Industry Committee on May 21st, 2020

[François Perron]

In a nutshell, the answer is yes. Everything is moving at a breakneck pace right now. We're communicating by video conference, so where do the data collected by the video conferencing system go? Is anyone making sure that the data stay in Canada?

Questions abound, but we're moving so fast that it's impossible to have all the answers. It's a slippery slope, and problems could arise. I wholeheartedly believe that.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Perron.

[François Perron]

Thank you.

[The Chair, Liberal, Sherry Romanado]

Thank you very much.

Our next round of questions goes to MP Masse.

You have six minutes.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Madam Chair.

I'll have a question for every witness. There will be a part (a) and a part (b). I'll set it up and then go through the list so that they can answer appropriately.

Back in March 2018, I tabled Canada's first digital bill of rights. It was an attempt to start the process and a discussion on a more formalized updating of our regulations, laws and agencies, with an overall feeling, I guess, that Canadians would be confident that their digital rights would be respected, similar to their physical rights. It was about empowerment and, as well, controls and issues such as net neutrality. There was a series of different things, but the most important is to have a predictable pattern, I guess, so that businesses, not-for-profits, governments and also other institutions from around the world will understand that Canadians are protected in a very specific and very tangible way, empowered by law.

We've seen a number of different issues come up with this COVID response, with everything being discussed, and now, even tracing. Last night, we had interesting testimony with regard to fraud, which was very important. This is part of the question.

I look at some of the issues and at the Competition Bureau, for example, when we talk about online information. They just fined Facebook for $9 million—it's $5 billion in the United States—for misleading Canadians in using third party applicants and allowing private information to be dispersed. The Competition Bureau here is only at a $9-million fine versus $5 billion.

The Privacy Commissioner has already said specifically that they need more resources and money with regard to doing their job in terms of the challenges they face. Look at the CRTC. Even before now, it has taken ages to get an answer or a decision and, also, enforcement on public policy issues related to Internet use, service rates and expansion.

My questions for the guests are: (a) Do you accept, support or reject a digital bill of rights that could be brought forth in some capacity, with everybody involved, to finalize a position and to have at least an understandable sound grounding of what that means for each person and also for the responsibilities of companies? (b) Do government agencies and does the respective legislation need modernization or updating? You don't have to get into the specifics of that, but I'd like to hear about those things.

I'll start with the order of presentation, so perhaps we can start first with CyberQuébec. First, do you accept, reject or support a digital bill of rights? Second, what is your position on whether government agencies need modernization, or are they capable right now?

[François Perron]

It's hard to give a clear and comprehensive answer. There's no doubt in my mind that the current legislation is incomplete. I alluded to that earlier when I said I wasn't very familiar with the private protection regime. I'm much more familiar with the public protection regime, seeing as I work in certification on the public side.

The legislation needs more teeth. That's my personal opinion. I pay attention to what Europe, in particular, is doing. There, the General Data Protection Regulation is in place. Under the regulation, companies that fail to report privacy breaches involving personal information are fined. I would say it's important to move in that direction.

I missed the nuances of the second part of your question. As I said earlier, the current legislation needs to be strengthened so it has more teeth.

[Brian Masse, NDP, Windsor West, ON]

That's great. Thank you, Mr. Perron.

Next is Google.

Mr. McKay.

[Colin McKay]

Thank you for the question.

Yes, I think I remember your bill and when you tabled it. There are many elements that are complementary to the conversation we've been having, up until this crisis, around reforming Canada's data protection laws.

I want to underline that there's certainly a conversation that we had around PIPEDA, but also around the Privacy Act, especially in the context of the conversation we're having today in regard to modernizing and recognizing, as many of witnesses have reinforced, the need for explicit consent from users, and then, in defined circumstances, for the use and then withdrawal of data that has been shared. So I think my answer to you is yes, and I think we've seen some of those paths begin.

On my answer to your second question, as we can see from the Competition Bureau's decision, there are specific roles, responsibilities and penalties that already exist within our system. You hinted in your question they may not work at the speed and the breadth that some of us may want. Google certainly is working globally around levelling the playing field on data protection, as well as consumer protection, and we're a participant in those conversations. There's certainly space to grow in Canada.

[Brian Masse, NDP, Windsor West, ON]

Okay, thank you.

Next is Mr. Johnson from IBM.

[Eric Johnson]

I would echo Colin's comments. We would obviously support the modernization of it. It's all about trust and transparency, and that's what we have to build. We've seen it in Europe, like you mentioned, with the GDPR. We're supportive of going down that path.

[Brian Masse, NDP, Windsor West, ON]

Thank you.

Next is Madam Arjomandi, from Mimik.

[Fay Arjomandi]

Absolutely we support it. In fact, in 2017, we published a digital manifesto about personal data, and a few months ago, we published consumer analytics for data robbery, because we believe that data belongs to us. In fact, it should be treated as a form of income for us versus just generating income for others.

Also, we believe that we're facing not only data privacy but data piracy, and consent is not enough. We need to be engaged with our data and give permission for use of our data every—

[The Chair, Liberal, Sherry Romanado]

Thank you very much, Madam Arjomandi. Sorry, but that's all the time we have for that round.

The next round of questions goes to MP Rempel Garner.

You have the floor for five minutes.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Thank you, Madam Chair.

My questions are for Mr. McKay.

I'm looking at YouTube's community guidelines related to the COVID-19 medical misinformation policy. It says that YouTube doesn't allow content that spreads medical misinformation or contradicts the advice of the World Health Organization or local health authorities. Does this mean that Google and YouTube are now taking responsibility as a platform for determining truth about public health information during a pandemic?

[Colin McKay]

No, we're looking to public health authorities, who have the experience and the expertise to provide guidance on what they consider authoritative information.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

If you're not looking to take responsibility, then why do it?

[Colin McKay]

Sorry. Do you mean why apply the guidelines and battle misinformation on YouTube?

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Yes. I guess I would contextualize the question.

In January, the World Health Organization said there was no evidence of human-to-human transmission of the coronavirus. Would YouTube have removed a video questioning that at that point in time under this policy?

[Colin McKay]

I'm sorry. I can't speak to possibilities. I can only speak to the practical experience we've had.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Sure.

In that practical experience, would that community guideline have applied to videos or users talking about using masks to prevent the transmission of COVID-19 when the WHO was quiet on that issue?

[Colin McKay]

The policy itself is applied to instances where there's an explicit threat to personal safety or health and where there's the possibility of personal injury. In the case that you're describing on the use or non-use of masks, we would still turn to the WHO and public health authorities to give us guidance.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

I'm reading directly from the policy, and it says the policy would remove:

content that contradicts WHO or local health authorities' guidance on:

- Treatment

- Prevention

- Diagnostic [and]

- Transmission

So I think it's a little broader than that.

Would this policy have applied to, let's say, someone who posted a video saying that border security measures do work when the WHO was saying that they don't work?

[Colin McKay]

We try to apply the policy as broadly and effectively as possible. The reality is that we're facing circumstances from day to day where we're dealing with misinformation on a much more significant scale. What you're describing here would sound in our conversation as something that would need to be deliberated, but at the time—

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Just as legislators.... I'm just wondering if this opens your company up to legal responsibility for determining what is the truth in a pandemic situation. I'm just curious why you're taking this position as opposed to just acting as a platform.

[Colin McKay]

We are acting as a platform, but we're looking to informed sources to give us the information so that we can ensure that authoritative information is going to our users. We also take steps—