Industry Committee on May 21st, 2020

[Eric Johnson]

When he says contact tracing, I'm assuming it's proximity tracing that we're talking about, what Mimik was talking about. I think the position we've taken is that it's very much a consent model, much to what Fay said. You as the end-user should have the decision on your data and on whether you opt in or opt out.

[Earl Dreeshen, Conservative, Red Deer—Mountain View, AB]

Thank you very much.

[The Chair, Liberal, Sherry Romanado]

Thank you very much.

Our next round of questions goes to MP Lambropoulos.

You have six minutes.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thank you, Madam Chair.

Thank you to all our witnesses for being here with us to answer our questions.

My first question is for Google Canada. Obviously, protecting Canadians and the privacy of Canadians should be the priority. In a statement that you, alongside Apple, issued earlier this month, you did mention that there are strict guidelines in order to protect the privacy of Canadians. Can you please go into detail about what has been put in place in order to protect the privacy of Canadians?

[Colin McKay]

I think that a lot of what I'm about to say will echo what Madame Arjomandi just said.

When we're talking specifically about the exposure notification API, there is on-device collection of information that is not shared without the consent of the user. They first have to take the step to download an app and then give permission for that information to be collected. Importantly, the information that is collected about their location is actually anonymized and randomized. It's not associated with the individual or the device. Rather, it is a reference point for public health authorities if there happens to be a person who has been notified that they're positive for COVID-19. Throughout the process, we're taking specific steps to provide information about the proximity contact of individuals without actually sharing the personal information of those individuals or creating a long-term record about either their travels or their location.

I'd also like to follow up by underlining that we've made an explicit commitment with both the exposure notification API and the community mobility reports to shut those programs down once public health authorities have signalled that the current crisis is under control. Now, it's up to the public health authorities—I don't think we have a definite timeline on that—but we have made that commitment to alleviate any concerns about this being a long-standing complication on your device.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thank you very much.

From what I understand, there are two phases. Phase one began in May, possibly yesterday, I guess. The application is now available for Canadians to download. It seems that phase two will be more broadly used a few months from now. Can you explain the difference between the two phases and how this may compromise, in some way, the privacy of Canadians?

[Colin McKay]

Really, it's a technological progression. The reality that exists right now is that we need an application programming interface so the public health authorities can develop the apps that allow them to build that relationship with the user and request that they allow tracking through Bluetooth.

As a second phase, we're pushing out modifications and improvements to the operating systems on the device itself, so that much of that work is being conducted through the operating system. It's a technological improvement rather than an expansion of the program or its capacities.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thank you very much.

Do we know if contact tracing has been used before to track diseases and to ensure low infection rates? Do we think this is a good way forward that would actually help slow the progression of this disease?

Google or IBM, I guess, has this ever been used in the past?

[Colin McKay]

Speaking from my point of view as a one-time history student, it has been used in the past. I can't give you any judgment on whether or not it's effective and how we contain the virus.

What I'll state is that we, at Google, are certainly an environment where we're recognizing that we need to modify our services and provide tools to public health authorities so that they can explore options. We are recognizing the opportunity and then trying to react to it in a constructive way, while recognizing our obligations to the users.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thank you very much.

I know that it depends on what the health authorities ask for, and we're trying to protect Canadians as much as possible, but what specific information will these apps allow us to gather?

[Colin McKay]

If that's directed to me, I can't speak to the specific apps. What I can speak to is that at Google, what we'll be exchanging is anonymous Bluetooth beacon information that enables the apps to identify and then notify individuals who have been in proximity to each other. As for the apps themselves, it will be up to the public health authorities to decide what sort of information they are going to request from users.

I will note, however, that we've made it a specific requirement of using our exposure notification API that app developers cannot request personal information; they can't associate it with the Bluetooth information. They also cannot request specific location information from the device alongside the exposure notification API.

What that means in practice is that there could be an app that only interacts with the API, then a separate app that does a lot more on behalf of the public health authority. That would be separate from Google services.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

The Privacy Commissioner of Canada requested, along with its list of requests, that the app be decommissioned once this crisis is over. Do we know of any plans to do so once the crisis is over?

[Colin McKay]

As far as I know, there aren't any apps deployed with the exposure notification API. We're certainly in contact with public health authorities about this. That's something for the app developer to discuss with the privacy commissioner in their jurisdiction.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thank you very much.

[The Chair, Liberal, Sherry Romanado]

Mr. Lemire, you have the floor for six minutes.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Madam Chair.

My question is for Mr. Perron.

How safe can we feel with our telephone? Can we assume that we're under constant electronic surveillance? Is that a myth or a reality?

[François Perron]

Yes. We have some very clear evidence that the telephone can keep a record of conversations and geographic locations. There are also acceleration sensors, which make it possible to better understand what the person is doing. Increasingly, algorithms help identify an action verb associated with what the person is doing.

A telephone can undoubtedly be used to do what you've just described.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

This week, Radio-Canada published an article stating that Facebook had to pay $9 million for making misleading claims regarding confidentiality. The article quotes Matthew Boswell, the commissioner of competition:

The Competition Bureau will not hesitate to crack down on any business that makes false or misleading claims to Canadians about how they use personal data, whether they are multinational corporations like Facebook or smaller companies.

Is the current legislation stringent enough for companies?

[François Perron]

Again, I must put my response in context.

I'm much more familiar with the part of Quebec's legislation that applies to software used in the health care sector. In this context, the matter involves the use of personal information by public agencies. In these cases, clearly, we must obtain explicit consent for each use or purpose of the personal information provided.

In Quebec, the health legislation is stringent. However, in the private sector, it's a different story.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

As you said, we can't assume that users will be thoughtful in terms of their own protection. You spoke of a combination of measures. I seem to recall that you spoke of an “ecosystem” earlier. Can this ecosystem help us develop free and informed consent that applies to a specific context, such as the COVID-19 context, of course?

[François Perron]

This ecosystem will be spontaneous. We'll see a growing concern. Your question can have two parts. First, the public will take an interest in the issue and will start asking questions. The players in the ecosystem can explain the ins and outs. What issues are being raised and what can we do to protect ourselves? Second, it will depend on how the ecosystem is structured and on how well the ecosystem meets the standards in place. The question touches on very clear concepts of public education and information.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

In response to COVID-19, a company by the name of Mila has taken an interest in developing a location tracking app that uses Bluetooth.

In a situation where the greater good, in other words, public protection, is at stake, how can we make sure that someone who tests positive isn't automatically recorded in the system if they aren't a consenting user?

[François Perron]

That's a very specific question, one that raises the question of second-class citizens. All of a sudden, extra information about these people is available.

Obviously, if a company puts out an app for the public that is deemed to contain people's personal and health information, the technology will be governed by clear legislation, in Quebec's case. Options include asking users for their express consent or ensuring information owners are always the ones deciding who the information goes to and have the ability to withdraw their consent and recover their information. I'm much less familiar with how the law applies in the private realm. On the public side, an app deemed to contain personal information goes through phases of certification. Watchdogs ensure the app is compliant.

Again, the information will have to be categorized to determine whether it constitutes personal information or health information, which isn't at all clear right now. That's one of the questions that will have to be answered in order to classify the app.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Canada's federal and provincial privacy commissioners got together and issued a joint statement on May 7. In it, they say, “The choices that our governments make today about how to achieve both public health protection and respect for our fundamental Canadian values, including the right to privacy, will shape the future of our country.”

Is it therefore conceivable that the decisions we make today, even the most minor initiatives, could become permanent?

[The Chair, Liberal, Sherry Romanado]

Please keep your answer brief.