Transport Committee on May 9th, 2018

[Robert Aubin, NDP, Trois-Rivières, QC]

Thank you, Madam Chair.

Five minutes for the two of you is really too short. So, let's get into it.

I want to return to the fundamental element here, the notion of consent. I'm not sure I'm able to count the number of times I have tried to read a full consent form. Every time, I end up agreeing without having understood anything, because the wording is absolutely arcane to me, and the contracts are usually very long.

Here is my first question: What can and should the government do so that those who give consent are doing so in an informed manner?

Buying a car is a major investment. People are usually so excited that they often agree to the terms and conditions without really knowing what they are agreeing to.

[Daniel Therrien]

Users don't always need to give consent, but they do so when it is appropriate, for instance, granting access to their contact lists when their cellphones are plugged into their cars. That is why we established preliminary guidelines that will very soon be finalized. These guidelines aim to ensure that car manufacturers and other companies focus on certain key elements, when developing their privacy policies, to give users a more informed understanding of what they're consenting to. I won't go into the details right now, but, with our guidelines, companies will have to focus on four key elements that consumers will have to be able to understand, so that they can give informed consent.

This doesn't really apply to today's extremely high-tech vehicles, but there are certain situations where giving consent is appropriate.

[Robert Aubin, NDP, Trois-Rivières, QC]

My second question addresses the same issue as Mr. Hardie's question, but goes a little further.

When I buy a vehicle like that, will I be able to refuse to consent to sharing my personal information, without this having an impact on the other built-in functions of the vehicle?

What would happen with my consent, whether I have given it or not, if I were to leave Canada and go to the United States, for instance, where the legislation we've passed would not apply?

[Daniel Therrien]

Again, we have to distinguish between security procedures for vehicles and means of transportation, where giving consent is less relevant, and uses such as individuals' entertainment and location systems, where giving consent is relevant.

When Canadian automotive dealerships sell cars to Canadian consumers, they are required to have privacy protection policies that abide by Canadian law. I imagine that vehicle manufacturers could give drivers the option of changing their vehicle's parameters based on the vehicle's location, for example, if a driver were to leave Canada and go to the United States. But manufacturers could also make sure that the parameters that apply in Canada, apply elsewhere as well. I don't think that the law compels manufacturers to configure any given set of parameters.

What is certain is that Canadian law applies in Canada. When drivers leave the country, the manufacturers will probably be the ones who decide if the Canadian protections follow the vehicle, or if American law applies.

[Robert Aubin, NDP, Trois-Rivières, QC]

I imagine that it is the Canadian government's duty to harmonize its consent policies with those of the United States.

[Daniel Therrien]

Yes, but harmonization isn't simple.

[Robert Aubin, NDP, Trois-Rivières, QC]

I don't imagine so.

European legislation, which you probably know far better than I, applies the concept of privacy by design. Is there something similar in Canadian legislation? Is this the way to go?

[Daniel Therrien]

Actually, the concept of privacy by design is a Canadian invention attributed to Ontario's former privacy commissioner. European lawmakers imported it, and will include it in their legislation in a few weeks.

It isn't a direct requirement in Canada. However, Canadian law has the principle of accountability. Companies must be held accountable for how they handle data. With this concept, we introduce the notion of—

[The Chair, Liberal, Judy Sgro]

Thank you very much, Mr. Therrien.

[Daniel Therrien]

—privacy by design.

[The Chair, Liberal, Judy Sgro]

I'm sorry, but I have to cut you off. Everybody is trying to get a few questions in here.

Mr. Iacono.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

Thank you, Madam Chair.

Thank you, Commissioner.

With Facebook, we have seen the reality of data collection.

How can we and should we legislate to protect our drivers' and citizens' data?

[Daniel Therrien]

We are investigating Facebook, so I won't go into the details of that matter. However, it seems that there is a problem regarding the scope of consent, which is an issue we are revisiting.

First, we can protect Canadians by having clearer rules around consent. We are in the process of developing guidelines for this.

Second, it's mostly an issue of ensuring that companies truly comply with the principle of accountability I mentioned earlier. That is when the issue of the Office of the Commissioner's powers comes into play. Companies must be held liable according to federal law, but they are seldom monitored by independent third parties, in this case, the Office of the Commissioner. That is why we are, first, asking for the power to perform audits, and, second, for credible penalties for companies that violate privacy protection laws.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

Are you referring to a consent model? Is that what you're describing precisely?

Is this about the definition of consent, or is it making reference to something else?

[Daniel Therrien]

I'm now referring more to the accountability principle.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

Okay.

[Daniel Therrien]

In a complex thing like a connected car, consent is valid for certain uses of information, but for others, such as the proper functioning of a very complex technological car, it's more the accountability principle that's at stake. Companies have an obligation to be responsible. That's a good start, but we see that it's also important to have independent verification of whether companies are truly accountable, which is why I'm saying my office needs greater authority to verify and to sanction.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

What is, according to you, the appropriate balance to have between the information flow and the privacy protections?

[Daniel Therrien]

I think it depends on the collection and use of the information. Where information is collected, as I've been saying, for purposes of car safety or transportation safety, privacy should have a lesser weight in the balance. When information is collected about the communication system, the link between a telephone and the car, privacy should have a greater weight in that circumstance.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

Could you elaborate a bit more? When you say the time has come to have more privacy laws in order to protect personal information, what exactly do you mean by that?

[Daniel Therrien]

Again, where the use of data is in the context of the technologically complex device or a car, for instance, but it applies in other situations, accountability is important, but we cannot rely exclusively on companies being accountable. There needs to be a third party able to verify and sanction inappropriate conduct.

To me, a solid privacy law in 2018 includes the ability for the regulator—here the Office of the Privacy Commissioner—to verify that companies are actually accountable and, if they are not, to sanction them for that.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

Thank you.

[The Chair, Liberal, Judy Sgro]

You have three minutes, Mr. Fraser.

[Sean Fraser, Liberal, Central Nova, NS]

Excellent. Thank you very much.

I find this whole thing fascinating. There are a number of legitimate uses of personal information which you've flagged, but there are some things which I envision we could get into. You could be dealing with automated vehicles in a car-share type of scenario further down the road. You might even get to new urban design principles that would help with traffic flow. You might monitor the locations of cars to make sure they arrive when people are taking off for work and going somewhere in the evening.

Are there challenges to the successful implementation of a regime that might know where a person like Joe is going without necessarily disclosing what Joe specifically is doing, so to speak? Is the one legislative change to allow you to proactively investigate industry really the only legislative tool you would need to complement our existing laws, to allow companies to do all the good things with this information without compromising privacy?

[Daniel Therrien]

Well, I think here that the issue of de-identification becomes very relevant. That there is communication of information between a car and its environment to better manage the flow of vehicles, for instance, makes sense.

The first thing that should happen is a credible attempt to depersonalize that information so that it can serve its useful purposes without disclosing the location of an individual. That should be possible in many cases if rigorous methods of de-identification are used. That's certainly part of the solution.