Information & Ethics Committee on Feb. 23rd, 2017

[Raj Saini, Liberal, Kitchener Centre, ON]

Mr. Martin-Bariteau, you mentioned a structure for fines within Europe under the GDPR right now. The fine structure is either 4% of annual turnover or 29 million euros, whichever is the higher number. Do you think we should follow some sort of mechanism? Right now, as you've very aptly said, there is no fine procedure. The Office of the Privacy Commissioner cannot fine.

Ms. Scassa, in your writings, you've mentioned Globe24h. In that Romanian case specifically, the fine imposed was only $5,000, and there was no way to collect on that or to even prevent Romania from stopping the indexing of files on the CanLII website.

Do you think the fine procedure should be there, and at what levels?

[Prof. Florian Martin-Bariteau]

I think the GDPR's mixed approach is the good one, regardless of the percentage, because even at 4%, I think it's still calculated based on the number of citizens affected by potential breaches of confidentiality and depending on the area.

We know that there are fewer citizens in Canada than in the European Union. On the other hand, it is important not to have a simple percentage, because 4% of a small structure, for example a start-up company, is not much. The company might want to take the risk with its investors and tell them to go ahead. If anything were to happen, at most, it could be about 4% of $500,000. That’s peanuts. That’s why it has to be doubled.

For example, in France, until 2016, the maximum amount was $150,000 for the first fine and $300,000 afterwards. It did not work. France has just raised this to a single amount of $3 million. This was adopted almost at the same time as the Regulation, which in my view also reflects the number of citizens concerned within the boundaries of a certain territory.

[Raj Saini, Liberal, Kitchener Centre, ON]

Ms. Scassa, in your opening preamble, you mentioned business. Right now, the difference between the GDPR and Canada is that we don't have a privacy-by-design or privacy-by-default mechanism. Do you think that's important, or is that a first step to making sure not only that businesses are somewhat concurrent with GDPR but that the relevancy is there?

You also mentioned SMEs. Do you think that, by process, there should be some sort of privacy document or privacy agreement that would be standardized across the Internet, to the extent that we can do it, whereby privacy trust marks could also be used? In this way, we would be helping consumers when they interact with certain businesses to have the confidence that the company has a privacy-by-design or privacy-by-default mechanism and, more important, that it has been authorized by some sort of body so that they would have confidence and there would be a privacy trust mark there. Would that be something that you think would be viable?

[Prof. Teresa Scassa]

I know that in the very early days of PIPEDA there was a lot of talk about trust marks and trust seals and so on. People tried them. They haven't really gone very far. I think there have been concerns about the counterfeiting or faking of trust seals and trust marks as well. I'm not sure how viable that is as a solution.

There are interesting technological developments as well. People are working on codes and apps, for example, that will scan and rate privacy policies, so I would be hesitant to go with a trust mark solution when there may be other technological tools that would be more useful and more effective in terms of helping consumers understand what the privacy policies are.

That said, I know that for some time we've been talking about privacy by design and privacy by default. Those are important principles. It may take amendments or changes to the law to get people's attention on them.

[Raj Saini, Liberal, Kitchener Centre, ON]

Okay.

Mr. Karanicolas, you mentioned that Google had 350,000 or 340,000 requests for the right to be forgotten. In those cases, 42% were removed. You mentioned the case in Europe, so I'm thinking you probably meant the Google v. Spain case. Is that what you were talking about?

[Michael Karanicolas]

That was the original case at the ECJ, yes.

[Raj Saini, Liberal, Kitchener Centre, ON]

Do you think the Google v. Spain case, and the judgment from that case, should be used in a way? The judgment was clear on the right to be forgotten and the right to erasure. Do you think that was the right judgment, and is that something we should use, or not at all?

[Michael Karanicolas]

No. I think the judgment of that specific case was terrible. That's a lot of what I was speaking to in terms of the lack of clarity and in terms of the solution that was proposed.

As well, specific to that case, I don't think it's a very good test case in terms of the right to be forgotten. In my opinion, the specific information that's at issue in that case, which is a person's bankruptcy or some sort of financial difficulty that they were in 15 or 20 years ago, is absolutely relevant. That information should certainly still be available. I think what they—

[Raj Saini, Liberal, Kitchener Centre, ON]

But—

[The Chair, Conservative, Blaine Calkins]

But we're out of time, Mr. Saini.

[Voices]

Oh, oh!

[The Chair, Conservative, Blaine Calkins]

Mr. Kelly, you have up to five minutes, please.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

In listening to the witnesses we've had so far, including today's witnesses, I'm struck by the sheer number of different kinds of organizations that this law applies to, and how many different contexts or different anecdotes and examples are discussed that fall under the same law, and yet it would seem virtually meaningless, perhaps, to the different types of businesses and organizations that this law is subject to. You have professional services like law firms, financial services, accounting firms, and my own business from before I became a parliamentarian, the mortgage brokerage business. These are businesses that have long, long understood the need to keep client information private. They do not try to share information publicly or to profit from doing so. It would be completely counter to all the principles which the many different professions that must collect information work under, and yet the same law is also for a social network, for whom the product is the information that is shared.

Do we need to have two different laws? We have personal information and privacy, which seems like one thing. Electronic data, or the deliberate sharing or communication of electronic information, strikes me as something quite different.

I'd like any of you to comment on whether or not, with so many different things going on and the different types of activity that this law tries to regulate, this needs to be split up.

[Prof. Teresa Scassa]

I could jump in on that.

I think there would be dangers in splitting it up. Increasingly over time the commissioner's approach has been to try to create guidance that is specific to particular sectors or particular contexts so that you have one law that applies to all, but how it applies in particular contexts may be different. The commissioner's office has given attention to mobile apps, and has given attention to fitness devices, and has looked at various specific things with guidance to small businesses and guidance to businesses in particular sectors.

The code of practice model is one that I think is also getting more attention now. This is the idea that perhaps some sectors could work together to develop codes of practice around certain types of information collection use and disclosure within the context of their particular operations, and that this could somehow be developed in consultation with the OPC and approved by the OPC. You would start to shape norms and guidance around particular sectors under the umbrella of one law and one commissioner. It seems to me that this would be a preferable approach to dividing it up and having separate laws.

The other thing, of course, is that some companies start out being brick and mortar companies, then go online, and then they develop apps. Businesses are constantly changing in terms of their information practices and needs.

[Prof. Florian Martin-Bariteau]

I have nothing to add.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay.

Mr. Karanicolas.

[Michael Karanicolas]

[Inaudible—Editor] against relying on market incentives or thinking that companies that have a direct interest in keeping their users' information secret or following better practices will necessarily do that. Ashley Madison is a great example of a company that had a direct interest in having strong security and strong privacy protections, had nothing good in place, and didn't follow any industry best practices to safeguard user information or protect users' privacy.

I do think that the idea of building a degree of flexibility into how—

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

If I may, I'll stop you on that example. I'm not familiar with exactly how that breach happened. Was that a failure of legislation or just a failure of that particular company?

[Michael Karanicolas]

Certainly, it was a failure of that company, but I think you could say that the fact the company was allowed to operate the way it did, with such shoddy security practices, was potentially a failure of legislation or a failure of enforcement, in the sense that there were basic security mistakes being made that weren't necessarily being monitored or followed up on.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Kelly.

We now move to Mr. Long, please, for five minutes.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Thank you, Chair.

Welcome back to some of our guests, and welcome for the first time to Mr. Martin-Bariteau.

Mr. Karanicolas, I want to start with you with respect to meaningful consent and how that relates to children.

I talked about this at our last committee meeting, too. I have friends with younger children. We were at their place last weekend. The children were on their computer going through things and clicking on this and clicking on that. What protection does PIPEDA need to ensure that our children are being protected?

I'll start with you, Mr. Karanicolas, and go to Ms. Scassa after that.

[Michael Karanicolas]

It's well established to have different rules in place for protecting children in terms of gathering their information and tracking their information. I think there's a huge challenge online in implementing that, because it's quite difficult, I think, in terms of people who navigate to a particular website to know how old the users are. You can require them to enter their birthdate, but again, that's not a particularly difficult hurdle to overcome—

[Wayne Long, Liberal, Saint John—Rothesay, NB]

I'm going to jump in there, if you don't mind.

One of the articles I read recently stated that a lot of U.S. websites have more tracking software on them for children than they have on sites for adults—the clickbait. Again, what can we do to ensure that our children are being protected?

[Michael Karanicolas]

Because you can't necessarily know how old the person is who's on the website, I think the best option is to look at those websites that are directly targeting children, or that have a target audience geared towards younger web users, and to maybe expect a stronger standard to be imposed on them.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Thank you.

Ms. Scassa.