Information & Ethics Committee on Nov. 20th, 2023

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

That would be fine.

Thank you, Mr. Chair. I appreciate it.

[The Chair, Conservative, John Brassard]

I don't know whom to direct this question to. I would probably direct it to Mr. Khoury.

One thing we haven't touched on yet is the impact of artificial intelligence and bot farms in the whole scheme of social media and the impact this may have going forward. How concerned should we be with the potential that AI and bot farms will be influencing not just young people, but all Canadians going forward?

[Sami Khoury]

We're definitely concerned about misuse of artificial intelligence. Artificial intelligence comes with opportunities, but also with challenges. We know that artificial intelligence is often used to amplify misinformation. Part of the algorithmic nature of some of those tools is to amplify misinformation.

We're also concerned about information leakage through artificial intelligence when you interact online. We've put out some advice and guidance to Canadians on how to make use of some of the public tools that are out there in terms of artificial intelligence, on being aware of the threat that is inherent in the use of artificial intelligence and on how some countries or some states are trying to exploit AI algorithms for their benefit.

[The Chair, Conservative, John Brassard]

It's changing rapidly. What's the centre doing to stay on top of this? How are you staying on top of this as AI evolves? It changes rapidly and has a tremendous impact on the future. What are you doing about that?

[Sami Khoury]

We're doing a number of things. One is our own internal research on what the state of the art is in terms of what AI is up to these days. From a government perspective, we're also working closely with Treasury Board to ensure that it provides some guidance to the rest of the government departments on how to use those tools with informed advice. Beyond government, we've put out some publications. We talk. We offer speaking opportunities to inform about the threat that comes with AI.

Absolutely, there are opportunities, but we also know that the flip side of that opportunity is potentially a challenge or a threat.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Khoury, Ms. Henderson and Mr. Madou, for appearing before the committee. On behalf of the committee, I want to thank you for your service on behalf of Canadians.

We're going to suspend for a minute, and then come back with our next witness. We will need some time for committee business, probably about five minutes. I know we've scheduled 15 minutes, so we should have enough time to ask questions and have them answered.

We are going to suspend for a minute.

Thank you, everyone.

[The Chair, Conservative, John Brassard]

Welcome back, everyone.

We are going to start the second part of our meeting today.

From the Privacy and Access Council of Canada, I'd like to welcome Sharon Polsky, president.

Ms. Polsky, you have five minutes to address the committee. Please go ahead.

[Sharon Polsky, President, Privacy and Access Council of Canada]

Thank you very much.

Thank you for inviting me to share some views about whether, and how, social media can undermine privacy, safety, security and democracy.

I am Sharon Polsky, president of the Privacy and Access Council of Canada, which is an independent, non-profit, non-partisan organization that is not funded by government or industry. It has members in the public and private sector who routinely use social media in their personal and professional lives.

Many can recall when Google mail was introduced. It was a brilliant marketing manoeuvre that preyed on human nature. Only the chosen few who were selected to have an account could have one. The invitation accorded those few people special status among their peers. This tactic and the media attention created demand. There was no talk about downsides, risk or privacy. People just wanted to have that Google account. It was simple psychology that showed how easily people can be manipulated.

Since then, we have seen countless examples of big tech manipulating us to share the most intimate details of our existence online. Social media continues to leverage human nature, and the lucrative data broker industry is the biggest beneficiary, other than those who would manipulate us for their own benefit, whether they're companies, political parties or governments. With recent geopolitical events, it's easy to think that what people post to social media might be used to coerce, extort or manipulate, but crediting social media alone, or social media from one country or another, is short-sighted.

Online risks reflect society and come from many sources, including familiar communication and collaboration tools that many in this room probably use most days. Every one of them is a real and constant threat. Zoom, Teams, Slack, Facebook and the rest are all foreign.

It's no secret that many companies scrape data and justify their actions by saying they consider the information to be public because their AI systems were able to find it on the web. Maybe the secure location where you posted personal or confidential information, or the Ontario hospital you visited recently, has been breached and now your health condition or sensitive conversations are being sold on the dark web.

If the concern is that people who use social media might disclose information that could make them politically sensitive and at greater risk of being influenced, I look to the recording we hear every time we call our cellphone provider or most other companies that says, “This call will be recorded for training”, which typically means the training of artificial intelligence systems through machine learning. The human side of that training is done in countries around the world by individuals who have access to your sensitive information.

A Finnish tech firm recently started using prison labour to do data labelling. It goes on and on. We have no choice whether the labelling is done by someone in Alberta or in Albania. There is no control over it and there is nothing stopping a company or a government from purchasing information, because it is available largely through the data broker system. It is widely available internationally. I could go on and on.

Yes, certainly education is important. Computers have been on desktops for almost half a century. The education is not there yet, as we see big tech investing tens of billions of dollars a year in objecting to and undermining efforts to regulate the industry, with the claim that it will undermine innovation. It's a red herring that's been disproven many times throughout history.

We see dating sites that people use routinely, which are wonderful for a social life, but when things like the Canadian dating site Ashley Madison are breached, I dare say that many of their customers become politically sensitive.

If children or adults go on any website, usually, before they even see the results, the fact that they have been there—whether it's for mental health, addiction or medical counselling.... That website has already secretly been transmitted to the likes of Facebook and data brokers.

This isn't something Bill C-27 is going to fix, or any of the other legislation. In fact, most of the laws being introduced here and abroad will make the situation much worse for everybody, including children—especially children.

I am happy to take your questions. This is a massive endeavour, and I commend you all.

[The Chair, Conservative, John Brassard]

Thank you, Ms. Polsky. I'm sure our members have lots of questions for you. You will be the only one answering them, so here we go.

Mr. Kurek, you have six minutes. Go ahead, please.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thanks, Mr. Chair.

Thank you very much, and welcome back to our committee.

One of the big challenges we face is this. When somebody downloads an app, they click a check mark for terms and conditions. There's education, increasingly, about what should or shouldn't be posted on social media. However, there's this grey world out there as to what information is actually being harvested or accessed—location and otherwise. In fact, it was this committee that looked into the fact that cellphone location information was shared with the government during the COVID-19 pandemic. It detailed people's trips to liquor stores, grocery stores and other public places.

How do we reconcile with this now “big data” world, where somebody downloads an app and checks a box, and all of a sudden their information goes to something we don't really understand? What are the impacts of where that data is going?

[Sharon Polsky]

It's a terrific question, especially considering that previous witnesses in this committee, from CSE and CSIS, repeatedly said it is up to the consumer, including children, to read the privacy policy and understand what is going on. A lot of my colleagues and members of the Privacy and Access Council of Canada don't get it. They don't understand it. How can we reasonably expect children or anybody else to? I live this stuff. Most people don't.

How does it happen? Largely, it's foreign companies. Our laws are obsolete, ineffective and poorly enforced. They do it because they can.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Are we seeing the gaps you're highlighting? Can you point to examples in Canada where that's being leveraged by foreign state actors, or by other entities that try to do Canadians harm? Can you point to examples and say, “That's where we're seeing the consequences of this playing out in real time”?

[Sharon Polsky]

I think it is pervasive.

Also, in the last half-hour, it took me a few minutes to find the birthdays of all but three members of this committee. I wish you an advance “happy birthday” for next week.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you for that.

[Sharon Polsky]

It's very easy. Our information is out there, even if we put out bogus information. You can imagine what my children go through. They have their online birthdays. On their real birthdays, their friends say, “happy birthday” and the algorithms pick up on that. The algorithms detect, by the volume of greetings on the real date, that it's the real birthday, along with the other information amassed through this hidden data broker system, where our information is traded, sold and bid on instantly.

The minutiae of our lives are available globally for sale.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I appreciate that, and thanks for the birthday wishes. I'm certainly much younger than I look.

The thing that triggered this study was largely the issue of TikTok and the government banning it on government mobile devices. We saw, just a number of weeks ago, the government ban WeChat, which has certainly far more direct connections with the Communist dictatorship in Beijing. Those are two examples that have made headlines and that the government has taken action on, but we saw a weather app being one of the apps selling data, which the government purchased over the course of the COVID-19 pandemic.

More generally, can you provide your insight to the committee—in about a minute, if you can—about how we look at it from this perspective, the big picture, looking beyond just TikTok, WeChat or social media at the access we give entities to an incredible amount of information?

[Sharon Polsky]

I agree. It's not just a matter of one social media platform or another, one company, or one government or another. This is pervasive, and it's been growing for a generation.

What do we do about it? How do we stop it?

Yes, it's education starting at the very youngest ages. Is it too late to put the genie back in the bottle? No. There is so much information about each of us floating out there that we don't even realize that we individually are at a loss. Corporately, people who are procurement officers, who know as much or as little as most people, are at the mercy of the vendors. They're not interested in your privacy. They're interested in their commission, their bottom line and their shareholders benefiting.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I am out of time, so I'm going to ask you for a follow-up with some information. Would you be able to provide to this committee some specific recommendations—and we're talking largely about the impact this has on children—that this committee could make in terms of being able to address this, specifically with children but also the much larger societal impact of this?

I don't have time for you to answer that question, but hopefully you can provide that to the committee at a later date.

[Sharon Polsky]

I'd be happy to.

[The Chair, Conservative, John Brassard]

Thank you. That's a good request.

Mr. Ehsassi, you have six minutes. Go ahead, please.

[Ali Ehsassi, Liberal, Willowdale, ON]

Thank you, Mr. Chair.

Thank you, Ms. Polsky. That was very helpful.

I have a few questions.

We had Mr. David Lieber, who is the head of privacy public policy for the Americas for TikTok, testify before our committee. I was just wondering if you had a chance to review that testimony, by any chance.

[Sharon Polsky]

I read some of the written record, yes.

[Ali Ehsassi, Liberal, Willowdale, ON]

Was it misleading, in your opinion?

[Sharon Polsky]

No. Was it a complete, thorough, fulsome answer? I don't know, but from my experience—keeping in mind that I'm the president of the Privacy and Access Council of Canada, that I've been a privacy adviser for about 30 years, and that I've been inside a lot of organizations and have seen a lot of things—very often, the language in testimony, in media reports and in so-called privacy policies doesn't give the full story. We'll collect your information and share it with our partners and affiliates, but with whom, when, where in the world and for what purpose?

[Ali Ehsassi, Liberal, Willowdale, ON]

One of the things he did say, which struck me as somewhat odd, was that no one has anything to worry about because we are subject to Canadian law. Is that any comfort? If they have data and, as you were suggesting, they're sending it out to Albania or what have you, even if you're subject to Canadian law, I don't think there's much we can do, is there?