Information & Ethics Committee on June 1st, 2017

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Thank you very much.

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

Thanks very much.

Our next seven-minute round of questions goes to Mr. Jeneroux.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

Thank you, Mr. Chair, and thank you, everybody, for being here today.

I want to start with you, Mr. McKay, and dive a little bit deeper into the right to be forgotten. We've had a number of witnesses before us here at committee who've weighed in on it. We're waiting for the Privacy Commissioner to provide his fulsome analysis of it, but we're hoping to get as much from a variety of sources as we can, you being an obvious one.

When it comes to the right to be forgotten, or the right to erasure in some cases, how do we determine where and who should be forgotten? You mentioned elected officials. There have been a number of cases where I'm sure certain elected officials would like to have their pasts forgotten, none around this table, of course, but certain other ones. I feel that it's also imperative in certain cases that the public know what's out there.

I guess Google's approach to the right to be forgotten would be helpful to us when drafting our report.

[Colin McKay]

The right to be forgotten, as it's identified and implemented in Europe, is problematic because it effectively creates an administrative role for Google, as a private sector corporation, in deciding what information users can and cannot see, but it doesn't remove that information from the Internet. We're placed in the uncomfortable position of staffing up and running an office that then makes a decision about whether or not a request to delist a URL from search results is in fact appropriate, based on the laws of 21 different jurisdictions.

You're very right. As was mentioned by Ms. Bourne-Tyson, there are people who have childhood criminal records or were indiscreet in university, and then there are people who have explicit corruption convictions or other violent crimes, or more simply, who have a history of poorly stated and poorly thought out political or personal beliefs. It's a difficult role for the private sector to be the adjudicator on that.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

The camera's on you.

[Some hon. members]

Oh, oh!

[Colin McKay]

Or it would be in the Canadian context. Part of the challenge is that this right has been created in lieu of having a serious civic conversation about when information should become opaque to users.

If we have a requirement for administrative decisions to be made public in a specific context, the right to be forgotten tries to create an end run around that by obscuring that information again, rather than having a fulsome conversation around whether there should be a time limit on making that administrative judicial information public, and around whether bankruptcies should have an expiry date in terms of publicity as well as relevance to your credit record.

That's why, in my admittedly short remarks, I made the observation about it needing a full dialogue. It's not just a question of a deliberation as an element of a possible revision to PIPEDA. It's actually a full dialogue around what we expect in a democratic society around free expression, the retention of records, and the retention of information about people in the context of both legal and public proceedings.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

I appreciate that. In following the line of questioning of my colleague Mr. Long when he spoke specifically about kids, it's one thing to have set up a family link app. You mentioned it's not in Canada yet. It sounds interesting for that type of enforcement, but still that doesn't stop them from going to school and having another kid, who doesn't have that similar set-up, take a photo, upload it, and boom, it's part of the public record.

I want to shift a little to a witness we had here, Dr. Michael Geist. He brought up algorithmic transparency. He suggested that should require search engines and social media companies to disclose how information is used to determine the content displayed to each user. I'm curious about your thoughts on algorithmic transparency. Do you think it's feasible?

[Colin McKay]

We already try to provide that information to our users, in the context of that recitation of websites that I mentioned in my account, where underneath that you can see a record of your location history, your search history. You can see how we've made decisions around what advertising you should see, based on broad categorizations that are based on the search behaviour and ads you click on within our properties.

Rather than discussing algorithmic transparency, we need to focus on the outcome of that process. Does that outcome demand intervention or does it demand supervision? You have to have a measure of the levels of harm, and an idea if you're seeing outcomes that are detrimental to the individual.

It's difficult to say that algorithmic transparency, in being able to see outside the box and see the gears, will reveal anything. In many cases the inputs that are coming through the algorithm change are on a near-instantaneous basis, providing immediate results. Understanding both the information that's being collected, which is already a requirement under PIPEDA, and then understanding the outcomes is more relevant to the challenge we're trying to face, which is the individual user's understanding of their interaction with the box and the system, and then how that is influencing the information that's presented to them.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

Do you keep certain algorithms private in, say, a competition place?

[Colin McKay]

Yes, they're all considered corporate assets. There's an example of when we were a young company and all we had was a search product. Larry and Sergey, our founders, published a paper about the page-ranking system upon which the search product was based. Just the process of publishing that paper gave spammers who wanted to game the search rankings and get a higher ranking for their services enough information to start skewing the results.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

Okay. I'm done.

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

Thanks very much.

Our next seven minutes go to Mr. MacGregor.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Thank you very much, Mr. Chair.

Mr. McLinton, the committee received a letter from the commissioner, and in that letter the commissioner identified a few concerns. It was a fairly lengthy letter, and it goes over the current state of the laws today. One sentence stood out for me. He wrote:

Technology and business models have changed so significantly since PIPEDA was drafted that many now describe the consent model, as originally conceived in the context of individual business transactions, to be no longer up to the task: 90% of Canadians are concerned that they no longer have control of their personal information.

I'd just like to have a quick response from you on the commissioner's concerns.

[Jason McLinton]

I can only speak again from a retail perspective, and say that it's not in the retailer's business interest to do anything but be clear and simple with regard to the collection of consent, in the news that they didn't treat it appropriately. From our perspective it's a model that's been working quite well.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

You said you feel it's better that we have a trust model and no increased enforcement powers. The commissioner's gone on to say that his predecessor did ask for stronger enforcement powers under PIPEDA, and that he has made it known to the committee that he's going to be asking for order-making powers under that act. You're not in favour of the commissioner's approach?

[Jason McLinton]

I'm not specifically familiar with that enforcement power—

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

It's like order-making powers and the power to impose administrative monetary penalties.

[Jason McLinton]

Without knowing the specifics of that, I am familiar with order powers and AMPs generally. I would say that our members would not be in favour of that for the exact reasons I expressed during my testimony, that right now under the current arbitration-type model, because of the shared goals that retailers have with the Office of the Privacy Commissioner, they can be very forthcoming with the information that they provide as opposed to being in a more formal legal context where they perhaps would be given advice where they couldn't be as forthcoming. I think in the end that would probably accomplish, at least in our context, the opposite of what's intended, that you would get less done with a more legalistic approach to things as opposed to a collaborative arbitrary approach.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

It's noted here that the information and privacy commissioners of Alberta and British Columbia, which is my home province, do have order-making powers. Have any of your members related to you their experiences under those provincial regimes? Are you familiar with them at all?

[Jason McLinton]

I'm not familiar enough to comment on it. I did have conversations a little bit with regard to the fact that other jurisdictions, as I mentioned in my comments, do have privacy legislation. The feedback I received was that what's currently happening is working well, in that provinces and the federal government are speaking with each other and exchanging information, and that this is something that's working well, because it's avoiding multiple reporting requirements. But in terms of order-making authorities, I didn't engage in that conversation.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Okay, thank you.

Ms. Bourne-Tyson, in your opening statement you made a reference—and this is in the context of the right to be forgotten—about people trying to delist previous criminal records. I don't know if I caught it. Would you mind repeating what you stated about that, about a person's criminal past and the right to try to remove any links to that?

[Donna Bourne-Tyson]

I'm going to pass this to my colleague Susan.

[Susan Haigh, Executive Director, Canadian Association of Research Libraries]

This was in the context of a specific example that we were citing, just something that arose within our context as a research library where a thesis.... It was content that was embedded in a chapter in a thesis that somebody had authored, of course; and the thesis is put up on the Internet as part of the public record, as part of the research record, if you will, on open access. The request had to do with the fact that the individual had turned his life around, and the family came forward with a request that the whole thesis be removed from public access.

Libraries make these judgments on an ongoing basis. The judgment that was made at that time was that this was legitimately researched. It was responsible content. It had been through the ethics board to start with and, of course, there was the degree granted that it was part of the public research record. The request didn't come from the rights holder, which can change things a little bit in terms of takedown. The decision was made that it would not be acceded to as a request.

What we were really trying to illustrate, though, is that there are dimensions of this issue, that it can get complicated, and that's part of the nuance we're aiming to suggest is necessary.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

I'm curious, and I'll open it up to all the panellists. When someone has gone through the effort and served the appropriate amount of time after having received a criminal record and has applied for a record suspension, how does the removal of the criminal record officially—so that potential employers won't have access to that anymore—interact with someone maybe having a record of that criminal act still online somewhere? Does anyone have any information on that?