Evidence of meeting #68 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was online.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Jane Bailey  Professor, Faculty of Law, University of Ottawa, As an Individual
Owen Charters  President and Chief Executive Officer, Boys and Girls Clubs of Canada
Kristjan Backman  Chair, National Association for Information Destruction - Canada
Rachel Gouin  Director, Research and Public Policy, Boys and Girls Clubs of Canada

4:50 p.m.

Liberal

Nathaniel Erskine-Smith Liberal Beaches—East York, ON

Such as a Facebook account or something...?

4:50 p.m.

President and Chief Executive Officer, Boys and Girls Clubs of Canada

Owen Charters

Absolutely.

4:50 p.m.

Liberal

Nathaniel Erskine-Smith Liberal Beaches—East York, ON

Okay, you did note that you liked Ms. Bailey's mention of perhaps moving beyond consent.

When we look at models around the world, is there a gold standard we should be looking at, Ms. Bailey, in terms of moving beyond consent?

September 25th, 2017 / 4:50 p.m.

Prof. Jane Bailey

I don't think there is. Again, I go back to the way the EU approaches it. The more you create rights to not have your data used in particular ways or collected for particular things, the more you foreclose industry's being able to dictate that in their terms of service, creating this illusion of consent by having people click “I agree to the terms of service”.

4:50 p.m.

Liberal

Nathaniel Erskine-Smith Liberal Beaches—East York, ON

I think the EU still allows the use of data for reasonable business practices.

4:50 p.m.

Prof. Jane Bailey

Yes, I agree, so when you said there's a gold standard, I said there wasn't. There isn't.

4:50 p.m.

Liberal

Nathaniel Erskine-Smith Liberal Beaches—East York, ON

Okay.

4:50 p.m.

Prof. Jane Bailey

In the ultimate model that I'm thinking of, I don't think there's anybody who's doing that.

4:50 p.m.

Liberal

Nathaniel Erskine-Smith Liberal Beaches—East York, ON

It strikes me, when you mention discriminatory practices, that it's a very compelling example. Obviously discriminatory practices, regardless of age, should be outlawed—full stop. But the use of data itself for reasonable business practices doesn't strike me as a particular problem. I recognize that I may not understand the algorithm behind it, but I do understand what it means to use my preferences to advertise to me based on those preferences.

I worry that when we talk about not understanding the algorithm, then we undo the ability of businesses to advertise or to use the data in a meaningful way that a lot of consumers would appreciate.

4:55 p.m.

Prof. Jane Bailey

Yes, except that businesses can't now make decisions that violate human rights codes. If they come up with mechanistic ways of doing that and it makes it impossible for us to know whether that's happening or not, they're still violating human rights codes. That was my point.

My point is that part of machine-based decision-making is that we don't get to see that, so we may miss discriminatory practices that we might otherwise pick up in human-based decision-making. One way of addressing that is the example from the GDPR that says, for certain kinds of decisions, you have to be able to provide an explanation. That will mean that you'll have to be able to provide an explanation that is humanly understandable.

4:55 p.m.

Conservative

The Chair Conservative Bob Zimmer

Thank you, MP Erskine-Smith.

MP Baylis, you have the last two and a half minutes.

4:55 p.m.

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

I just want to follow up on those questions that Nate was asking, and I understand there's no perfect solution.

What are the best practices? I've heard of jurisdictions such as the U.S.A., California, the EU, and the right to erase, the right to be forgotten, some general data protection under 16, under 13. What would it be if you had only one that you could implement? Which one would you choose?

We'll start with you, Mr. Charters.

4:55 p.m.

President and Chief Executive Officer, Boys and Girls Clubs of Canada

Owen Charters

We actually put it in our recommendations. We didn't pick a jurisdiction, but we said that we want the capacity for parental consent to be a requirement under the age of at least 13, with the right to be forgotten by the time you reach the age of majority. The combination of those two is sufficient at this point in time.

4:55 p.m.

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

Does that exist anywhere?

4:55 p.m.

President and Chief Executive Officer, Boys and Girls Clubs of Canada

Owen Charters

It's a combination of the United States' COPPA and the European model.

4:55 p.m.

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

Combine those two, okay.

4:55 p.m.

Chair, National Association for Information Destruction - Canada

Kristjan Backman

I would go at it a little differently, and the GDPR is pretty good on this. It's the privacy by design. You say, from the very first steps when we're collecting information, that we are designing the system around protecting that information. We think of the protection of that information first, before we start to think about how we're going to analyze it, how we're going to deal with it, how we're going to sell it, how we're going to market it, and that becomes a requirement of each individual organization as they're building their data collection.

4:55 p.m.

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

Who has that kind of a law in place?

4:55 p.m.

Chair, National Association for Information Destruction - Canada

Kristjan Backman

The GDPR that is coming in. “Privacy first” or “privacy by design” is what they call it.

4:55 p.m.

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

It's not in place yet, but it's coming. Is that correct?

4:55 p.m.

Chair, National Association for Information Destruction - Canada

Kristjan Backman

It's coming this year.

4:55 p.m.

Prof. Jane Bailey

With respect to young people, I would say that we should prohibit companies from collecting and using their data for profiling and marketing purposes. That's a beginning. That doesn't address all the other things I talked about.

4:55 p.m.

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

Does someone do that right now in any jurisdiction?

4:55 p.m.

Prof. Jane Bailey

No.

4:55 p.m.

Conservative

The Chair Conservative Bob Zimmer

Thank you, MP Baylis.

Thank you, guests, for coming today. It was a very thorough conversation with a limited amount of time.

Just for the committee's understanding, they were invited before but it was pre-empted by some parliamentary business.

We're going to suspend, folks, for about five minutes until our guests can exit. Then we'll get into our committee business.

[Proceedings continue in camera]