Information & Ethics Committee on April 17th, 2018

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Thank you, Mr. Therrien and Mr. Vickery, for being here.

It seems that we have a fundamental question to ask as a society, and that is, when we come to data, what will we allow and what will we not allow? It really falls on the government to make the rules and not allow each company to decide how and when they use data in whatever manner.

I'm going to put that question to both of you, in order to understand. Before I do so, I'll say that we've always had targeted marketing. I was just looking up Michael Dell from Dell Computers. Before he became a computer mogul, he used to sell newspapers. He would look at the database of people who were newly married or people who had just moved. He was extremely successful as a teenager doing that. I could get that data now from, say, Facebook. If I wanted to sell newspapers the old-fashioned way, tell me who has just moved and who just married. We've allowed targeted marketing before.

Now, selling of data—nothing to do with Facebook, again; I give charitable donations, and I know that some of these charities share my data with other charities, because it's a good way to hit someone up again. Sometimes they ask permission to share the data, and sometimes they don't. That sharing of data for commercial reasons, that targeting, has been allowed. Both of these things have been allowed in the past; Facebook makes it far more efficient. If I were a political party, let's say the Green Party, I'd say that whoever's posting a lot about environmental issues might be a good person for me to target to get a donation or to convert.

I want to ask you this fundamental question. What should we allow, knowing that these things have already happened, and what should we not allow? How should we as a government put parameters around this behaviour?

I'll start off with you, Mr. Therrien, and then we'll go to Mr. Vickery.

[Daniel Therrien]

I don't think there's a short answer to that question, but if there were one, I would say that we have tried our darndest to come up with a reasonable answer in the study we've made in the consent report and the recommendations and measures we are taking in relation to it. You augmented that significantly, I think, with your report as a committee in February. So it's not one thing. It's a series of things.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

On a philosophical level, for example, should we allow...? For example, I'm asking if we should say, “Look, I'm giving you this data, but you may only use it for this. I'm making a donation. I'm in your database. I do not allow you to share it.” Or I might allow you to.

On a philosophical level, do I own what I give? Do I not?

[Daniel Therrien]

On that level, I think the answer is that the personal information of individuals is something they need to be able to be in control of. You put it in terms of ownership, and that is something that is sometimes said. I would rather say that it is a human right, that privacy is a human right, to control your privacy, and therefore what information you allow to be known by others, and to what end, is because you choose to do that, because you think it provides a benefit for you, as opposed to giving consent for an extremely broad purpose, which is then open season for others to interpret as they see fit.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

So you would come down to the formulation of consent, from a philosophical point of view, as I give you this data, but I put parameters around what you can and cannot do with that data.

[Daniel Therrien]

Yes, with legal rules—that's the role of government—to ensure that this philosophical concept is actually respected.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Yes, we will build the technicalities. Once we decide what we want to do, then we can drill down and make, for example, your right to investigate and your right to fine, etc.

I agree with you that you apply it even to political parties. That's the technicality, once we decide what we want to do.

Mr. Vickery, how would you see this? You're in this world constantly.

[Chris Vickery]

I believe the incentives to spread around data by people who are profiting from it are great. Giving in a little bit is not only a slippery slope; it is a foregone conclusion that it will happen to a wide degree, and it's just a matter of time before political parties and commercial list builders and consumer surveillance groups all come together and offer each other large sums of money for the data.

A suggestion I would have for looking into a potential kind of compromise would be to decide that everybody has a right to own their own data. If you want to give a charity the right or permission to share your data with another charity of similar mind, I don't think it's unreasonable to expect that the first charity you gave the information to should send you an email saying they're planning to share your information with such and such a group and ask whether that is okay—“Opt in here to share it”—or at least send you a notification that they are sharing it. Nothing then is done in the darkness; nothing is done under the table; everything is known, and there's a paper trail and there is consent.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Next up, for another five minutes, is Mr. Kent.

[Peter Kent, Conservative, Thornhill, ON]

Thank you, Chair.

Thank you, Commissioner, for noting this committee's unanimous report and recommendations to the government in February. We hope that the government has consumed it as you did.

One recommendation in that report, one that you have made in a variety of rather tangential ways, is to work with the European Union privacy regulators. In just a couple of weeks the new EU GDPR, the general data protection regulation, comes into effect. It protects virtually every data element of citizens across the EU, from their basic information—social insurance number, in the Canadian context—to all of their social media activity, all of their personal information, the computers they own, their telephone numbers, and so forth.

Has this Facebook scandal, the Cambridge Analytica scandal, AIQ, all of the things we're talking about today, and the fact that artificial intelligence, which has generated magnificent benefits to society, to mankind, while at the same time there's been a rush to develop new programs without any consideration for protections and precautions...? Is it time for Canada to consider something like the GDPR regulations to protect privacy, from the most minimum basic level up to the most complicated, when it gets to algorithms and stereotyping and exploitation?

[Daniel Therrien]

It is more than time that Canada legislates. I have made that point many times. The GDPR, the European regulation, is certainly a good standard to compare ourselves with, but I think it's important for each country to develop its own legislation. There might be cultural or constitutional reasons that certain rules would be different, but certainly the European model is a good model. I've made a number of recommendations inspired by that model.

The main point is that it is high time—it is past time—to legislate.

[Peter Kent, Conservative, Thornhill, ON]

Thank you.

Mr. Vickery, you touched on this in a number of your previous answers, but is there a technical way to ensure, if social media users don't opt in, that the multiplication or pluralistic development of their individual data through their friends, their lists, their contacts, their friends' faces, can be prevented? Or does this come down to a matter of trust that the social media companies that users place their trust in will be true to whatever commitments they may or may not make now or are regulated to make in the future?

[Chris Vickery]

I have both a positive answer to that and a negative answer to that.

I'll start with the negative. There is no way to guarantee that any bit of data, any string of characters you submit or that are identified with you, will not be propagated down the line to another company. Data multiplies. I see it all the time. There is just no way to prevent it. It's too prolific.

I do have a suggestion on how to work towards the goal of containing the amount of data that is multiplying out there for whatever purpose. That suggestion is to have on the books laws that have teeth. These companies will not deal with large databases of information if they know that it is a huge liability and a potential threat to their bottom line. It's not until the regulators can issue fines that affect profits and stock value that these companies will respect what the regulations say.

[Peter Kent, Conservative, Thornhill, ON]

So this would be along the lines of, for example, the GDPR, which has provisions for up to 20 million euros in penalties, in fines, or the equivalent of 4% of the revenues of that particular company? Some of these companies are multi-billion dollar revenue generators.

[Chris Vickery]

I can't speak specifically to the numbers and calculations, but I believe that is in the same vein as what I'm talking about, that, yes, it takes something with teeth attached to it to really get executives' attention. GDPR has gotten a lot of executives' attention.

[Peter Kent, Conservative, Thornhill, ON]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Kent.

Next up is Madame Fortier.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Thank you very much.

Gentlemen, thank you for being here today.

Mr. Therrien, you have become a regular. It's like you're a favourite on Tout le monde en parle and can come whenever you like. I will begin with you, because I really want to understand the exercise we are doing now and, most importantly, the one you are doing on your side.

As you know, the committee also unanimously decided to investigate the apparent breach of Facebook data by Cambridge Analytica, but without compromising your own investigation.

I am curious to know how you characterize the breach of privacy in this case. If I have understood the comments you have made recently, it is your belief that the regulations in force have left too much leeway for Facebook in collecting personal data and that this has created the right conditions for Cambridge Analytica to use that information in an illegal or unethical manner.

Could you characterize the breach of privacy that you are currently studying?

[Daniel Therrien]

Because of the ongoing investigation and our legal obligations, the most important of which is not to draw any conclusions before completing this investigation, I would like to qualify your remarks slightly.

The conclusions you attribute to me would be more a function of what we generally see, as representatives of a regulatory agency, with the behaviour of all companies and the legislation that applies to them. Every day, we see that privacy policies are very permissive in that they allow for a very broad use of information, which is not always consistent with informed consent.

Can we say that Facebook violated privacy based on the facts alleged? We will certainly be looking into it. Our investigation is ongoing and we cannot draw conclusions yet. I can tell you what issues we will be looking into, but we are not going to talk about any conclusions in this case.

In general, we will be asking ourselves whether the two companies we are investigating, Facebook and Aggregate IQ, have violated the federal privacy legislation and, in the case of British Columbia, the provincial legislation.

More specifically, we will be examining whether Facebook's privacy policies actually were too permissive and whether they played a role in the subsequent use of the information by analytics firms to give advice that may or may not have been useful to political parties, among other things.

We will also be trying to determine, as I said earlier, whether the recommendations made by the Office before I arrived in 2009 are still applicable in 2018.

Finally, we will be looking at the role played by Aggregate IQ in all this and how the company collected the information. Was it done in accordance with the legislation? We will mainly consider the type of data analysis that was done. Did the final product, as communicated to the political parties, comply with privacy protection laws?

All those questions are relevant, and we will examine them. Obviously, I cannot draw any conclusions right now.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

I understand, thank you very much.

You are conducting your investigation on your side, but this committee will be receiving Facebook representatives later this week. In your opinion, are there any particular questions we should ask them? Do you have any suggestions for the committee?

[Daniel Therrien]

Yes.

Factually, how does Facebook ensure that a third party, the people conducting the research, obtains the personal information of its users in a manner consistent with the consent given by the users and with the privacy requirements?

In addition, how does Facebook protect the data of its users against anyone who might want to use them for inappropriate or unauthorized purposes? I am thinking here of malicious hackers, the so-called bad hackers.

Finally, last week, Mr. Zuckerberg said that the time has come for Facebook to have appropriate regulations. So what does this mean for Facebook, especially in terms of our recommendations—in the Office of the Privacy Commissioner of Canada—of this committee's recommendations, and the European regulations?

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Thank you very much, Mr. Therrien.

[The Chair, Conservative, Bob Zimmer]

Thank you, Madame Fortier.

Next up, for three minutes, is Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

Mr. Vickery, we started out dealing with a breach of 85 million Facebook accounts that may have upended the most important election in Europe in this generation. Then you come this morning and just casually mention that 48 million other people may have had their information breached, including very personal information.

I know this is something you're probably still investigating, but was this a Facebook breach?