Evidence of meeting #6 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was use.
A recording is available from Parliament.
Conservative
Jeremy Patzer Conservative Cypress Hills—Grasslands, SK
Thank you very much, Mr. Chair.
Thank you to our witnesses for coming.
Ms. Cavoukian, I think it's fair to say that for a lot of people out there who are having their location data collected without their knowledge or consent there is a level of trust that has been damaged and, quite frankly, broken. How important is public trust when it comes to an issue like this?
Executive Director, Global Privacy and Security by Design, As an Individual
I think public trust is essential, in terms of building it, because it is fleeting right now. That concerns me so much. In the past, when I used to go and speak to public groups, I would have to explain why privacy was important and why I thought they should care about it. I don't have to do that anymore. When I go out and speak to the public, they are so concerned about it.
The public opinion polls in the last two years—from Pew Internet research and others—have come in at the 90 percentile in terms of concern for privacy. Ninety per cent are concerned about their privacy. Ninety-two per cent are very concerned about loss of their information. This is huge. I have been in the business for well over 20 years. I've never seen such enormous concern—consistently in the 90 percentile—associated with loss of privacy. The trust...or the lack thereof that exists right now with government is staggering. As I said, I've been in this business for many years. I've never seen it escalate as it has now.
The growth of surveillance that follows that is massive. A lot of times people say to me, “Oh, you just have to give up on privacy; it's just not possible anymore.” No, we don't give up on privacy. Privacy forms the foundation of our freedom. If you want to live in a free and open society, we have to have privacy, so I fight for this, even though trust is waning. Let's build it up. Let's get our governments to be honest with what they're doing with our information and at least notify us. Having it under the hood, not letting people know about it, just grows distrust, unfortunately.
Conservative
Jeremy Patzer Conservative Cypress Hills—Grasslands, SK
I've seen some interesting commentary around the amount of surveillance that's gone on during the pandemic. When compared to what happened post-9/11, what's going on right now dwarfs what happened back then. I'm wondering if you have more comments on that.
Executive Director, Global Privacy and Security by Design, As an Individual
I was commissioner during 9/11, and obviously it was enormously troublesome, but when 9/11 ended.... You see, during a crisis—a pandemic, an emergency—there are emergency measures that can be introduced to put the privacy laws on hold. The problem is that after the pandemic or emergency ends, often those emergency measures continue. Transparency goes out the door. Surveillance grows and continues to grow. That's what I'm concerned about with the pandemic now.
The pandemic, God willing, will be coming to an end. Measures are already being lifted in terms of our restrictions. We have to ensure that the measures taking place during these emergencies are suspended when the emergency is over, because we need to restore trust and we need to restore privacy. We can't have people believing that we just have to give up on privacy. No: You never ever give up on privacy. Privacy and freedom go hand in hand. They're both essential.
February 10th, 2022 / 4:20 p.m.
Conservative
Jeremy Patzer Conservative Cypress Hills—Grasslands, SK
Thank you for that statement. That's very important.
I worked in the telecommunications industry for 10 years prior to being elected. It's my experience that people's data, whether.... Even as far as a smart home goes, your level of protection is only as good as the individual who's trying to access it.
Earlier, you mentioned synthetic data, but what else needs to be done, above and beyond the anonymized data, to actually try to really protect people? I've seen other reports. They had a sample of 100,000, and they were able to reidentify about 92% of all users, so there are obviously some issues. What more needs to be done here?
Executive Director, Global Privacy and Security by Design, As an Individual
We have to get serious about getting the messaging out about privacy and the measures that need to be invoked at the time when the technology is introduced. A lot of people want to protect their home, so they have all kinds of measures to do that, but it often intrudes upon their neighbour's privacy, because the cameras capture information not just from that household but also from those around it.
Starting with what should be the appropriate restrictions on technology that is intended to be surveillance, what do you do about that and how do you minimize that in terms of its impact on others who don't want to be involved in it and who haven't introduced it into their lives and homes? These are the measures. We need to have measures that reduce the collection of data, of surveillance, and maximize the privacy choices that people can make.
Conservative
Liberal
Ya'ara Saks Liberal York Centre, ON
Thank you, Mr. Chair.
I would like to thank our witnesses who are joining us today. It's a very fruitful conversation.
Dr. Scassa, I would like to start with you, if I may. You made some important points with my colleague Mr. Green about the difference between surveillance data and mobility data. Telus for good was the sole-source contract in December 2020 through PHAC at that time. Prior to that, both the Prime Minister and Dr. Tam had been very clear that they were using the Telus data for good platform. From what I understand, that data was used by universities and others. University researchers, health authorities and others are using the Insights platform to collect really important data that we need during the health crisis. From what I understand they even received the seal of approval of the privacy by design certification on their work. That was the sole-service data provider to PHAC from the time of the public and transparent announcement that was made in April 2020 until the contract of December 2020 right through to October 2021.
In what you've described in this process, if you were a Telus user, would you be comfortable knowing that you could have opted in or opted out, knowing that data which PHAC used was not surveillance but mobility data?
Canada Research Chair in Information Law and Policy, Faculty of Law, Common Law Section, University of Ottawa, As an Individual
To be perfectly honest, I have no problem with my mobility data being used for legitimate public health purposes in the middle of a pandemic. I have more of a problem with it being used to push ads for cheaper coffee or whatever promotions as I travel around. For me that's more of a privacy concern than the use of my de-identified mobility data for socially beneficial purposes. I think this goes to the balance that we need to find.
Liberal
Ya'ara Saks Liberal York Centre, ON
Of course and I appreciate that. The Telus data for good platform was the sole-source provider to PHAC for that initial year. Dr. Cavoukian said to look under the hood. Well, the Privacy Commissioner was informed in April 2020 as well and didn't raise any alarm bells about looking under the hood at that time, and was informed, and from his own testimony had bi-weekly meetings with PHAC throughout the duration of that first year, and also in the preparation of the RFP for the forthcoming year after that.
Just so we're all clear on the process that has taken place, Canadians had ample access to public information whether they chose to.... Look, there's a lot of data and there's a lot of information in the news cycles as well. It's a really difficult thing to process what you are being told in the news cycle in the middle of a health pandemic, but Dr. Tam through COVID tracker and other sources was very transparent with the public of using data that was on a public platform.
Would you agree with that assessment, Dr. Scassa?
Canada Research Chair in Information Law and Policy, Faculty of Law, Common Law Section, University of Ottawa, As an Individual
I guess what I would say here is I think that part of the problem in this whole situation is the fact that we have companies and we have governments trying to do their best to address how to use data appropriately in this environment for socially beneficial purposes, but we don't have the updated legal frameworks that would apply to them. We don't have clear provisions that say, “This is what you need to do. This is the role of the Privacy Commissioner with respect to de-identified data. This is how transparency is achieved when data is shared for socially beneficial purposes and this is how we define those purposes.” All of this is taking place in this context where we don't have the modernized frameworks for this type of activity in place.
Executive Director, Global Privacy and Security by Design, As an Individual
May I add very quickly that Telus for good is excellent. I have no problem with that at all.
Liberal
Conservative
Liberal
Ya'ara Saks Liberal York Centre, ON
Like all of us, I have one of these with agreements on them and so forth.
Dr. Scassa, through the chair to you, I really appreciated your comments on understanding that the client consumer relationship when it comes to these devices has dramatically changed in terms of the volumes of information that we're dealing with, and also of how they've become a part of our daily lives.
Perhaps you could provide a written answer to this. What recommendations would you want to see us consider going forward in tabling something like C-11, or recommendations for this committee to provide on upcoming legislation?
Conservative
The Chair Conservative Pat Kelly
It will have to be a written submission or later in the panel, because it is now time for Monsieur Villemure for two and a half minutes.
Bloc
René Villemure Bloc Trois-Rivières, QC
Thank you, Mr. Chair.
Dr. Cavoukian, I would like to ask you two questions and I don't have much time. The first question is simple, but you can answer the second one at greater length.
Some of the people that I spoke to during my career as an ethicist, and others that I spoke to about this issue, have said that, if you have nothing to hide, there shouldn't be a problem. I would like to hear what you think about that.
Executive Director, Global Privacy and Security by Design, As an Individual
That always makes me laugh. That could have been the motto of the Stasi police and the Third Reich, because they would tell people, “If you have nothing to hide, what's wrong with the state knowing everything about you?” It is absurd. It's the exact opposite of freedom. Please, let us preserve our freedom. Privacy forms the foundation of our freedom. It's nonsense that you have to reveal everything to the world and to the government.
Bloc
René Villemure Bloc Trois-Rivières, QC
The relationship between privacy and freedom is clear, and we don't have to reveal everything to government or any other organization.
A call for tenders was issued for a second contract, and this committee made a unanimous decision to request the suspension of that call for tenders. A vote was held in the House on the matter yesterday. The request was made, and we don't know what will happen.
In the call for tenders, it was mentioned that the data could be used after the pandemic was over. Two things interest me. First of all, we don't know who will declare that the pandemic is over. Secondly, why would these data be used after the end of the pandemic?
Executive Director, Global Privacy and Security by Design, As an Individual
That's what I would object to. As I mentioned, after 9/11 it was the same kind of thing.
Executive Director, Global Privacy and Security by Design, As an Individual
The measures that were introduced during 9/11 were intended to end after the emergency was over. They didn't. It's always a concern with measures that are introduced during something like a pandemic or an emergency situation, ensuring that they will no longer continue afterwards. I would be very concerned about that.
Bloc
René Villemure Bloc Trois-Rivières, QC
Okay. What would be your two main recommendations to improve the legislation?
Executive Director, Global Privacy and Security by Design, As an Individual
I would want to be able to work with.... For example, the Telus for good program is excellent at de-identifying and protecting data. They have privacy by design certification. I'd want to work with them and with the government to see how we can make some uses of beneficial information while completely preserving our privacy or perhaps introducing synthetic data. Let's explore different options. This is what I would like to introduce in legislation.