Information & Ethics Committee on Feb. 23rd, 2017

[Prof. Teresa Scassa]

I'll make clearer the distinction I'm making between the right to be forgotten and data erasure.

Let's say you've joined a social networking site, and you've created a profile, you have photographs, and you have information on your profile, or let's say it's a dating site and you've created a profile for that. You have that up for a couple of years and you decide you no longer want to be part of that site. You don't want to do business with it—this happens all the time—and you say to the company, “Remove my account and get rid of my personal information, because I'm done.” That's the right to erasure. That's different from the right to be forgotten.

You're not saying that there are newspaper stories about you out there that you don't want anyone reading anymore and you want them de-indexed. You're saying that you've had this relationship with a private sector company that you're terminating and you want the data that you have provided as part of that relationship to be removed. In many circumstances that has been very difficult for people to achieve. That's the right to erasure.

I think that's very important. If we can strengthen the right for people to be able to take those kinds of measures with the private sector organizations that have been collecting and using their personal information, I think that's important.

The other aspect of the right to be forgotten, I have substantial misgivings about.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

Fair enough.

If I could jump in here, and I hope to bring Mr. Martin-Bariteau into this as well, let's say a 16-year-old posts something on a Facebook account. Fast-forward 20 years and they decide to, I don't know, do an honourable profession and run to be a member of Parliament perhaps. Even though they've entered into that contract, what's not to say that somebody hasn't gone and screen-captured that particular story, with a news story perhaps written about it? I guess that's where I'm struggling with the right to be forgotten piece. It's not necessarily the contract you've entered into with that organization, it's the fallout, the public fallout, I guess, after that.

I used the example of a member of Parliament only because I know that there are people around the room here who would agree with me that it's prevalent.

[Prof. Teresa Scassa]

I think that's a serious issue as well. I'm not sure it's a PIPEDA issue. In some circumstances, issues like that have been dealt with through the tort system. Where it's been done maliciously, they've been dealt with through other mechanisms, because I think they raise issues that go beyond simply data protection.

While I agree that it's an important issue, I'm not entirely convinced it's as much a PIPEDA issue as it is a problem that maybe requires multiple different solutions, depending on the circumstances. I mean, revenge porn falls into that category. That's clearly a tort and also perhaps criminal activity and so on.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

I think I'm out of time.

[The Chair, Conservative, Blaine Calkins]

You certainly are, buddy.

[Voices]

Oh, oh!

[The Chair, Conservative, Blaine Calkins]

Mr. Blaikie, you have up to seven minutes.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you very much.

Mr. Karanicolas, I want to start with a couple of questions about the right to be forgotten. You mentioned that the rollout of that in Europe has not gone very well. I was just wondering if, for the benefit of our record and testimony, you could provide a couple of the best examples of what didn't go well, what didn't work, in the European context.

[Michael Karanicolas]

I'll start by endorsing the distinction that Professor Scassa made between data protection and a right to deletion and a right to be forgotten, because that is a key distinction.

The way it was handed down was the first problem we saw. There was a decision by the European Court of Justice that didn't even really mention freedom of expression, and included statements that, for example, the right to privacy generally trumps people's right to obtain information. There was a lack of proper consideration of the rights that were being infringed. That would be the first one. With that decision, which was relatively bare, providing the only guidance at the outset at least that Google was going to have in implementing that, it was hugely problematic, because you create this enormous new responsibility without a huge amount of guidance on how it's supposed to be implemented.

As I mentioned briefly before, putting this on the private sector is hugely problematic, because this is a very tricky decision. It involves balancing different rights against one another, and it involves considering the overall public interest. Google is absolutely not equipped to do that. Even for a company of their size, this is something that you need judicial or quasi-judicial decision-makers to take on. Saddling it onto the private sector was also a significant mistake. I think you saw that the floodgates sort of came open. I looked it up in the interim, and I saw 348,000 requests to remove links by Google.

When I say that I have a certain amount of sympathy with regard to a few limited cases of where the right to be forgotten could be applied, I think it's a challenging thing to implement in terms of just applying it to those extreme cases. I think the European example shows that once the right is implemented, the floodgates kind of come open, and you have a huge amount of legitimate or accurate information, or perfectly relevant information, that people would request deletion for.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

This comes from a decision of the European Court of Justice. Without a great background on this subject, is there anything in the general data protection regulation about the right to forget?

[Michael Karanicolas]

My understanding of the way in which it's applied is based on the initial rollout of the ECJ decision. I believe the data protection regulation does address that, but I haven't reviewed that specific aspect.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

For me, the next question, and perhaps some of our other witnesses have an idea on this, is that when we talk about worrying about whether our privacy laws are adequate under the European test so as not to disrupt the commercial data flows, is having some aspect of a right to forget a necessary component of meeting the adequacy test for Europe?

[Prof. Florian Martin-Bariteau]

No. Absolutely not.

Even in the new GDPR, which addresses the issue of the right to be forgotten, it is in quotation marks. In that context, it is called “the right to erasure”. The Regulation makes the distinction that Professor Scassa mentioned. In fact, the right to erasure provided for in the GDPR is somewhat in line with the one already in the 1995 directive, which was in force in most European Union countries.

It is possible to request that data be deleted, but only for the data whose collection, communication or disclosure violates the Regulation. However, the Regulation sets out exceptions for freedom of expression, freedom of the press, the right to information and so on.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

The right to erasure already exists in Canada. I wonder whether it fits in with the European model or whether the option should be there.

[Prof. Florian Martin-Bariteau]

Like Professor Scassa, I think PIPEDA should clearly provide for the right to erase inaccurate and erroneous data so that it is not just a recommendation.

I would also like to point out that the second paragraph of article 45, which talks about adequacy, does not mean just doing a cut-and-paste; it means considering effective and enforceable rights. Direct rights would therefore be appropriate. In terms of data protection, it does not directly relate to any right to erasure, but indicates that the country’s rules on human rights and fundamental freedoms will be taken into account. In this case, we are talking about the Canadian Charter of Rights and Freedoms.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you.

On the issue of consent, I'm just looking for some practical advice. I think it's pretty clear that the current consent model really doesn't work very well. Anyone who has signed up for software over the Internet and been confronted with user agreements has a pretty good sense that these are opaque and long and technical. Even when you do start to read them, they tend to be overly broad and you feel like you're signing up for just about anything when you click “I agree”.

How do you have a model that isn't overly prescriptive but nevertheless offers something that ordinary Canadians who don't have a background in that particular kind of law can digest so they can feel comfortable that they know what they're signing on to? Do you have template agreements, or is that overly prescriptive and you would then have agreements that wouldn't fit the kinds of services being offered? How do you write something into law that actually accomplishes a viable consent model?

[Prof. Teresa Scassa]

That's a very good question.

It's challenging. I think there are small fixes in terms of tools, direction, and guidance in drafting better privacy policies and more condensed or short-form privacy policy templates, as you suggest.

In terms of ubiquitous and continuous collection, people have suggested that there should be pop-ups from time to time to remind people that their information is being collected by the toaster, for example, and that they might want to think about whether they still want that to be happening. There are those types of things. Some of those could be mandated in legislation. Some could be done through guidance from the Privacy Commissioner.

There are others who suggest, as you know, broader fixes, such as moving all sorts of data collection and considering it fairly routine, and consent wouldn't be required. What worries me about that, of course, is the threshold that there be no risk or no harm. I think that in the big data environment, we're still trying to figure out exactly what the risks and the harms are. It's not always obvious at the outset what the implications of the collection of certain types of data are going to be, depending on what is then subsequently collected by someone else and put together.

I think there are some very serious challenges there, and I wish I could say, “Here are the three things that need to be done”, but I'm still struggling with it myself.

[The Chair, Conservative, Blaine Calkins]

We are out of time for Mr. Blaikie's allotted time, but I know that if there are others who want to get in on this, there will be an opportunity, I'm sure.

We'll now move to Mr. Saini, for the last of our seven-minute rounds.

[Raj Saini, Liberal, Kitchener Centre, ON]

Thank you very much.

I want to start off with one point. Canada, having recently signed CETA, is going to be under some pressure to rise to the level of the GDPR, general data protection regulation, that will come into effect in May 2018 in Europe. There are stark differences between what we currently have and what has been indicated in the GDPR. One is data erasure and privacy by design and by default.

Could you give a broad outline to the committee as to what significant or important areas we should focus on? I guess ultimately we'll have to rise to that level to do business with Europe. Are there any key indicators you feel we should focus on?

[Prof. Teresa Scassa]

Maybe I'll pass the floor to our resident European.

[Voices]

Oh, oh!

[Raj Saini, Liberal, Kitchener Centre, ON]

I have a lot of questions. I can ask another question.

[Prof. Florian Martin-Bariteau]

In my view, PIPEDA should clarify the issue of the retention of data over time, provide for an obligation for organizations, and also provide a direct right to litigants. The direct rights of litigants are one of the conditions for adequacy. As with the enforceable orders and fines, paragraph 45(2)(b) of the Regulation tells us to look at whether the supervisory authority is truly independent and has adequate enforcement powers.

[Raj Saini, Liberal, Kitchener Centre, ON]

Ms. Scassa, do you have anything to add?

[Prof. Teresa Scassa]

Yes. I would agree with that. I certainly think the biggest weakness in PIPEDA in terms of conformity with European norms is on the enforcement side. There are simply not enough powers for the commissioner.