Information & Ethics Committee on Nov. 20th, 2023

[Matthew Green, NDP, Hamilton Centre, ON]

Is it your assertion that when someone is not granting full information and full consent when engaging in an app or a platform, this is a type of fraud committed by the company and therefore should have a criminal liability to it?

[Sharon Polsky]

I wouldn't go so far as saying it's fraudulent, but it's perhaps misleading. It's permitted under the current legislation and under Bill C-27, which is going to maintain the status quo of the same vague consent. That's not going to improve the privacy.

[Matthew Green, NDP, Hamilton Centre, ON]

Here's a chance for you now to address that specific consent clause.

I would say that if you're not entering with full understanding, you can't consent. If you're downloading an app for a certain use and your use of that app is then sold to third parties that you don't know about and the real purpose of the app.... I reference Cambridge Analytica. They had your life in data. I can't remember the exact name of the app where they scraped all this information. I would say it's fraud. You don't have to say that, but I would say it's a fraudulent engagement of the consumer.

As it relates to consent, again, could you just provide, with specificity, the types of explicit consent you would like to see so that people who engage with these platforms would have full prior knowledge of what it is they are engaging in?

[Sharon Polsky]

Okay. There are two things you're talking about here, I think.

One is that the companies or organizations that are supposed to obtain our informed consent at the time of or prior to collecting our personal information acknowledge—as did Mark Zuckerberg before Congress—that few people read these privacy policies. This, to me, says they are collecting our personal information knowing that nobody reads the privacy policy. Therefore, it is not informed consent. They are in violation of our privacy legislation, the GDPR and others.

What to do about it? Turn it around. Stop allowing the organizations to be in control. Turn it around so that we each have the ability to—

[Matthew Green, NDP, Hamilton Centre, ON]

Opt in rather than opt out.

[Sharon Polsky]

No, it's more than just opting in or opting out. Interrogate the company. Make it so that there is an index of companies where consumers can go and see how a company complies with the legislation. If one company does it in a way that is better than another, the consumer can make a choice. I allow my information to be used by your company for a certain purpose. I get a receipt. There is a record of it that I am in control of and not the company.

[Matthew Green, NDP, Hamilton Centre, ON]

That's interesting. I appreciate that.

I think the last study you were here for, sometime back, was about surveillance on phones, with the RCMP.

[Sharon Polsky]

Spyware.

[Matthew Green, NDP, Hamilton Centre, ON]

Yes. Here we are. In a lot of ways, whether it's governments using these devices or corporations using these kinds of device applications, it's spyware. Would you agree with the assessment that social media apps are a form of spyware?

[Sharon Polsky]

Absolutely.

[Matthew Green, NDP, Hamilton Centre, ON]

Would you care to expand on that?

[The Chair, Conservative, John Brassard]

Please respond very quickly.

[Sharon Polsky]

I have a challenge with that sometimes. There's a lot, as I said, to discuss.

It's the granularity of the information they collect about us—usually without our knowing about it—such as the ride-sharing app we use that records the precise geolocation and the time of day. They can use it for their own purposes. Whom is that given to, and what assumptions can be drawn from that or any other information?

It is effectively spying on us. I agree.

[The Chair, Conservative, John Brassard]

Thank you, Ms. Polsky.

Mr. Gourde for five minutes.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you, Mr. Chair.

I want to thank the witnesses. Their statements and those of the previous witnesses have left me quite concerned.

We, as human beings, have become products. These major companies have created a profile for each of us based on our aspirations, what we buy and what we look at. That profile is then re-sold to companies wanting to sell us something.

It's my impression that it's already too late for my generation and all those currently using social media. I'm the proud grandfather of six grandchildren—soon to be seven—, who are too young to use social media. Should we be focusing on protecting the next generation?

[Sharon Polsky]

We're protecting the next generation, absolutely, but we're all fighting against well-funded big tech that insists everybody wants this. Nobody understands it. Well, a few people understand it well enough to object to what it is doing to us.

Things have changed very quickly. I think it was in 2004 when a minister of the Canadian government was in the hot seat because it had been discovered by the media that the government was collecting 2,000 bits of information about each of the 33.7 million Canadians when there were some 31 million Canadians. People reacted quickly and vocally. The minister said, “Never mind. We've given the information back”—how you do that with electronic data, I don't know—and they apparently disbanded it.

That very quickly changed. Instead of dealing with one government department or another, now we deal with government, and the government says it owns our information. The whole concept of public policy has shifted. I dare say that if there is a genuine interest in preserving and protecting children, privacy and future generations, there needs to be some serious thought given to actually doing that. Studies are wonderful, but action has to be taken very quickly.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Is this current quest for information on all individuals a breach of our individual freedoms.

[Sharon Polsky]

Is it a threat to our liberty? Absolutely. It's too easy for any organization to use the information that has been amassed about us to sway our views, to sway views of public policy, government, legislators, teachers, institutions. It's absolutely a threat to democracy and civil liberties—human rights. Artificial intelligence is going to make it even worse, unless there is effective, strong regulation to protect individuals, not just to foster commerce.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you very much.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Gourde.

Ms. Damoff, you have five minutes. Go ahead, please.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Thank you, Chair.

Thank you so much for being with us today and bringing your vast knowledge to our committee.

I want to go back to youth. Earlier, when we had CSIS and CSE here, I said that when TikTok appeared, they said the only thing they collect is an email address. They make sure that young people give them their birthdate and everything is just tickety-boo. They don't have any young people who shouldn't be on there. I challenged them at the time.

I wonder if you could just share with us a little bit. Young people sign up. They give an email address. How much more information are TikTok and Instagram, which are the two popular ones with young people, gathering and how are they gathering it? Is it of concern to you?

[Sharon Polsky]

I have not investigated either of those companies closely enough to know what they gather, but in more general terms, companies do gather that information.

Typically—and keep in mind that we're told to respect authority and to give a straight answer when asked a question—people give their real information. It doesn't occur to them to give a made-up name or a made-up birthday or to use an email address that is a throwaway or that hides their real email address. They use their email address, and that gets connected in the background by the data brokers. It's a huge concern.

As for how to identify whether somebody is providing their real age or not, there are a lot of companies that are selling this service. They will collect your government photo ID and they will verify it. They amass that information, and that is another threat. On legislation, I know that Canada is thinking about the same thing that the U.K. and the EU have been thinking about—or, in the U.K.'s case, it has been enacted—and that is requiring organizations to collect that information. That is a huge threat.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

To go back to the young people, we haven't talked at all about apps and filters. I remember that a few years ago there was a thing going around where you could download an app onto your phone that would show you what you would look like in 20 years. I remember all kinds of people downloading that app and uploading their pictures—it's fun to share these pictures—and then it turns out that the company was based in China and that information was actually not secure.

I often see young people who have downloaded filters that can turn them into a Disney character or whatever the filter app might be. I'm just wondering if you have concerns about those kinds of things that appear to be fun but are in fact quite dangerous in terms of the information you're sharing.

[Sharon Polsky]

I think they're very much like the questions you get: What's your favourite dog, your favourite animal or your favourite colour, or if you were a car, what would you be? These are all subtle ways of gathering information about people and their psychological makeup and their preferences. You don't know who's collecting it and what they're going to use that information for. It's a huge concern, absolutely.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

I hadn't thought of that, but quite often on Facebook, it will say “take this quiz”: What city were you born in and where did you go to school? Often, people don't look at their security settings to see whom they're sharing with, and it ends up being public. You've given people all the information they need to breach your security, because those are often the answers that you use for questions when you have your credit cards or banking information.

How do we educate the public, though? There's an onus on the companies, but there's also an onus on Canadians—and around the world, but we'll focus on Canada. How do we educate Canadians to be more aware of what they're sharing online?