Information & Ethics Committee on Sept. 25th, 2017

[Owen Charters]

I would just add that the problem is that young people check the box without recognition of.... I'll give you the opposite example, which is that I think, as an adult, many of us feel guilty for not having read all the terms and conditions, at least for a split second before we check the box. We know we should have. I don't think young people who have grown up using the Internet think twice about the fact that they checked that box. Checking that box gives them the access.

Yes, I'd love to have a broader debate about consent and what it means, but at the very least I think there needs to be an acknowledgement that the momentary split-second reaction that I should read those, that I should know.... There have been humorous examples of sites that have popped up saying, “You've just agreed to buy a flock of lambs”, or whatever else, and “Maybe you should pay more attention to these terms and conditions.”

At least in these cases, we need to make sure there's a second thought given to the idea of consent.

[The Chair, Conservative, Bob Zimmer]

That's time, Mr. Weir.

The next seven-minute round goes to Mr. Saini.

[Raj Saini, Liberal, Kitchener Centre, ON]

Good afternoon. Thank you very much for coming here today.

I want to pick up on this idea of consent. I don't want to kill the idea totally.

Some people have suggested that maybe consent should be defined differently, in the sense that there should be a model of consent to which all these service providers or the people who are using the data could agree, with a certain stipulation of agreed-upon rules whereby that model would be defined clearly for all those companies. Then, if a company or an organization were to step outside of the rules, they would highlight which rules, first to make for less reading but also to be more specific about how they were going to use that information differently.

Now, I know, Ms. Bailey, you're not a huge fan of consent. I'm just trying to see—

[Prof. Jane Bailey]

I'm a big fan of consent. I just think that in some circumstances it isn't realistic, and I'm afraid this is one of them. It's interesting to have service providers agree on a model of consent, but what that means is that they're going to have to agree on what algorithms are going to do. I actually don't think that's feasible. I'm a professor, so feasibility isn't usually a big deal with me. I usually put feasibility to the side and talk about principle, so here I am using my own argument against me.

First of all, I'm not sure that's feasible. Even if there was going to be agreement about what algorithms will do and what they won't do, most service providers don't want to disclose what their algorithm does because it's how they make their money. There's an intellectual property there that they don't want to share.

I worry that the more we build up people's idea that we shouldn't worry because we've taken care of consent, the more we'll lose sight of the fact that we're dealing with something that is so difficult to know. Maybe if we thought about regulating the processes by which information is being dealt with, then we could say we've created an environment where consent or informed consent actually makes some sense.

[Raj Saini, Liberal, Kitchener Centre, ON]

Is there anybody else?

[Kristjan Backman]

I just say good luck.

[Voices]

Oh, oh!

[Raj Saini, Liberal, Kitchener Centre, ON]

The second question that was raised was the question of penalties. Right now, as you know, the GDPR is going to come into effect next year and we will have to analyze our own privacy controls in regard to that. Right now, in the GDPR there are two levels of penalties. One is 10 million euros or up to 2% of annual revenues, and the second level is 20 million euros or 4% of annual revenues.

How are we going to adjust that because, obviously, there's a huge discrepancy between European companies and Canadian companies. That's what the level of the penalties are right now, and I know that we're nowhere close to that. How would we...?

[Kristjan Backman]

I think Canada has to make choices as to what will work for Canada. We don't have to take the United States model. I don't think that's necessary.

[Raj Saini, Liberal, Kitchener Centre, ON]

It's the GDPR model.

[Kristjan Backman]

Or the GDPR model. We have different cohorts, different regulations and rules. We can set our own, but it should be meaningful and it should have enough teeth to make sure people comply with it. You can tier it, you can do all sorts of things there. It can be an absolutely “made in Canada” model for sure. I don't think we have to take the European model and say 4% and 2%. That's your job.

[Raj Saini, Liberal, Kitchener Centre, ON]

Ms. Bailey.

[Prof. Jane Bailey]

I agree with that.

[Owen Charters]

We haven't really thought deeply about it.

[Raj Saini, Liberal, Kitchener Centre, ON]

Okay.

Mr. Backman, one of the things you wrote is that you had an amendment for PIPEDA that would require an organization to destroy data once it was no longer needed. Can you give us an understanding of how someone or how an organization would come to the conclusion of when they felt the data was no longer needed? I think that's very subjective.

[Kristjan Backman]

In lots of industries it's not subjective at all. Certainly, CRA has rules with regard to how long you're keeping.... Financial institutions, the doctors, the lawyers, all have governing bodies that assist them in developing document-retention policies. There's a reasonableness test there, that when you reasonably no longer need that data, it's time to make it go away, unless the law says you have to keep it for a longer period of time.

Coming up with a policy for when documents should be destroyed is not a difficult process at all. Most companies have a retention policy as to how long they're going to keep documents. That's not the biggest hurdle there, for sure.

[Raj Saini, Liberal, Kitchener Centre, ON]

Ms. Bailey.

[Prof. Jane Bailey]

It's kind of like the current provision that talks about accuracy and completeness in the principles in PIPEDA. It's because it's kind of amorphous that it becomes difficult to use it or to know when an organization is.... In some cases, no. Maybe in health care, no. Maybe in the context of health care, or those kinds of situations, you might be able to know.

[Raj Saini, Liberal, Kitchener Centre, ON]

As a pharmacist, I know we have to keep prescriptions for two years.

[Prof. Jane Bailey]

Right.

In the online context and the data that's being kept by service providers, it's supposed to be accurate and relevant to the original purpose for collection. If the original purpose for collection is to use it to create aggregates for marketing, then when does it ever not become relevant? I think it is difficult to do that. I think the reason these principles are general is that to say something specific would not work for all the kinds of data you're dealing with.

[Raj Saini, Liberal, Kitchener Centre, ON]

Ms. Bailey, you've written quite extensively on young people, and one of the things you've written is that they should be included as part of the conversation. When should they be informed? At what age, roughly, should they be asked to be part of the conversation?

One of the things you wrote was that “Young people have...strategies and norms to mitigate this danger”. I want to get an idea of what you meant by that.

[Prof. Jane Bailey]

One of the first times that young people testified in a formal hearing, either in the House or in the Senate, was in the conversation around bullying and cyber-bullying. I think that is a really interesting model of bringing forward young people to engage and to testify.

I'll put in a plug for what our youth summit, the eQuality Project, is planning in 2019. We're hoping to bring young people together to talk about the Internet and what they want.

[Raj Saini, Liberal, Kitchener Centre, ON]

Is that before October 2019, or after October 2019?

[Prof. Jane Bailey]

It is in 2019.

We're hoping to bring young people together to talk about the Internet and what they want, and privacy will be a big part of that. If any of you would be interested in being part of that, you can let me know.

However, that's an informal process. We should start thinking about formal processes that look a lot more like the human rights committee in the Senate, where hearings were held on bullying and cyber-bullying. These things do directly affect young people, and they often affect them in different ways than they affect adults.

[The Chair, Conservative, Bob Zimmer]

Thank you, MP Saini.

MP Gourde, you have five minutes.