Information & Ethics Committee on Feb. 23rd, 2017

[Prof. Teresa Scassa]

The American approach has been to have legislation specifically addressing children's privacy. The Canadian approach has been to deal with it under PIPEDA and to recognize that children may be a special case, so as a matter of interpretation, we take into account the fact that a website might be targeting children.

I guess the issue is, do we want to have something very specific in the legislation that makes it clear that when you're dealing with children, the rules are different or the rules are stricter? I see some merit in that: in being very explicit and up front that the rules for consent may be expressly different when you're dealing with children.

In that a lot of websites that target children are based in the United States, where they actually have to comply with the American laws, we've benefited to some extent. In Canada, we're simply not clear and explicit about the steps that have to be taken to protect children's privacy.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Mr. Martin-Bariteau.

[Prof. Florian Martin-Bariteau]

I would say the same. American legislation already exists but there is a problem with enforcing it. It does not work. We know full well that, normally, under the age of 13, additional rules apply. Children under 13 are on all social networks in America, as in the rest of the world.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Thank you.

Mr. Karanicolas, I want to get your feedback and opinion on Globe24h and that ruling. I'll be honest. I don't know a lot about it, but my spin on it is that it does pave the way for a Canadian version of the right to be forgotten. Can you elaborate for the committee on Globe24h and the impacts and ramifications of that ruling?

[Michael Karanicolas]

I haven't examined the case. I haven't read the case. I've read only second-hand accounts of it.

What I will say is that one of the things that struck me was that it demonstrates some of the challenges in jurisdiction you have in these kinds of cases. This is not specific to the right to be forgotten. It impacts a lot of online speech, where there are going to be challenges in enforcement and also challenges in imposing a particular Canadian standard on websites that might be operating elsewhere but targeted at Canadians.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Ms. Scassa, could you comment on that?

[Prof. Teresa Scassa]

Yes. I would hesitate to say that it really creates a Canadian right to be forgotten. The very particular context of the case is that it was dealing with court decisions that had been made publicly available by the courts under specific restrictions that weren't being respected, and—

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Those decisions were accessible, but they just weren't linked to Google. Was that it?

[Prof. Teresa Scassa]

That's right. They were accessible but not indexed, and the courts made them available on the basis that they would not be indexed.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Okay. Fair enough.

[Prof. Teresa Scassa]

They were scraped and then indexed by this other site. I would hesitate to say that it's really a right-to-be-forgotten case.

[The Chair, Conservative, Blaine Calkins]

Thank you very much.

We'll go back to Mr. Kelly for five minutes.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

In the discussions around the right to be forgotten, that version of being forgotten—being de-indexed by a search engine—sounds more like a right to be lost than a right to be forgotten. It's certainly not erasure. I'm glad that we're finally getting to some distinctions between these different things.

Ms. Scassa, I was pleased to hear in your testimony and get into the record the acknowledgement of PIPEDA being onerous for small businesses and certainly unloved, probably misunderstood and, I would say, probably feared by many. Small business owners I've talked to are certainly not conversant with privacy law. They know there is a privacy law out there. In many cases, they're probably at a loss as to how to comply and, yes, it's beyond the reach of many businesses to have expert advice on how to comply, as you mentioned in your testimony.

In your opening remarks, though, you characterized the consent model as a joke. If so, what's the answer?

[Prof. Teresa Scassa]

Yes, well, I don't know, but I certainly know there's a huge volume of personal information about me that is out there now and is being collected and transmitted probably right now by my phone, information that I don't want to share. I don't even know what it is or how it got there. For me, that makes consent a joke, in that even somebody who's educated in law, has law degrees, and who works in the field of privacy can't get a handle on what's happening to their personal information. To me, that says the system is broken.

How do you fix it? I think the commissioner's consultation produced some interesting suggestions, ideas, and possibilities. I think it's a question of trying to find the right combination. I don't know. I'm sorry. I really wish I could say, “This is what's going to do it.”

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Consent surely has to be the basis on which consumers and businesses interact with each other.

For anything from going to the local bowling alley, to applying for a mortgage, to signing up for a cellular phone, to choosing to post pictures on Facebook, yes, the vendors of these services must recognize and be aware of privacy expectations on behalf of their customers. Customers have to be able to consent, or not, to these services. I don't know how we get around this idea that consent must end up being the principal basis of these commercial relationships.

Go ahead, Mr. Karanicolas.

[Michael Karanicolas]

I think consent is certainly a prerequisite, and I think you must have some form of consent within any system, but in a lot of the examples that you mention, consent is not the only thing that comes into play. There are also regulations and rules that govern these relationships.

I think there are ways to boost the current model of consent through greater transparency—that's a big one—on what exactly is being done and also through presenting what's being done to users in a way that promotes engagement and accessibility. Again, that's the opposite of the way things are being done now, with terms of service that are overly legalistic and complicated. I also think there's room for centralized rules to be put in place about what can or can't be done, or particular models that should be followed.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Go ahead, Mr. Martin-Bariteau.

[Prof. Florian Martin-Bariteau]

I don’t think that we have a magic solution in the case of consent. Of course, it must remain at the base, but people also have to know what they are consenting to. There was a problem on the consumers' side and we know that the provinces have legislated in the matter.

Perhaps it would be wise for consumers to know that they are consenting to something to do with protecting and managing their personal information. This is because confidentiality notices actually go in the opposite direction, in the sense that they deal with all the ways in which confidentiality is lost.

In addition, clearer legislation would perhaps help small companies to manage this. Principles could be set, with policies then established to reflect them. For each principle in the legislation, there could be an explanation of how to comply with and adhere to it.

[The Chair, Conservative, Blaine Calkins]

Thank you very much.

Mr. Dubourg, you have the floor for five minutes.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Thank you, Mr. Chair.

My thanks to the witnesses for joining us this afternoon.

Mr. Martin-Bariteau, my questions go to you.

In your brief you say this: “In terms of drafting, the act should remain conceived according to the principle of technological independence and be principles-based.”

The Privacy Commissioner has said that the act should be technologically neutral and based on principles. Given those comments, it looks like we are on the same wavelength.

However, you say that, compared to other federal legislation, there is no doubt that this act is one of the worst drafted, because it has, to an extent, been copied. That being the case, what do you suggest? How can we go about reworking it, rather than improving what we have now?

[Prof. Florian Martin-Bariteau]

In reality, it's only a small doctrinal debate. It means practically the same thing.

The idea that the legislation is based on principles is meant to allow greater flexibility, to set limits and, as Professor Scassa said earlier, to allow small and large companies, the mobile and health world to adapt.

The current act evokes great principles in some way, but not at the same time. To understand a principle, you need to read the text of the act in three different places. As with some laws, perhaps the idea would be to gut everything. It is a matter of trying to agree on what the main principles and the number should be. Then, after the mandatory sections in which the title is defined, the first principle can be described, then the second, the third and so on. Then it can be made very clear what the limits are and what the recourse of the users and the powers of the commissioner are.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Is that how it's done in Europe?

[Prof. Florian Martin-Bariteau]

I would say yes, even though I don't have the regulations or the old directive in front of me. The suite of sections includes those on collection, communication and so on. It is also a question of this famous right to deletion—and not to be forgotten—which is something that may need to be clarified.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Like Ms. Scassa, you agree to giving the commissioner more power. In terms of enforcement, you talked a lot about fines that should be imposed. However, you are also telling us that to avoid the appearance of a conflict of interest, fines should be payable to the Receiver General.

Could you expand on that?

[Prof. Florian Martin-Bariteau]

It is simply a matter of avoiding possible attacks by the private sector, which could claim that the commissioner would leave his role as an ombudsman to become a “sanctioner”. To increase his budget and his powers, he would apply greater sanctions.