Information & Ethics Committee on May 16th, 2017

[Dennis Hogarth]

In the day of big data, and even before big data, the issue is basically that organizations should set a time limit on what is a reasonable retention period for information. Even in a big data environment, there are tools that can be implemented to tag data and set a time limit or some other criteria on it. We are going to have to move into that world as we move into big data. We can't get into a big data world that is totally uncontrolled in any way, shape, or form. There are technology tools that allow the use of big data and allow the assembly of big data databases. There are also tools that basically allow control of the big data, and those need to be implemented.

[The Chair, Conservative, Blaine Calkins]

Thank you.

We'll now move to a five-minute round, beginning with Mr. Kelly.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

I'll begin with you, Mr. Hogarth.

You talked about the different types of consent and the need to differentiate between that which is particularly sensitive and that which is maybe less so.

Are there currently specific failings of PIPEDA as it is now that need to be addressed? In the concerns you've raised, what are the current failures that are preventing the types of better treatment of information and different types of consent?

[Dennis Hogarth]

I don't think it's a case of better treatment. PIPEDA is very explicit when it comes to issues of sensitive information. Quite frankly, I'd have to think about what other things and areas might need to be added.

Certainly, there are some people who consider their address a piece of sensitive information, as is their cellphone number and, increasingly, this information that can identify them, such as your identifier on your cellphone. The way that your cellphone can actually be tracked could be considered sensitive information.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay. Is there something specific that you would want to see? What's your one change that you would want to see under PIPEDA, then?

[Dennis Hogarth]

I'd like to take that away and think about it, but I'd pleased to do that.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay. Well, maybe if I get the next five, I'll try again, but if you could think about it....

[Robert Watson]

Excuse me, can I just...?

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Sure.

[Robert Watson]

Just as a practical situation with regard to your last question about cellphone number numbers and email addresses, people are wanting to keep these for life. You now can take your cellphone number anywhere in Canada and keep it. It'll go with any other carrier for the rest of your life if you want. Your information has to stay at the original carrier and at your new carrier. That's how it works. Your email address and that information you want to keep as your email address has to stay at the original email provider and your new email provider, however it goes. There's a practical application to this consent idea.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay. We're studying PIPEDA, and hopefully we'll get to a report that will recommend changes. Is there an existing impediment? Or are there changes that you need, and that you think need to be made to the law as it exists now, in order to facilitate these expectations that perhaps customers have and in order for the mechanics on the side of business to be able to comply?

[André Leduc]

When it was drafted in 1999 and introduced in the House, and then through enactment in 2001, I think that at that time we were clicking through websites and we weren't using these devices quite as much. I would venture to say that the pace of life was just a little slower.

I think the biggest thing is what you are studying: is consent the appropriate vehicle? If there's one thing that is worth reviewing in PIPEDA, it's what the value is of somebody actually clicking through consent when they don't know what they're consenting to. Should we be looking at another model of forgoing that step in the process to go more with a “reasonable use and reasonable person” test to evaluate what you should and shouldn't be collecting, or what you're able to collect, and how you're going to use and disclose that data after the fact?

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay.

Maybe I'll shift gears completely with the time I have left and ask you, Mr. Watson, to talk about what you mentioned earlier, which was the importance of making the distinction between criminal activity and the use of information by businesses. You said that no matter what regulation you might put in place to protect businesses, which have their own interest in avoiding reputational damage and all of this in complying, as an activity distinct from that of actual hackers and those who don't care about any of the foregoing.... I'll let you expand on some of that, because it seemed important to me.... PIPEDA is not the Criminal Code. This perhaps isn't where we address some of these activities that impact privacy.

[The Chair, Conservative, Blaine Calkins]

Mr. Kelly has used all of his time for his question, so please give a very succinct answer, Mr. Watson.

[Robert Watson]

It's simple. There are two ways for cybersecurity or cybercrime to happen. One way is with existing information sitting somewhere, but more and more lately, it's actually when you're doing the transaction that they get you. It's not historical data.

[The Chair, Conservative, Blaine Calkins]

Okay.

Mr. Long, please, if you can keep it short.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Thank you to our presenters this afternoon. Again, it has been very interesting testimony. The more we hear, the more we learn, and the more questions we have, I think.

I think my first experience with the right to be forgotten was—and I promise this won't be my bedbug story with the Saint John Sea Dogs—in 2005-06, when we did have a player who made a statement that actually caused national news. It was on Hockey Night in Canada, and I had to do certain things to try to mitigate the damage. I wasn't playing on my phone just now, I promise, but when you were talking, just for fun I googled his name, and the first thing that came up—we're talking about 11 years ago—was that instance.

I'll throw this out right across the panel. Maybe we'll start with you, Mr. Leduc and Mr. Watson. Can we forget about the right to be forgotten?

[André Leduc]

I wouldn't suggest that you forget about it. You also need to look back into the pre-Internet world. If something ends up in a newspaper, it goes on microfiche and is still accessible. It's just different in the way that we access it now. We're using a search engine and going to the Internet, so it's more readily available than it was then.

From a legal standpoint, the rule book shouldn't change because we have the Internet. The person made those statements, and whether a judge would afford them the right to be forgotten in those circumstances is what's interesting. That's why we always kind of refer back to.... When we talk about third-party reviewing, we allow it to be our judiciary who does that review. They can make the decision on whether this person will or will not have the right. It's not a simple request that I'd like to have that information taken down from the website—

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Right.

[André Leduc]

The recourse is already there. It was there before the Internet came about, and it maintains its applicability today.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Mr. Watson.

[Robert Watson]

The beauty of the Internet, which is that it enables everybody anywhere in the world to get information the same as anybody else—if you have the right connection, of course—is also the problem with the Internet. Everybody makes mistakes, and now your mistake is there.... You won't stop people from making mistakes in the future—

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Right. Just to jump in, this is now a 27-year-old man who's interviewing for jobs and having people check him out. Again, the first thing that comes up is this incident.

[Robert Watson]

Yes, immediately. Again, it's the beauty of the Internet. It's instant. In the old days, you would have had to wait. The guy probably would have been employed for a couple of months, somebody would have found it, and then he would have been done.

It's a timing issue. People will always make mistakes or have things they regret saying, or whatever. We can't keep putting in regulations to try to protect people from doing silly things.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Mr. Smith.