Evidence of meeting #68 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was online.
A recording is available from Parliament.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
Thank you, Mr. Chair.
I would also like to thank the witnesses for being here.
I have concerns about big data and the fact that many organizations can collect it on all Canadians in different ways, with or without their consent.
Can Canadians request that their personal files become shadow-files again and that the big data on them be erased? Can Canadians demand that?
Prof. Jane Bailey
Under the current law, no. Then I guess the question is whether you are saying that erasure of their files is something that Canadians ought to be able to demand.
If you go back to the principles—and I want to use the right terms—accuracy, completeness, and being up to date, there are principles that require organizations to consider whether the material they're holding is accurate, complete, up to date, and still necessary for the purposes for which they're holding it.
They collected it. There is some case law of complaints around people saying that their file ought to have been erased and it wasn't. It was no longer accurate or complete. That may be a mild form of the sort of right you were talking about, where you're asking to have your file deleted completely.
Young people we talk to want to be able to go to Facebook, for example, when they're finished with Facebook, and say, “I'm not just closing my account, I want the record of my account deleted. I don't want you to have a backup of that on a server somewhere.”
We've talked to young people who said they would very much like to have the right to do that.
Conservative
President and Chief Executive Officer, Boys and Girls Clubs of Canada
I've been CEO of an online fundraising company, and I can tell you that, technically, it's entirely possible to erase a file. The engineers who handle the coding can add an option or something else to the server. It's entirely possible.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
Mr. Charters, since you represent an organization for youths, I will continue to ask you some questions. Today, a lot of data is collected on youth, even those under 13 years of age, because they are very active on social media.
Could the information that can be obtained through their personal profile harm them in the future?
Director, Research and Public Policy, Boys and Girls Clubs of Canada
The answer is yes. I have a teenaged girl. I have seen the ads that show up on her Facebook profile. These are things that affect self-esteem or ads for beauty products. It is assumed that teen girls aged 13 or 14 are concerned about their weight and their appearance. It is causing them harm now and could also harm them in the future. I think it has an impact.
That's why it's important to consider the option of erasing data when young people reach the age of majority. They may have the chance to get their acts together or at least use social media by starting from scratch.
President and Chief Executive Officer, Boys and Girls Clubs of Canada
It's also a question of employability. As we know, teens are forming their personalities. The same thing happens when an adult makes a decision. The young person wonders who he is, what he wants to study or what job he wants to have. I think it's very important. So the answer is yes, absolutely.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
Young people aren't generally aware of the fact that one click can have an impact on their personal image.
President and Chief Executive Officer, Boys and Girls Clubs of Canada
Exactly.
Director, Research and Public Policy, Boys and Girls Clubs of Canada
I consulted with our youth council and talked to them about this before we drafted the letter that we submitted to the committee. In fact, it seems that young people don't think about the consequences. They weren't really interested in the topic and hadn't really thought about security issues.
I think the consultations should include an education component. If we want young people to get involved and have informed opinions, they need to know what's going on. I am sure that some young people are aware of this but, generally speaking, they haven't given it much thought.
Conservative
Liberal
Mona Fortier Liberal Ottawa—Vanier, ON
Thank you, Mr. Chair.
Since today is Franco-Ontarian Day, I will continue in French to make sure that we can hear you.
First of all, I would like to thank you for your presentations, which were very interesting. Since many colleagues have already asked the questions I wanted to ask, I will instead talk about retaining and destroying personal information.
Mr. Backman, my understanding is that the industry was concerned about the costs of retaining or destroying information. Could you tell us about the actual costs and processes that can affect the industry in this regard?
Chair, National Association for Information Destruction - Canada
Sure, I can be general on that.
There are steps that good businesses take to protect the information of their customers and their employees, for example document destruction, shredding the paper documents that are in there, and dealing with their old electronic devices, their servers, their PDAs, their cellphones, things like that. These are not onerous costs for a business.
For small companies, it would be in the range of several hundred dollars a year. In large corporations it might be significantly more than that, but again, it's a very small fraction of the cost that it took to manufacture that information, and I like to look at it that way. When you look at the cost of creating the files and collecting the information, storing it and analyzing it, the actual cost of disposing of that information is a very small fraction of the amount it cost you to aggregate the information in the first place.
There's no cost to the destruction of data that is prohibitive to doing it properly. The industry is remarkably competitive across North America, so there's no issue there where a company would be making a choice other than pure bottom-line dollars to not do it correctly.
Liberal
Mona Fortier Liberal Ottawa—Vanier, ON
Thank you.
I was concerned, for businesses, that it was a barrier to good data management, especially when it comes to retaining it or destroying it.
We have also talked a lot about Canada and some practices around the world. Should we consider other practices outside of Canada, or other measures from your analysis that we may not have had the opportunity to review?
Ms. Bailey, do you want to answer first?
Prof. Jane Bailey
Generally, in the area of privacy, I think of the EU as a leader and the reason for that is that they treat privacy as a human right. I think when you come at privacy as a human right, you start to see things a little differently and when you look at a market like digital communications, for example, you start to understand the costs associated with maintaining privacy are costs that are associated with respecting and honouring basic fundamental human rights.
The EU has been a leader in that regard and I think they have been courageous in the face of industry. When industry has made threats and said things were impossible, they have gone ahead and stood their ground and said we have a job to do and protecting basic human rights is one of them and here is our bottom line. It's the same as we've done with environmental issues. For instance, paper companies used to like to dump garbage into rivers. We said, you'll have to stop that and they said, that's going to cost a lot of money. We said, okay, because as a community, basic access to safe water is a fundamental part of who we are.
That's a long-winded way of saying that I do look to the EU. I think COPPA in the U.S. is a really interesting mechanism for protecting children's rights as well.
Liberal
Mona Fortier Liberal Ottawa—Vanier, ON
I slotted this time for whatever you wanted to add, but if not, that was my question. Did you want to add?
Chair, National Association for Information Destruction - Canada
I'll just add that in 1990 when we passed PIPEDA, Canada was the forefront of privacy legislation. We moved the needle across the globe and in a lot of ways the GDPR is the next step of our initial legislation. It's just that we went to sleep on this for 20 years, so it's time.
Conservative
Peter Kent Conservative Thornhill, ON
Thank you. I'll split my time with Mr. Gourde.
My question to all of you is this. Given the rapid pace of technological development, do you have thoughts or concerns about the cloud as opposed to device-stored or corporate-stored or hard-frame stored data and information? Can one ever absolutely be sure the information that an individual wants to be destroyed will be absolutely destroyed?
Chair, National Association for Information Destruction - Canada
I think we can have the policies in place to protect the consumer if their information is not destroyed properly, but I don't think you can protect people from bad actors who aren't handling the information properly. There's going to be those people out there. The question is, when you find those people, what does this legislation do and how does it prevent other bad actors from acting similarly? Can we find them? Can we rectify the situation and can we make an illustration to other people not to act that way?
Conservative
Chair, National Association for Information Destruction - Canada
I don't think it's significantly different from content that's sitting on a server in my office or in your office or here. The information is the information, where it resides I don't think makes that much difference.
Prof. Jane Bailey
When the word “cloud” started circulating and people were getting all crazy about the cloud and worried about the cloud, someone very high up in the industry said, I just laugh when people talk about the cloud. What is the cloud? The cloud means that your data is stored on a server in some remote location. It's not actually in the ether, so giving us that sense that we can't regulate clouds.... One of the problems is that it will be a jurisdictional issue. Where physically in the world is this server situated? That is an issue.
