Industry Committee on Oct. 17th, 2017

[Jim Eglinski, Conservative, Yellowhead, AB]

Thank you.

[The Chair, Liberal, Dan Ruimy]

Mr. Sheehan, you have five minutes.

[Terry Sheehan, Liberal, Sault Ste. Marie, ON]

Thank you very much to everyone for another thought-provoking session.

I am glad we're reviewing the legislation, based on all the testimony I've hard so far. I want to continue on with some of the questions I asked in the last session. The particular legislation talks about the “activities that discourage reliance on electronic means of carrying out commercial activities, and...amend the Canadian...” and it goes on. It talks about the various means of contacting and picking up.... There were some questions about Facebook today again.

Michael, when I take a look at when your task force went out, in 2004, I reference the fact that the same year there was another big thing happening, then called TheFacebook. You probably weren't delving into TheFacebook at that particular time.

My question is based upon these numbers that I see: Facebook just hit two billion users a month; YouTube has 1.5 billion per month; Instagram has 700 million; Twitter has 328 million, and so on. I'm not going to name the other various social platforms that are out there. They're all important. I use them all. They're generational too. Certain ages use more than others do. Generationally, privacy, in my opinion, is a different issue. My daughter is not as concerned as my father is about who sees what on social media.

My question concerns why or how this particular legislation affects the various platforms that are out there. Even Facebook has a messenger now, which uses basically email. I can't get into the technical terms of it. How will this legislation affect these various social platforms going forward? If it doesn't, why not, and should it?

Does anyone want to kick it off? Michael, I guess I'll start with you, and then perhaps other people will have an opportunity.

[Dr. Michael Geist]

I want to pick up on that notion that back in 2004 we couldn't or wouldn't have predicted necessarily the rise of social media and some of these other technologies. I think that's true. In fact, the committee recognized that there was a rapid pace of change taking place. Ironically, based on the recommendations we are hearing today, we were urged to adopt as much of a technologically neutral approach as possible. The idea was to not limit this just to this narrow band of what is seen as spam, but rather to ensure that the law can be effective as some of these technologies change, which is why there is that ability to be effective against spam, spyware, malware, and potentially even some of these new technologies.

One of the discouraging things that I'm hearing now is that the recommendations are, “No, don't do that. Get as specific and narrowly tailored as possible. We don't need to have that broad base on some of these issues. It's too broad in scope.”

That was seen by many as a feature, not a bug, back when we established this. I think one of the ways to ensure that the law is effective and relevant as things change is to ensure that it can be applied as some of these things change. I would certainly point again to things like IoT and those sorts of technologies. The idea that we would bring those technologies into our homes without effective protections against misuse of our information is a real problem.

[Terry Sheehan, Liberal, Sault Ste. Marie, ON]

The other Michael.

[Michael Fekete]

I would like to take a different perspective. There is no question that we need effective privacy legislation. The discussion and the points that Michael is raising are about privacy, agreed. That's why we have PIPEDA. That's why we have a very active, internationally respected privacy commissioner who sets out guidelines and provides direction based on very technology-neutral legislation that is based on principles.

The problem with the anti-spam legislation is that it's not based on principles; it's based on very prescriptive rules that don't necessarily work in these new environments. The Internet of things is a great example. If you don't have an interface through which you can get consent, how do you comply? There is an unintended application of these prescriptive rules to a technology we didn't fully understand or didn't see in the way that we see it today. Our privacy legislation provides the framework for technology-neutral legislation that is flexible to allow for technological change. CASL isn't that legislation, because it's overly prescriptive.

We have to fix the prescriptiveness. We have to make it more principle-based to achieve the outcomes that we all agree are necessary to protect consumers and to ensure that businesses don't exploit the privilege of contacting individuals or the right of installing an update to a computer program.

[The Chair, Liberal, Dan Ruimy]

Thank you very much.

Mr. Masse, you have two minutes.

[Brian Masse, NDP, Windsor West, ON]

I'll start with Mr. Fekete.

If the private right of action were fixed—and this is ironic, because you're concerned about frivolous lawsuits. We haven't had any lawsuits. We're just speculating now that it will be the place, and I don't want to get into a whole debate as to why it's going to happen, or whatever. But if it were eliminated—in terms of the speculation, which would basically be lawyers inappropriately acting against other lawyers, because that's how you create the lawsuits to begin with—would you support that at all, if we got rid of that and if it were just for serious cases?

I'll maybe go across the board really quickly, if that's possible. If it were cleaned up so it would involve only the most serious cases, and not the speculating...?

Thank you.

[Michael Fekete]

I think there would be broad support if the private right of action were targeted on the truly bad actors, and we had a situation where we weren't combining a private right of action, broad standing to sue, and statutory damages, because that's where the potential for frivolous class actions becomes most prevalent. Narrowing the scope and enabling private enforcement against the bad actors, I think, is something that would be broadly supported.

[Adam Kardash]

I completely agree, as I said in my opening remarks.

[Dr. Michael Geist]

I think we need to understand that the existence of the private right of action under the law is not an accident. We looked at other jurisdictions which had it, and then spoke to organizations that had used it and found it was effective.

In the United States, where you see some of these actions, we spoke to organizations that had used the law, and they found that the misuse, sometimes of their domain or other sorts of spamming activities, declined after they brought those actions. That was why we brought it in.

I think we can speculate about all the potential misuses of the private right of action if it were to come into place, but with a less litigious society, typically the United States—and we've actually seen effectiveness there—from my perspective, I thought we surely should have at least seen how it worked. That's what these kinds of hearings are for—to see if it has been creating unintended consequences and if we think there is an opportunity to fix it after the fact, rather than taking away what was viewed as an important element in the tool box to try to deal with the problem.

[The Chair, Liberal, Dan Ruimy]

Thank you.

I'm sorry. We have enough time to do one more round of five minutes each, so I'm sure Mr. Masse can get back to you guys.

We'll move right on to Mr. Baylis.

You have five minutes.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

I'd like to explore a bit more the concept of prescriptiveness.

I think, Mr. Messer, you brought up the idea about being more principle-driven, as opposed to having rigid and complex directives. Could you expand a little bit on that?

[David Messer]

Certainly. When you look at PIPEDA, businesses can look at it and figure out whether or not they are in compliance. They usually don't have to hire a lawyer to do that, and they have a relationship with the Privacy Commissioner, to whom they can reach out. It's much more of a partnership to make sure they're in compliance.

A more principles-based approach along those lines for CASL would help businesses be more willing to reach out and make it easier for them to comply, as opposed to saying, “Is this far enough along that it is a transaction? If I say these words, does it count as commercial?” There are a lot of very finite details, and it's difficult to tell.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

I imagine in a world where things are changing so fast, for example, that it becomes even more important. It would be very difficult to be prescriptive and capture everything, so principles might apply even more if it's a highly dynamic world, with such things as electronic messaging, Facebook, Twitter, and all that.

[David Messer]

Yes. A principles-based approach will give companies a little more confidence that they are leaning this way or that way, so they'll be able to have confidence in their decision and then develop a history and guidance to help them. For instance, if you use a hashtag in a transactional message that says your company's name, does that mean it's partly an advertisement? There are a lot of questions to which there aren't really clear answers. From my members' experience—

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

It's very difficult, as I believe the hashtag might not even have existed when the first draft of this came around. So it would have been hard to be prescriptive on that, and so where does it fall?

Your argument about principles is understood.

I believe, Mr. Fekete, you were making exactly the same argument. Would that fall in line with what Mr. Messer is saying?

[Michael Fekete]

Let me give you two real-life examples.

The law tells you how you must request express consent.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

So it has to be this way.

[Michael Fekete]

You have to say this is my business name, and this is my mailing address and either my email address, my web address, or my telephone number. And I must say that you have the right to withdraw consent, or you can withhold your consent, or pull it back later.

If I don't ask it in that specific way, with that information, the consent is not valid, so—

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

So even to the point of the way you unsubscribe, or the way you ask for consent, it's so prescriptive that it may not.... For example, if Twitter were advertising, I couldn't get that into Twitter. I doesn't fit the 127-character limit.

[Michael Fekete]

That's a great example.

Another example is on implied consent. I'm in full agreement with Dr. Geist that we need a strong consent regime, but there has to be a willingness to look at the circumstances and ask whether it makes sense for this small business to send a message to a customer based on a prior relationship.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

On that issue, then, it can't be too prescriptive, because you don't know what's coming. You would agree with Mr. Messer, then, that we should look more at principles rather than be highly prescriptive in those areas.

[Michael Fekete]

Absolutely. If I've made a purchase within the last two years, you can send me a message, but if I've subscribed for a free service—I didn't buy anything—maybe you can't send me a message. I say “maybe” because we're left scrambling to interpret the law. It's too prescriptive to make sense to business, let alone to the legal community who have to interpret it.

[Adam Kardash]

You could make changes consistent with Mr. Fekete's comments, and there's a ton of common ground with Dr. Geist. It might not appear that way, but there really is. You could make a series of tweaks to eliminate some unnecessary wording, to clarify the ambiguity—