not had as strong an oversight over our intelligence services, but our intelligence services tended to respect boundaries much better. The information that I have heard suggests that under the previous Canadian government, that dynamic changed dramatically, and Canada's intelligence agencies became far more aggressive. Not being in a position to personally be able to oversee it, it's difficult to say, but that's the impression that I have.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Thank you.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Lightbound.

We're almost at six minutes, so we'll now move over to Mr. Kelly, who I believe is going to split his time, possibly, with Mr. Jeneroux.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Perhaps.

I want to ask a question that's a little different from what we've had so far.

We talked quite a bit about the dangers around security of data, the need to protect against breaches, and the reporting of breaches that are done through either malice on the part of, say, a disgruntled employee or are the result of a hacker or something of that nature.

I'm going to ask about certain kinds of privacy issues around information that is very deliberately shared or made public, and that's people's tax filings and the public record in family law. Concerns have been raised about privacy and even the potential for identity theft through tax filings and information that is included as part of proceedings in family law.

Can either of you comment on how to deal with privacy issues in areas that for due process require public information to be available?

[Vincent Gogolek]

We did a submission to the Provincial Court of British Columbia on the availability online of non-conviction information, which is not exactly the question you're asking, and I would refer you to that to a certain extent.

There's also something called “practical obscurity”, where information is not widely disseminated. It's not available online, but it's still available if somebody wants to go and get it. Of course, we do have an open courts doctrine. The courts are supposed to be open, and judges do have control over their proceedings. If there is an appropriate case, then one party or another can apply to have information stricken that goes before the judge, who then decides. There are some mechanisms in place to deal with that, if there is some serious risk in the court at the time.

[Michael Karanicolas]

I haven't studied that issue specifically, but I will say that I would be interested to know if there are documented cases of identity theft that has occurred as a result or if it's just a flag that's been raised.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

If, as part of the public record, the family law proceedings required the disclosure of a tax record, then there would be information contained in there that would be useful for somebody who wanted to commit identity theft. Even in the absence of a tax record, many types of family law cases would contain all kinds of information that could be put to malicious use when combined with information from other sources.

I'll share the rest of my time with Matt.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

How kind.

Mr. Gogolek, you mentioned during your presentation the requirement for domestic data storage and what the province is doing. Could you elaborate a bit on that? I don't think we've heard yet at this committee what you guys are doing in the province.

[Vincent Gogolek]

It's something that has been in effect since the early 2000s. It was brought in, and there was very extensive debate. The Privacy Commissioner of British Columbia at the time, David Loukidelis, did a very extensive report. We did submissions, and a number of other people were involved. This was the outsourcing of what's called MSP, the provincial pharmacare plan information.

We have no opinion one way or the other on whether that should be done by government. It can be done by us, but the question is, what happens to the information? This was happening at the time the Patriot Act was being introduced after 9/11, and there was a great deal of concern over what would happen to very sensitive personal information that would be managed by an American company.

As a result, the government brought in extensive domestic data storage requirements in the B.C. Freedom of Information and Protection of Privacy Act, section 30.1. I would refer you to that for the background on that issue. It has worked well, and during the last review of our public sector act, which was held earlier this year, the commissioner, our organization, and the B.C. government all agreed that this is a good thing. It's popular with British Columbians, and it should be kept.

[The Chair, Conservative, Blaine Calkins]

Okay.