Information & Ethics Committee on Sept. 25th, 2017

[Prof. Jane Bailey]

That's why international agreements become very important as well as trying to have countries keep pace so that nobody becomes the lowest common denominator.

[The Chair, Conservative, Bob Zimmer]

Jacques.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

We talked a lot about youth earlier, but I would like to talk about seniors aged 60 to over 75. These people are probably more likely to get scammed through big data or emails they receive. If people are scammed once, they end up in a database and are targeted every two weeks using the same process. It repeats itself.

Have you ever seen that kind of situation?

[Prof. Jane Bailey]

I have not done work on the elderly, so I wouldn't be any more informed than anybody else who reads about all the fraudulent mechanisms by which vulnerable elderly people have money and other important things taken away from them. I couldn't comment specifically based on research.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Let's go back to youth. Surely you have some advice to give them. What can we advise them so that they pay attention to the future?

[Owen Charters]

It's a good question. For us, we have found that most fundamentally they need information frequently and often about good practice. That information exists, by the way. It is out there. I think there needs to be more resources put behind ensuring.... There was a conversation about putting it in a curriculum. There are conversations about making sure it's more widely available, and persistent, in that sense. There have been campaigns about personal information protection in general. I think we need to do a lot more to ensure that young people are cognizant of the risks they're taking on an ongoing basis.

[Prof. Jane Bailey]

I would just add that I think education is important, too, but one of the ways I'd like to see education changed in this regard is not only to educate kids how to protect themselves, but to educate kids on what their rights are and on the practices that the media industry is engaging in that infringe on those rights, and what they can do about that. How can you advocate for your rights?

I feel that's a piece that's missing because we're so concerned about protecting children, as we should be, and we forget. When we teach kids about crossing the road, we also have laws that put people in jail for running stop signs. A lot in the Internet context has been focused on telling kids how to behave instead of saying, “Let's scan the environment to see what we're doing or what we could be doing that would make it a heck of a lot easier to exist in these spaces in a way that's healthy now and in the long term.”

[The Chair, Conservative, Bob Zimmer]

MP Dubourg.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Thank you, Mr. Chair.

I would like to welcome the witnesses here today and thank them for their presentations.

Ms. Bailey, my first question is for you.

I know you are looking more specifically at the youth approach, but the system is complex. We talked about the right, from the age of 18, to erase all of their personal information and start over from scratch. What do you think of the fact that companies have information on young people under the age of 18? Should parents be given the right to erase this data at all times?

[Prof. Jane Bailey]

The other issue is that, when you talk to young people about privacy, one of the groups of people they need privacy from are their parents. This is a healthy part of growing up. They need privacy from their parents, in particular at ages when they're exploring issues around identity, whether it be gender, sexual identity, or sexuality. It's very important for them to be able to have privacy from parents on these issues.

An overarching parental right that says the parent should be the person who has the absolutely authority to makes these decisions, I have some hesitations about.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

It is true that it has become very complex. There was a time when we could block certain things on our televisions, but now young people are so skilled that we can't get around them.

Mr. Charters, you said young people needed to be informed. I don't know if you are aware of the approach that is being taken in Quebec in this regard. People from the Quebec government go to high schools to educate young people. Should such practices be extended or suggested in other situations?

[Owen Charters]

I don't know that I'm aware of the specific curriculum piece in Quebec, but we're seeing that every jurisdiction, especially in its curriculum, has come up with different approaches to this. That's part of why we've advocated for some federal leadership, because we're finding that there is real unevenness in this and we don't think it's a curriculum issue. It's not the same as math, reading, writing. Those are curriculum issues. These are about privacy, and I think they're about rights.

To Ms. Bailey's point, I think that's the fundamental piece. If we're talking about rights, then this has to happen not just in one province, although that definitely shows leadership, but needs to be something that's more consistently approached. But it may be good practice.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

All three of you agree to give more powers to the commissioner and even to go so far as imposing penalties.

Mr. Backman, given the nature of your organization, you say that this should be done, despite the fact that your clientele would be subject to those penalties.

Should penalties necessarily be monetary or could they take other forms, such as taking away the licence? Should there be a range of penalties?

[Kristjan Backman]

I think that money is probably the easiest one. It's the easiest one to target. We've had “name and shame” for years, where the Privacy Commissioner can name you and publish your information. There is certainly some reputational risk there. There have been some teeth, but you have to find something you can do, and money is certainly the thing that everybody has a little of. If you're going after something, that's the easiest. I think it should be up to you guys to craft rules on where you want to go.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Thank you.

[The Chair, Conservative, Bob Zimmer]

We'll have a three-minute round with Mr. Weir, and then that's it. If anyone has any further questions, we'll put you on the list.

Mr. Weir.

[Erin Weir, NDP, Regina—Lewvan, SK]

Thank you.

I normally sit on the government operations committee and we look at the appointment process. Given the role that the Privacy Commissioner would play in applying this legislation, I'm wondering if you have any thoughts on what qualifications or criteria we should be looking at when appointing privacy commissioners.

[Prof. Jane Bailey]

I'll go back to what I said about the EU. I think we should be interested in a Privacy Commissioner who understands privacy from the perspective of human rights. In the process of writing a paper, I was just reminded that privacy didn't make its way explicitly into the charter. Part of the conciliation for that was the creation of the Office of the Privacy Commissioner of Canada.

Someone vested with the responsibility of administering quasi-constitutional rights has to be somebody who views privacy in the context of constitutional rights from a human rights perspective and prioritizes that perspective in decision-making.

[Erin Weir, NDP, Regina—Lewvan, SK]

We've talked a little about removing the personal information of younger people. I'm wondering if panellists think there should be an upfront prohibition on the collection of personal information of Canadians below a certain age.

[Owen Charters]

We didn't argue for a prohibition, but I think it's like other questions of privacy—it has to be about what's appropriate and needed for the transaction. Since transactions tend to be pretty notional at the age of minority, this should be pretty limited. I wouldn't call it a prohibition, but it means you're not collecting very much. I think there has to be a greater understanding of what that actually means. You don't need to provide a lot of information at a young age to access a site that allows you to take your character through the maze, for example, or learn math. I think we have to consider what it's being used for.

[Erin Weir, NDP, Regina—Lewvan, SK]

I would also invite comments on the desirability and feasibility of requiring social media companies and other online providers to disclose their algorithms.

[Prof. Jane Bailey]

I think it will be a problem because they have become the fundamental basis for making money in a “data in exchange for services” market, which is what the Internet has become. Just asking them to disclose the programming of their algorithms is likely to yield some fairly significant resistance in the market. This may be one reason why it makes it easier to say there are certain things you can't do, there are certain people you can't collect information from, or there are certain things you can't do with that data once you collect it. It avoids the problem of trying to compel disclosure of something that I think would be met with resistance.

Then there's the fact that you'll have algorithms that nobody can explain to you in human terms. You can say to disclose it, but then someone will come here and.... If they can understand it, you won't be able to, and sometimes they won't be able to understand it themselves. With machine learning, that's the point. The machine is teaching itself.

[The Chair, Conservative, Bob Zimmer]

Thank you, MP Weir.

We have two others. We have five minutes left, so there are about two and a half minutes each.

MP Erskine-Smith and MP Baylis.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

First, for the Boys and Girls Clubs, you mentioned parental consent, verifiable consent. I'm not exactly sure what that means. If I were to play online poker in the U.K., for example, would they require that I send my driver's licence and see a piece of ID? What are we talking about when we talk about verifiable consent?

[Owen Charters]

It depends on the sites. There have been ways where there's a verified account provided by a parent, which then verifies the underage person's account. It could be ID or it could be something simpler, depending on the risk.