Evidence of meeting #47 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was consent.
A recording is available from Parliament.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
I have one last question for you.
You talked a lot about transparency as regards algorithms, stating in particular that this approach should be reviewed.
What are your thoughts on that? How should we review those algorithms? Should we also impose sanctions on people who use personal information in ambiguous situations?
Full Professor, Department of Criminology, University of Ottawa, As an Individual
I'd refer you to the statement that's been put together by the Electronic Privacy and Information Center. They have an interesting statement of rights when it comes to algorithmic transparency. In a lot of ways, it's already in our legislation. They have to tell us what they're doing. They have to tell us why they're doing it. They have to tell us what the outcomes are. It's just that so often it's been buried in the algorithm in ways that make it even less transparent, so certainly a number of us within the civil society sector are quite concerned about this and think that it's worth pursuing as a provision in its own right.
A lot of it, too, requires that corporations be much more responsible for the outcomes. Yes, I do think there should be penalties attached when there are discriminatory outcomes in particular, and I think that would create a situation in which people would be much more careful when they are running algorithms that really significantly change people's life outcomes.
Conservative
The Chair Conservative Blaine Calkins
That's interesting.
Thank you very much.
We have time for two folks in the five-minute round.
We'll go to Mr. Kelly and then to Mr. Saini, so let's keep it within our five minutes, colleagues.
Mr. Kelly.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Thank you, Mr. Chair.
So far, most of our testimony in this session seems, at its premise, to have been geared toward the larger businesses, the global social media players, such as Facebook and Google. I haven't heard Facebook named very many times, but I get the feeling that's who we're talking about in much of this. Yet this act in concert with provincial private sector privacy law, where it exists, is one that governs all businesses in Canada.
I'll ask both witnesses this. How well do you think all organizations that are subject to this law understand their obligations? We had Gary Dickson, the former Saskatchewan privacy commissioner, talking about doing audits or investigating compliance, and he found very little awareness regarding organizations' obligations under PIPEDA.
Full Professor, Department of Criminology, University of Ottawa, As an Individual
And that certainly has also been found in studies that have been done by CPIC, for example. Andrew Clement has found the same in work he has done at U of T. So from what we can tell from the research, compliance is quite low.
In work I've done, what companies have said has been interesting. Again, it's, “I have a right to the information. The person has to give it because there's legislation.” So I think there is a very important piece with education, especially for small businesses. I know the commissioner has some material on his site that attempts to fill that void, but we have a lot of work to do in that regard, for sure.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
We didn't get far in our testimony regarding what harm may have been done as a result of non-compliance. One thing they may have found going into a small business is that the proprietor is not aware of the obligations and hasn't undertaken certain obligations such as appointing a privacy officer, and these kinds of things. But where have we found harm? Which types of businesses are harming the public through their non-compliance with PIPEDA?
Full Professor, Department of Criminology, University of Ottawa, As an Individual
In any complaints-driven process, you're going to find out what's going on only when someone is angry enough to complain. So as the tip of the iceberg, certainly the free flow of health information has created a certain number of complaints. As it moves from private sector legislation to public sector legislation, people are really concerned about that and when they find out that people have access to that, they're motivated to complain.
Am I going to be as worried if my bowling alley has collected that information about me? Again, its ability to collect is at this point limited by the nature of the business and the technology and the resources that it can bring to bear. I think that's why you've seen the main complaints about these larger issues with these larger companies. They're simply more visible.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
I'm going to ask Mr. Gogolek to comment in the remaining time I have.
Executive Director, B.C. Freedom of Information and Privacy Association
We'll probably be finding out more about what's happening here in B.C., where we apparently have the problem that Professor Steeves was talking about, with doctors' offices and PharmaNet being under our private sector PIPEDA-equivalent law. There are going to be questions about what's going on here and who fell down on this. There were a few doctors' offices involved, four I believe. I would suggest that we keep an eye on the situation here in British Columbia for an idea of how badly things can go wrong.
Conservative
Liberal
Raj Saini Liberal Kitchener Centre, ON
I'm going to have two questions, but I want to sort of finish off on one question. We spoke about the right to be forgotten, and other people have mentioned minors and you also mentioned minors. As we explore the right to be forgotten, do you think there should be a special provision as a recommendation for those minors who may have given consent at a certain age? Do you think there should be a specific provision for them to have it totally eliminated?
Full Professor, Department of Criminology, University of Ottawa, As an Individual
Yes, whether it's 18 or not. I think with anything before age 18, you should be able to get a clean slate and make it all just go away.
Liberal
Raj Saini Liberal Kitchener Centre, ON
I suggested that because you mentioned it in your preamble.
If you remember the case in Spain with Google, there were two provisions there. One was that the search engine could not provide a link to the information, but the link was being held by a newspaper that had been archived, so although it may not have been ubiquitous, it was still able to be found. Technologically, in what way can we do that? Is there some way?
February 16th, 2017 / 5:25 p.m.
Full Professor, Department of Criminology, University of Ottawa, As an Individual
Again, it speaks to the earlier comment. It's the kind of remedy that would work well with social media, for example. I would know where my information was because I gave it to that particular organization.
Information about me that floats around is typically only brought to light when it harms me in some way, and then the remedy that most young people want is the ability to have it taken off of someone else's social-media account. It really reflects the ways that young people gather in particular places. Social media is a hot spot.
Education is another area of concern, because there are a number of companies that are now collecting minute details of young people's learning and commodifying it.
It was interesting—we started to try to look at political economy in both of these areas. One of the reasons we talk a lot about the big guys is that they buy the little guys. As soon as there's an information platform that attracts a lot of information and that becomes very marketable, it's bought by someone larger. Again, you see those honey pots. If we could address those honey pots, I think that would help.
Executive Director, B.C. Freedom of Information and Privacy Association
I think I'll pass on this one.
Liberal
Raj Saini Liberal Kitchener Centre, ON
I'm going to ask you a technical question. It relates to a certain section of PIPEDA.
There are two things I want clarification on.
First, can you explain to me the difference between destroying data and making it anonymous?
Second, do you think that providing choice in the legislation creates a loophole?
Full Professor, Department of Criminology, University of Ottawa, As an Individual
Those are good questions.
It seems to me that destroying data means magnetizing it, making it go away so that it's no longer held at all.
I am very skeptical about the ability to anonymize data, and I think the loophole it creates is this space for de-identified or anonymized data, which can be so easily re-identified, with so few factors taken into account. It goes back to the notion of retention as well.
The intention always was, “Tell me why you want it. I'll say yes. Once you're done, make it go away.” Yet, because of the monetary value of all this information, we're just letting companies hold it in perpetuity.
I think it is a loophole. It's another loophole that allows them to hold it because it might be valuable in the future.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much. We have a minute left.
Ms. Steeves, in your opening remarks you mentioned something that caught my attention and I wrote it down. I don't know if anybody asked a question directly about it.
Could you elaborate and expand a bit more on the perception that younger people have insofar as audience control goes?
Full Professor, Department of Criminology, University of Ottawa, As an Individual
Okay.
Typically, as I said, in a regulatory regime, we figure that if someone discloses something then it's no longer private, whereas their notion of privacy is relational, and they want to negotiate it with different audiences.
If I post something on my Instagram account, and that account is for my friends, I don't want my mother looking at it. I want a mechanism that will say, “No, that's not my family account. That's my friend account.”
Typically, when they worry about privacy invasions, it's because the barriers between their different audiences have been removed. This is all taken out of the social-media world and made accessible to anyone outside of those audiences, and there are harms to them because of it.
Two 13-year-old kids in Toronto went on vacation. They got back. They were talking about their tans online. One said, “I'm darker than you,” and they were called into the principal's office for racist bullying, because they both happened to be African-Canadian kids.
They were thinking, “I'm talking to my friends, and we're having a chat, but because this information can then be captured, now I'm under surveillance by my school and I'm accountable to my school for everything I say.” It's the ability to keep those lines firmly in place that they care about.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much.
Thank you very much, colleagues.
Mr. Gogolek, I think we kept you within your time limit, so I hope you'll be able to do what you need to do.
We thank you both very much for coming before the committee.
Colleagues, we'll see you here Tuesday of next week.
The meeting is adjourned.