Evidence of meeting #54 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
If we're dealing with that on the contractual model, does that really mean just a longer consent form and document? Or is there a way to do it that doesn't involve making the consent form more cumbersome?
Conservative
Advisory Consultant, Risk Masters International Inc., As an Individual
I think the consent model would be difficult to do. Just making it longer, with more and more consent—
Principal, David Young Law, As an Individual
Could I have 15 seconds to respond?
Conservative
The Acting Chair Conservative Pat Kelly
We're over time. I'm sorry. We may get back to that with another question.
It's now time to go to Mr. Saini.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Thank you very much, all of you, for being here today.
I just want to pick up on the right to be forgotten. There's been a lot of discussion on that, even going back to previous meetings. Some people have said that it couldn't stand a charter challenge.
If we leave the main premise alone, what is your opinion on the right to be forgotten for children? Do you think there should be some provision up to a certain age, if children have posted things online? What's your opinion on that? Should we have some provision for that?
That question is to all of you.
Ian Kerr
First of all, one of the points that hasn't been mentioned today, but I think has come up in previous testimony, is that even if we put aside the grandiose right to be forgotten in the European sense, PIPEDA and privacy legislation across Canada, the principles that we've referred to so many times, already include a principle about data accuracy. In situations where there's data that's untruthful or that is misleading about people, we already think that the privacy law suggests there should be a form of redress.
As I think Professor Florian Martin-Bariteau and Professor Teresa Scassa talked about, the idea of a right to erasure of wrongful information that's online could be fortified. My view is that it's already covered under the existing principles, but it may be the case that in the context of social media and young people, we ought to use that as an anchor in, to talk about something much less grandiose and vague than a right to be forgotten and something much more specific that protects children. I think we should do that.
Principal, David Young Law, As an Individual
I would certainly agree with an enhanced or a conceivable statutory right to be forgotten for children. As you'll see in my brief, I think we have a right to be forgotten. We don't know the scope of it, because there are two cases going to the Supreme Court that will articulate that in the next year. That's where I think we have to treat very carefully the general right, because I think we have it, frankly. Ian mentions accuracy. You can withdraw consent. Consent is the right to tell somebody that they can no longer use your information and can no longer keep it: delete it.
The simple answer to your question is “yes”. We've had constitutional issues with legislating children's rights for a number of reasons, but I don't think it's an insurmountable issue.
Advisory Consultant, Risk Masters International Inc., As an Individual
I believe in withdrawing consent and I believe in the right to be forgotten. With respect to children, I haven't gone into the details, but in the United States, COPPA, the child online protection act, does provide some protection, for children 13 and under, from the information that they are likely to provide or do provide to an Internet service provider.
As I said before, it's difficult to get all the instances of that data removed from throughout the organization, particularly if that data has been sold to other organizations. I think it's a good idea to be able to withdraw consent and also to have the right to be forgotten. I see technical challenges.
Full Professor, Director of the Centre de recherche en droit public, Faculty of Law, University of Montreal, As an Individual
I'm not sure that I'm in favour of a specific right for children, such as the right granted recently by the Europeans. The law already allows us to remove certain data when the damage is greater. It's true that the situation of children is more sensitive. The data can already be removed in certain cases.
I would also say that solutions exist. Facebook, for example, is very responsive and is already very good at removing problem images and videos. The company is extremely effective because it controls, in spite of what it says, the social media. It can limit the damage by removing the data and images of children. It's not a problem situation.
Liberal
Raj Saini Liberal Kitchener Centre, ON
I have another question that I wanted to get your opinion on.
Currently, the websites we use are indexed automatically and are unindexed only upon request. Do you think there might be some provision, or that it would be a good idea, to do it opposite to that, so that you would have an opt-in system to secure privacy rather than an opt-out system? Would that be ideal?
Ian Kerr
I think that is one of the issues on which one might have a principled view and the technical implementation of it would undermine any idealism that one might have, so I'll be a bit deferential in my response.
I am generally of the view that all default settings should default towards privacy. That's the problem that happened when Facebook put in its privacy settings, which I complained about previously. I think that's especially true in the context of an Internet that always remembers everything. The first book by an academic to be written on this subject was Delete and was about this idea of the importance of finding proxies for forgetting in an information age.
The suggestion you make would go a long way towards that, but I think it would also make for a fairly unusable environment online. I don't know how to actuate that through prescription. That would be an example of where the law could really undermine the other kind of code, software code, by making that sort of prescription.
That said, I think that as you work through these issues with your committee it's absolutely essential that you think carefully about how we make the defaults always towards privacy. That would be one way to try to do that.
NDP
Principal, David Young Law, As an Individual
In terms of what Ian is talking about, I think, an idiom in the U.S. that has been talked about for a number years is called “do not track”, which is a default setting. It basically says that for all this data collection that you.... Any time somebody goes to a website, data is being collected, whether you actively or passively provide it. Now the rule is basically an opt-out rule: you can opt out of it if you're given notice that it's happening. The converse is “do not track”, and really, that's the most protective rule—
NDP
The Vice-Chair NDP Daniel Blaikie
I'm afraid that's Mr. Saini's time.
We want to make sure that Mr. Kelly has his full five minutes to ask his questions before the end of the meeting.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Thank you, Mr. Blaikie.
I'd like to return to some of the more provocative statements that you made in your testimony, Professor Kerr, and perhaps ask the other witnesses to comment.
You spent quite a bit of your presentation talking about the perhaps frightening aspects of AI decision-making. You invoked Orwell, which some do when talking about the power to know and follow people's activities. There's an important distinction, though, which certainly wasn't lost on Orwell, when information is collected, tracked, or used for a nefarious purpose by a government, rather than by private actors who presumably act with consent. We've heard about all the different challenges the consent model has, in particular with regard to children.
You talked about “a duty to explain”. It occurred to me that a lot of the problems that maybe some would have around the challenges you've mentioned are dealt with through.... When we're talking about private businesses and private actors, as long as there's choice, does that not allay some of the fears that one would have?
I'd ask some of the others to comment on that, as to the distinction between a government collecting information and then being careless about people's privacy versus businesses with which one could choose not to deal.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Sure.
I'll let the others go first and we'll try to make sure we have time.
Advisory Consultant, Risk Masters International Inc., As an Individual
I think if you look at the choice model, yes, you can choose certain things, and that should allow you to “opt out” of having information processed in a certain way or kept on your behalf. I think that's a relatively good model, but it doesn't work in all cases.
Another example, just to go back a bit, is the fact that if you want to be forgotten, you can't on the Internet. I use Facebook very minimally. I don't put any pictures on Facebook. However, my picture is up there and it's tagged, because someone else put it up there and tagged it. It's so omnipresent now. You can take certain items off there, but no matter what you select as your choice, it's out there.
Principal, David Young Law, As an Individual
I think the biggest problem with pure choice is that it resolves to an opt-out idiom. The choice is usually given—here are the options, maybe it's given clearly—and if you don't choose one of them, you're in.
I can tell you that in the private sector world that's the reality. It's an opt-out reality, not an opt in. If sufficient notice, transparency, Ian's thesis—I don't disagree with him—is made clearly, then the choice should be totally possible. I agree with it.
However, I think as a reality, it's not done effectively. That's what they talk about with meaningful consent. You've heard this a myriad of times, I know. It's a big challenge, but it's not insurmountable. It will never be perfect, but it's not insurmountable.
NDP
Full Professor, Director of the Centre de recherche en droit public, Faculty of Law, University of Montreal, As an Individual
Regarding the consent model, I'll simply repeat that I don't think it's necessarily a matter of choosing between opt in and opt out, although that may work in some cases. The issue has merit, but the fact remains that we rely too often on a model based on consent when the consent is fictional. Other solutions exist, such as an examination by an organization such as the Office of the Commissioner.
The Vice-Chair NDP Daniel Blaikie
I know, but we already gave a little extra time.
We're going to go to Mr. Long for the rest of the meeting, which is only about two minutes.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
Thank you, Chair.
I want to drill down a bit on meaningful consent. Again, I stick to this line every time I question, but with respect to children and meaningful consent, I've read in some places that potentially under the age of 13 you have to have parental consent, with 13 to 15 maybe there's a blend, and 15 and up.
Mr. Young, can you comment on what you deem is acceptable for meaningful consent?