Evidence of meeting #49 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
However, you agree that the commissioner would be the one to determine and enforce the penalties, but the budget would not be determined on that basis.
Assistant Professor, Common Law Section, Faculty of Law, and Director, Centre for Law, Technology and Society, University of Ottawa, As an Individual
Exactly.
His budget would be totally independent of the sanctions he would impose or not, and it would come back to the taxpayers, therefore to Canadians.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
Right.
However, other organizations or other departments, even if they raise money, do not necessarily keep it. Take, for example, the Canada Revenue Agency.
Lastly, we are talking about the right to be forgotten. You said that it should not be used to manage the reputation of people. Earlier, you heard our colleagues talking about young people, for example, who post messages on Facebook or on other social media. In terms of reputation management, what are you telling us about that?
Assistant Professor, Common Law Section, Faculty of Law, and Director, Centre for Law, Technology and Society, University of Ottawa, As an Individual
I think my way out would be to say that I do not think it would be PIPEDA that would deal with that, but that it's more about private relationships. Some provinces have established remedies. We have the Criminal Code, which provides for a criminal remedy. However, if it was put online and it was in the public interest—
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
On the other hand, we know that these organizations have algorithms, that they will take this information, that they will use it, and that they will then offer services. They want to sell products. That is the point raised. Do you not think that PIPEDA should continue to regulate all of this?
Assistant Professor, Common Law Section, Faculty of Law, and Director, Centre for Law, Technology and Society, University of Ottawa, As an Individual
Yes, in that case, but in the case of someone who is going to get a photograph and put it elsewhere, then I don't think that person is subject to PIPEDA anymore. There is more talk about the right to the image and civil liability, which is generally a matter of provincial jurisdiction.
Conservative
The Chair Conservative Blaine Calkins
We're actually well past the time, Mr. Dubourg.
Mr. Blaikie, for the last of the scheduled time here, please go ahead.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
Thank you, Mr. Chair.
My next question is for Mr. Martin-Bariteau.
Obviously, there is an important economic link between Canada and the United States, and there is a real sharing of information. It may involve a transfer of information between Canadian companies and American companies. This is done even when we record data with a Canadian company, because the infrastructure we use then is in the United States. We know that American law does not give much protection to citizens of other countries.
Does our relationship as such, let alone the other deals with the United States, threaten our relationship with Europe and the judgment Europeans might pass on the protection of their personal data?
Assistant Professor, Common Law Section, Faculty of Law, and Director, Centre for Law, Technology and Society, University of Ottawa, As an Individual
That is an excellent question. I must admit that I haven't thought about it.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
Could you? Maybe not today, but I invite you to think about it a bit and give us your opinion at some point.
Assistant Professor, Common Law Section, Faculty of Law, and Director, Centre for Law, Technology and Society, University of Ottawa, As an Individual
It would be a pleasure.
Certainly the problem at the moment is that recent decisions of the new government have made this is an issue for Canadians. I can look at how this would affect an adequacy decision.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
Okay. Thank you very much.
I'd like to come back to the question of consent. I know we've tried this a couple of times.
One of the things I find as a layperson with respect to consent is that it would be nice to be able to divorce my consent for the use of my personal information from being able to use the service. You know, people can't decide to just not use computers anymore because they don't want to have that personal information shared, or they can't decide not to use a Microsoft product if they're in a work environment where often they're exchanging documents or whatever. In order to get into what have become essential tools for doing your job or even conducting your personal affairs, you can't read those terms of use and say you don't like those terms of use, so you're just not going to use that software, because then you can't actually accomplish the things you need to be able to accomplish, either in your personal life or in your professional life.
I could be wrong about this, but I think consenting to the extent of collection and then third party use of my personal data is often not really relevant to my using the service. Is there a legal way to try and divorce consent to the kind of widespread use of my personal information from what they would really need?
If you have an app like Foursquare, for instance, which uses your location, which is about where you are and about sharing that with other people, obviously collecting my location at that time, and doing that through my phone, is part of the app. With other software, however, you're often consenting to a broad statement about using your personal information that really has nothing to do with the use of that software. It's not integral to the operation of whatever service it is I'm trying to access.
Is there a way to try to carve that up that doesn't become overly cumbersome?
Full Professor, University of Ottawa, Canada Research Chair in Information Law, As an Individual
The overly cumbersome part is the tricky thing. One of the challenges, of course, is that there are a lot of so-called free apps and free social media platforms and free services that are not free. The currency that you pay is your personal information. In that context, it does make it harder to draw a line between what is reasonably necessary, since they're the ones who are deciding what they need in order to make their business model stay afloat. I think that's another challenge as well.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much.
Colleagues, we're at the end of the official rounds of questioning. I know that some colleagues want to follow up with some questions.
Mr. Massé, I know that you would like to ask some questions, so I'll go to you right now.
If any of our witnesses have some things that they wished they'd said or that have come to mind, there will be an opportunity at the end to express those thoughts.
Mr. Massé.
Liberal
Rémi Massé Liberal Avignon—La Mitis—Matane—Matapédia, QC
Thank you, Mr. Chair.
I would like to thank the witnesses for appearing before the committee and for taking part in its work. I know that you must have done a lot of work in order to meet with us. It's greatly appreciated.
Mr. Martin-Bariteau, earlier you referred to the term “technological independence”. I just want to make sure I properly understand the term. Is “technological independence” the same for you as “technological neutrality”? To you, it's the same concept. Is that correct?
Assistant Professor, Common Law Section, Faculty of Law, and Director, Centre for Law, Technology and Society, University of Ottawa, As an Individual
Yes, it's the same concept. It's just that, in my doctorate dissertation, I have just defended that we should instead speak of “independence” rather than “neutrality” because the word “neutrality” has two meanings.
Liberal
Rémi Massé Liberal Avignon—La Mitis—Matane—Matapédia, QC
That's a good point.
In this context, what recommendations would you make to ensure that the Personal Information Protection and Electronics Documents Act, commonly referred to as PIPEDA, provides this technological independence?
Assistant Professor, Common Law Section, Faculty of Law, and Director, Centre for Law, Technology and Society, University of Ottawa, As an Individual
I think that on this point, aside from writing, this is currently the case. There are no rules specific to paper or the Internet.
You are going to propose amendments to the bill and Parliament will pass it. In the time it'll take for the legislation to come into force, technology will have advanced. If we think of artificial intelligence and robotics, for example, we don't know what tomorrow will bring. We only know the situation today. So it's preferable to always keep to this idea of principle. This will allow the law, once it's been properly drafted and not as it is currently worded, to be in force for many years and to adapt to all technological developments that we can't even imagine yet.
Liberal
Rémi Massé Liberal Avignon—La Mitis—Matane—Matapédia, QC
Okay. Thank you.
On another point, the comments of all the witnesses obviously caught my attention.
Mr. Martin-Bariteau, in your remarks, you mentioned the right to be forgotten. You find that the proposition dreamed up and demanded by some is dangerous.
Could you tell us more about what led you to make such comments? You said that in a democracy, the archives have never been erased simply because they were disturbing, at least not legally. In your opinion, this is very dangerous ground. I'd like to hear more about that.
Assistant Professor, Common Law Section, Faculty of Law, and Director, Centre for Law, Technology and Society, University of Ottawa, As an Individual
This comes back to the idea of reputation management. For many people, when they propose a right to be forgotten, they want the right to be able to erase information that concerns them. For example, it can be disturbing press articles that talk about some things they have done in the past. An article might have appeared in the press last year and, later, they went to a job interview. They would like to be able to erase the information that is recorded.
It's true that we are in a world today where it is increasingly difficult to forget. The Internet doesn't forget, nor does it forgive. People have never been allowed to go to La Presse or the daily newspaper Le Devoir to ask that articles be deleted. A person might say that, since an article is no longer agreeable, we will remove it from the archives and erase it from all the libraries.
I don't see why today, because it's facilitated by technology, we would allow actions like that, which would erase the memory.
However, as someone said earlier, there are a number of other cases of information gathering, which is the case in Globe24h.com. One of my colleagues insisted that this is perhaps the beginning of the right to forgot. When I read the court ruling, which is on pages 70 to 76 of the judgment, I think that the problem is that the collection of information is in violation of the act and is being used for illegal purposes. In this case, it was to extort people by telling them that we would delete data in exchange for money. This is not reputation management. These are just attempts at fraud.
Conservative
The Chair Conservative Blaine Calkins
Mr. Dubourg, did you want to follow up? No.
Go ahead, Mr. Saini.
Liberal
Raj Saini Liberal Kitchener Centre, ON
I have a very quick question for Ms. Scassa.
My good friend Wayne Long asked a question about kids when it comes to privacy. I just wanted to ask your advice on one issue. In the United States a minor is determined to be the age of 13. That regime is undertaken by the FTC. Under the new GDPR regulations that have come out, the age will be 16. In Canada we don't have an age parameter. Apparently the Privacy Act covers all ages.
I'm wondering if you think that's important for two reasons: one, to have a benchmark where websites can have some control in terms of who they're dealing with; and two, when it comes to the right to be forgotten, to make it easier for people under that age as compared to an adult.
Full Professor, University of Ottawa, Canada Research Chair in Information Law, As an Individual
As a parent of teenagers, I'm all in favour of the higher level of 16, simply because I think there's an educational function to be played there as well. It's not simply a question of strictly consent. It's a question of ensuring that kids under that age are given more opportunities to reflect on what they're doing, what they're consenting to, and what they understand about information collection. There really is an educational role to be played there.