Good morning Mr. Chairman and committee members.
Thank you for inviting our office to address you on the privacy implications of camera surveillance as used in commercial applications, such as Google Street View and Canpages, and on other issues related to surveillance and new technology.
I am joined today by Carman Baggaley, our senior strategic policy adviser, and Daniel Caron, legal counsel. Unfortunately, Commissioner Stoddart can't attend today. She has laryngitis. I think this is a first for her, not attending.
We very much appreciate the committee's interest in this issue. We also followed your hearing on June 17, 2009, at which representatives from Google and Canpages appeared. We welcome the opportunity to discuss this interesting development in technology.
The Personal Information Protection and Electronic Documents Act, PIPEDA, is a technology-neutral law that does not, in our view, thwart the innovation of new technologies. We've sought to ensure that PIPEDA is a dynamic, modern, and effective tool for strengthening the privacy rights of Canadians. And we believe that PIPEDA can cope with the commercial collection and use of personal information through street-level imaging technology.
We're very much aware that the many services that use street-level imaging are very popular with the public. Our ongoing concerns about the commercial use of this technology really centre on ensuring that it protects the privacy of Canadians by meeting the requirements of PIPEDA, such as knowledge, consent, safeguards, and limited retention.
I would like now to briefly recap our office's involvement in the issue.
The Office of the Privacy Commissioner of Canada has been closely following, for a few years, the development and use of online street-level imaging technology by companies operating in Canada and elsewhere. As I indicated, such technology has potential privacy concerns, and we wanted to know more about it and how it would be deployed in Canada.
Street-level imaging applications use various means of photographing the streetscape. A camera is typically mounted on a vehicle that's driven down a street. The images are then shown on the Internet as part of the company's mapping application. Although the company's interest is to capture a streetscape so that users can take a 360-degree or virtual tour of a particular neighbourhood, the companies are also capturing images of identifiable individuals and tying those individuals to specific locations.
We began to monitor the issue in 2007, when we learned that Google was photographing the streets of certain Canadian cities, for the eventual launch of its Street View application in Canada, without the apparent knowledge or consent of the individuals who appeared in the images.
The commissioner wrote an open letter to Google outlining her concerns about the Street View application. She took that opportunity to point out that if companies like Google wished to use this technology for commercial services in Canada, there was private sector privacy law that would have to be adhered to, and stronger privacy protections would have to be put into place.
I would like to address a common misconception that some companies have about photographing people in public places. If an organization takes a photograph of an individual in a public place for a commercial purpose--for example, when a company, in the course of photographing a streetscape, captures an identifiable image of a person and that image is uploaded onto the Internet for a commercial reason--Canadian privacy law still applies. One of the key protections is that people should know when their image is being taken for commercial reasons and what the image will be used for. Their consent is also needed. And while there are exceptions under the law for the requirement for consent, they are limited and specific, and they concern journalistic, artistic, and literary pursuits.
Street View has now been launched in Canada—it went live on October 7—as well as in other countries. The Canpages service, called Street Scene, was launched earlier this year in certain cities in British Columbia. Canpages is seeking to expand its service to other Canadian cities and has recently provided notice that it is photographing streets in Montreal and Toronto.
Our office and our provincial counterparts with substantially similar commercial privacy laws, Alberta, B.C., and Quebec, have been in contact with both companies about their street-level imaging and mapping applications. Early this year those provincial privacy commissioners and our commissioner issued a fact sheet, which I believe you have a copy of, for industry and the public on what we think needs to be in place for these commercial services that use the technology to be in compliance with Canada's privacy laws.
This fact sheet, called “Captured on Camera”, details the privacy protections that are particularly pertinent in the case of street-level imaging. Among these are that citizens should know in advance that street-level images are being taken, when, and why, and how they can have their image removed if they don't want it to appear online. This could include visible marking on vehicles--and if you've seen the Google car you'll see that it's well identified--notification that the streets are being photographed through a variety of media, outlining dates and locations, the purpose of filming, and how people can contact them with questions.
We also think that faces and licence plates need to be blurred, so that the individual is made anonymous or is at least not identifiable. Companies need an effective and quick take-down process whereby an individual can have their image removed. Unblurred images retained for legitimate business purposes should be protected with appropriate security measures and the raw data should not be retained indefinitely.
We've seen changes to how the technology is used that are more respectful of privacy, and we played an important role in encouraging these changes, not only in Canada, but worldwide. Images of people and licence plates are blurred, but the process of doing so needs to continue to improve and evolve. Take-down processes have been established. The need for clear retention periods has also been addressed by Google.
Companies have solicited the views of umbrella community organizations about any possible sensitivity to filming in certain locations, such as shelters or clinics.
Notifying the public is an ongoing concern. We believe the nature of the information collected is not especially sensitive and that companies can rely on implied consent, provided they give reasonable notification to the public in the form of outreach. Individuals need to know in advance when the organization will be photographing their neighbourhood so they can adjust their plans accordingly.
As you know, the purpose of PIPEDA is to balance the individual's right to privacy with the organization's need to collect user-disclosed personal information. PIPEDA applies to a wide range of businesses, from banks and telecommunications companies to car dealerships and to the local neighbourhood store. It also applies to social networking sites.
The law is not prescriptive; rather, it requires that organizations adhere to a set of fair information practices or a set of principles. Each organization, given its business model and other regulatory requirements, has to find ways to adhere to the principles and achieve the balance between its own legitimate needs and the rights of individuals to their privacy. The Office of the Privacy Commissioner works with organizations to help meet their business objectives and their obligations under PIPEDA. I'd be very pleased this morning to talk to you about Facebook as a good example of that.
As I indicated earlier, PIPEDA is a technology-neutral and principle-based law, and so far it appears to be flexible enough to guide commercial uses of new technology. As you're likely aware, over the summer we released findings in two significant complaints originally filed in 2008, in which technology and new business models featured prominently. One, as I say, involved Facebook, and the other the use of deep packet inspection, or DPI, by a telecommunications company. Under PIPEDA, we were able to strike a reasonable balance that serves as a road map to help us face new privacy challenges on the horizon. These findings will have a positive impact on the privacy rights of Canadians and indeed on 300 million people worldwide who are users of Facebook, while at the same time acknowledging business interests.
What we have learned in the past 18 months through our work in street-level imaging, social networking sites, and deep packet inspection will help us significantly, and we believe these examples have served to raise the profile of privacy for business and average Canadians.
As we note in the PIPEDA annual report for 2008, new technology, for all its indisputable benefits, continues to pose privacy challenges. Indeed, our office is planning to explore over the next year the privacy implications of three significant technologies: behavioural advertising, cloud computing, and geospatial technology. We will be seeking the views of business, academics, advocates, and regular Canadians in order to better understand how PIPEDA applies to these technologies and business practices and their impact on privacy.
Since we were asked to appear, we tabled our 2008 PIPEDA annual report—and I understand that you all have copies. The main themes of the report are really a shout-out to youth, a reminder that Canadians need to take control of their personal information on the Internet. We think youth are particularly vulnerable, because they're big users of technology and may not realize the risks. Therefore, as our report indicates, we really focused this year on public education activities to reach out and talk to that demographic.
We've passed out some stickers for you that say “Think Before You Click”. We distributed those during frosh week. We also have many other tools. We have a youth blog and videos produced by youth, so we have youth talking to youth. You can find all these tools on our website, youthprivacy.ca. The federal, provincial, and territorial commissioners passed a resolution in 2008 on youth privacy, advising what individuals and organizations need to do.
Lastly, the other main issue I would highlight in the annual report is the matter of data breaches and notification. As you know, this is a global issue. Governments, organizations, and data protection commissioners are really grappling with various models, including mandatory breach notification.
The report highlights a study we conducted on our current voluntary reporting regime. I'm happy to talk about it more, but what it confirmed is that we can't possibly be receiving reports from businesses about all significant privacy breaches in Canada; there's just no way, because the numbers are relatively low. It underscores also the ongoing need for training, because one-third of the breaches reported to us were not the result of hacking, of technology breaches, but really simple employee errors, such as dialing the wrong fax number.
In conclusion, I would like to thank the committee for inviting us today to discuss privacy, street-level imaging and other new technologies.
I'd like to thank the committee for inviting us today, and I welcome your questions.
Just very briefly, these two cases deal in general terms with videotaping on private and quasi-private premises. In the case of Milner, the complaint the plaintiff had was that there was a vehicle outside their house taping the activities that were going on in and around the house for the purposes of understanding whether there was a bogus disability insurance claim. In Heckert, the plaintiff's complaint was that there was a camera at the end of her hallway in her apartment building that could obviously tape her entering and exiting her apartment.
In the case of Milner, it was found that there was a lawful interest with respect to the defendant insurance company's ability to be able to monitor the activities to establish a fraudulent claim. I think it's quite interesting in obiter that the judge, as he or she was then, mentioned that in the process of taping, the daughter of the plaintiff was seen semi-dressed, and had she advanced a claim, it would have been problematic for the defendant. It raises issues that my colleague talked about earlier about whether what they do with this information is secure.
In the Heckert decision, the most recent one, it was found that there was a reasonable right to privacy in entering and exiting one's home. Those activities were captured, and that judgment falls within violation of the law as it stood in 2008.
These are interesting because they deal with the fuzzy line between the private and public domain. In Milner it was found untenable that the private domain could be analogous to a public place—at least, this is what the critics were saying. It's obviously not what the judge felt. In both cases the factual matrix is clear. Video surveillance by a defendant with a legitimate interest in information that might be secured from it has to be balanced with the plaintiff's interest in what information is being recorded and how that's stored, and how the person performing the surveillance might be dealt with.
I'm not sure the Privacy Act provides a bright line here. This is relevant to our discussion today and certainly builds on my colleagues, because Google Street View and other groups like that don't have a nexus like these cases. There's no direct-connection test here with respect to their rights to privacy, whether it's a lady who's concerned about the tidiness of her garage or other activities, directly or unintended, by consequence of surveillance.
I have a couple of questions. Since counsel may not be familiar with the cases, I'll broaden my question. Has PIPEDA been affected by these and/or other court rulings in preparation for this kind of technology? If so, how will you be adapting in light of these kinds of cases from the common law, whether they flow directly from the decisions or as they may be raised as issues in obiter?
On the point, the member is quite right in terms of the applicability of our mandate. I have ruled on this many times in the past, and we can only deal with public office holders as defined.
Some members of Parliament are public office holders, but not all members of Parliament. The reverse, though, is public office holders who are elected--ministers and ministers of state, parliamentary secretaries--are all members of Parliament. Because the last part refers to meeting the ethical standards from public office holders, that standard can't be applied to members of Parliament who are not public office holders.
Technically, I think it's workable, but it would have been maybe desirable to include, after the words “members of Parliament”, the phrase, “who are public office holders”. That would have resolved it.
I'm going to allow the discussion to carry on, since a simple clarification would be possible, but there is no question that should this matter proceed it would only relate to the incidents that involved ministers, ministers of state, or parliamentary secretaries. All other members of Parliament would not be party to any of the discussions.
On the point of order, I'm not going to sustain the fact that the motion is out of order or outside our mandate, pending resolution of the point that the member has raised, which can be simply resolved.
The member has put this motion before us. Do I have to read it into the record, or should we just assume everybody has it? Okay.
Madam Freeman, are you prepared to move your motion this morning?
This issue is one that I and my NDP colleagues take very seriously. I think it was a New Democrat who first raised the issue last week about the way some public office holders, some members of the governing party, were using these public announcements of government spending and attributing them to the Conservative Party or to themselves personally. It is a very serious issue.
I don't think anybody would deny the government the ability to promote the work that it's doing and the spending that it is putting into communities, but I think a line is crossed when that's directly attributed to a political party or to an individual public office holder or MP. That's not to deny that those folks don't have a role in advocating for government spending in their constituencies and have often played a role in ensuring that some of that money flows that way. That's all entirely appropriate, but to attribute it directly to the efforts of that individual or that political party specifically right down to the dollars and cents has crossed a very serious line.
I'm pleased that my colleague Peter Stoffer raised this last week with regard to some of these incidents that happened in his home province of Nova Scotia and that he raised it with the Ethics Commissioner. It is one of the complaints she has received and one of the reasons she is beginning her investigation.
I think there are some issues that need to be clarified in the motion, however. You pointed out the one issue, and the parliamentary secretary did as well. We need to be clear that we're dealing with public office holders. I think that phrase you mentioned should be included in the resolution after the phrase “Conservative members of Parliament”. I think we should add “who are public office holders” to that, to be absolutely clear.
You also highlighted the phrase “partisan use of public funds”. I think that's an interesting one, because it is confusing. For me, it's the issue of partisan attribution of public funds. I would be much happier if the word “use” were replaced by “attribution”, although there may be issues with the use of public funds to prepare these partisan mock cheques. I have heard allegations that some of those props were actually produced through parliamentary resources. It may be that we need to say “use and attribution” in that phrase.
Chair, I also want to speak to another issue, and that's the issue of confidence in the ability of the Conflict of Interest and Ethics Commissioner to undertake this investigation. I'm concerned that for us to undertake this investigation or study immediately would reflect on our confidence in her ability to undertake the investigation that she's already told us she is engaging in. I am concerned that we not show any lack of confidence in her. There may be concerns about her mandate. There may be concerns about the extent of the legislation under which she has to operate and her ability to operate under that. But I do believe we should allow her to do her job before we undertake that and see what she comes up with. We'll see if she is able to come to a helpful conclusion to that investigation and see that there is a remedy she has available to her, given the complaints she's received. I know she has raised the point that she doesn't have a broad ethical mandate, but she does have some specific powers, and she has accepted the complaints she's received and announced that she's doing an investigation. It seems to me she does believe there is some area for her to be interested in in this situation already.
With all of those things in mind, I'm going to propose an amendment. I'd like to propose that in the phrase where it says “partisan use” that it be amended to add “and attribution of public funds”, so it would read “the study on partisan use and attribution of public funds”.
After “Conservative members of Parliament”, I'd like to suggest that we add “who are public office holders” at that point, so it would read “Conservative members of Parliament who are public office holders”.
I'd like to add at the end of the resolution the following:
In recognition of the investigation currently under way by the Conflict of Interest and Ethics Commissioner, that this study not commence until such time as the commissioner has reported her findings.