Information & Ethics Committee on June 13th, 2017

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

I am just seeking information about the GDPR with regard to algorithmic decision-making and the extent to which, if at all, the GDPR speaks about transparency in cases where decision-making processes are handed off to algorithms. Does the GDPR contain or foresee any rights for people to have a sense of how those algorithms work and how those decisions are made once it goes inside the black box, so to speak?

[Giovanni Buttarelli]

There are two approaches in the GDPR. The first one, which I already mentioned, relates to the right not to be subject to certain decisions unless there are safeguards. The second approach relates to transparency, and here we have a lot of novelties. This is an area where data options....will be equipped with more transparent, intelligible, concise, and easily accessible information and forms. There is a clear need to use plain language. Here we have another area where children are considered in terms of transparency—I forgot to mention this earlier.

These articles on transparency do not relate specifically to processing modalities, but by reading them in a global approach, you will understand that in the case of certain processing modalities that you mentioned, transparency should be reinforced and be effective in practice. This is largely for guidance by DP. There are some provisions concerning machine-readable icons and standardized icons, but I doubt they relate to the case you mentioned.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you very much.

[The Chair, Conservative, Blaine Calkins]

Thank you, Mr. Blaikie.

Now we just have a few minutes of open time for members who haven't had a chance yet.

Monsieur Dubourg, if you would like to ask your questions, the floor is yours, sir.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Thank you, Mr. Chair.

Buon pomeriggio, mister Buttarelli.

I heard you right at the start. I know that you speak French. I just wanted to ask you a question or two about the general regulations on data protection.

Is that okay with you? Can I continue?

[Giovanni Buttarelli]

Yes, please.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Okay.

Thank you.

I would like to ask you some questions about the powers. Here, as you are well aware—through your discussions with Mr. Therrien, among others—academia and the general public agree with giving more powers to the Privacy Commissioner, whereas businesses talk more about collaboration.

We know that, over there, you have those powers, even the power to impose fines. We saw that, in Italy, your native country, WhatsApp was fined $4.5 million.

Tell us how those powers are a deterrent in a situation of this kind. Or do you think that we should keep collaborating with companies instead of imposing penalties?

[Giovanni Buttarelli]

The two approaches are not opposite. Accountability is the right approach we request, and it doesn't mean that you should simply respect the law. We are asking now more, and let me speak for a second as a member of the judiciary, as I am.

Being in front of a court case where we may discuss to what extent the controller has been proactive, I would consider in a better way the case where he made mistakes but has been very operational. The question is not to have an emphasis on every kind of even minor mistake. I would like to see the big picture, but I would welcome the approach they recommended to you. We need a dissuasive approach.

Let me say that we are now bombarded from everywhere in the world, and if I am in Silicon Valley or in Africa or in South America, the first question is the same everywhere. What about fines?

We know that they are very serious.

I would now advise the legislators to clarify the interlink between administrative fines and penal law. This is another area. We have to clarify the so-called non bis in idem principle, so are we going to apply fines in all countries with regard to the same controller? In adopting the criteria to decide if a fine is to be applied, we have to consider the remedies considered by the subject, which is then he has been fair and dynamic in approaching a security breach, informing people after a violation, reducing the kinds of damages. All in all, data protection costs a lot, and every effort is to be considered when taking a decision.

So this is why I talk and I would defend this approach, a system where fines are to be applied where necessary, but not necessarily in every case. I'm not a lover of the Spanish approach. We call it tot capita, tot sententiae. If there is even a minor breach, there is no appeal, and unavoidably, the sanction is to be applied.

Let's look to the picture because otherwise we risk having fines considered as a budget line, and this leads also to an amount of fines because we need to graduate, we need to consider the position of small and medium enterprises, and we need to carefully consider the criteria in terms of the seriousness of the breach, the implications of a larger-scale approach. We cannot treat every breach in a single way. So we need a very dynamic approach where we use the carrot and the stick.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

I would like to ask you one final question.

You talked about the big picture. However, what has to be done to assess the situation in terms of imposing those penalties? For example, do we have to start by establishing negligence, or do we go extremes and prove that something was illegal? How do we resolve that situation?

[Giovanni Buttarelli]

If you'll give me 20 seconds to open article 83, I think this is one of the lucky provisions where we have no excuse because we have all the opportunities to consider. I'm quoting now the relevant paragraphs:

(a) the nature, gravity and duration of the infringement taking into account the natural scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; (b) the intentional or negligent character of the infringement; (c) any action taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32; (e) any relevant previous infringements by the controller or processor;

Another important point relates to the degree of co-operation with the supervisory authority to mitigate the possible nefarious effect. How many data subjects have been involved? What about the categories of personal data or data subjects involved? How has a data controller been proactive in approaching the supervisory authority to confess the breach? How do they notify them of the infringement? Are they following codes of conduct? Do they consider other circumstances, for instance financial benefits they got from the infringement?

All these criteria can be applied to four categories of breaches. We cannot treat every breach in a single way. In addition to the criteria I've just mentioned, we should also consider the seriousness of different violations so we are reasonable, we are credible. Otherwise, people would not understand.

We need to avoid a system whereby the fines are simply a budget line item for a big corporation. We need to increase the amount of fines where and when dispensable, but in the end we need to consider the amount of money and the energy that the controller, in the process, has spent on the case.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Grazie tanto, mister Buttarelli.

[Giovanni Buttarelli]

Oh. Your Italian is better than my French.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

No, no, è una parola al giorno.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, colleagues.

That pretty much exhausts the questions we have for you, Mr. Buttarelli. We want to extend our sincere appreciation for your making the time and effort to discuss this with us. As a committee we want to make sure that we get our recommendations to the government right when it comes to changing our laws here and making sure that we comply with any agreements that we need to honour as well. Your help has been indispensable. We thank you very much for your time. We trust that you'll remain available should we have any further questions.

[Giovanni Buttarelli]

Yes, we will. As I said, I'm very honoured. Tomorrow we'll appear before the Senate of this country. I hope to have the same kind of qualified audience as I noted today.

Needless to say, my office and I remain available for any specification in this case to provide accompanying documents and to satisfy any kind of curiosity as much as possible.

Thank you very much for your attention. Let me stress the high level of awareness and competence. I have long-term experience with politicians. This is not the case, so Chapeau!

[The Chair, Conservative, Blaine Calkins]

You're very kind. We appreciate that feedback, and we thank you again for your time. Hopefully, we'll keep our channels of communication open as we move forward.

[Giovanni Buttarelli]

Thank you. Have a good day.

[The Chair, Conservative, Blaine Calkins]

You as well.

Colleagues, we're going to suspend the meeting for a few minutes. There are some in camera items that we need to discuss with regard to some committee business.

For those people in the room who can be here, please stay; for those who can't, please exit as quickly as possible. Thank you.

[Proceedings continue in camera]