:
Thank you, Mr. Chairman.
My name is Kevin Bartus. I’m the CEO and owner of Nexopia Incorporated, the operator of nexopia.com. With me is Mark Hayes, the managing director of Heydary Hayes PC. Mark is a well-known privacy lawyer in Canada who is advising Nexopia on privacy matters, and I would ask the committee’s indulgence in allowing Mark to join me in order to assist with any technical privacy questions.
Thank you for inviting us to join you today. I want to apologize in advance for any areas in which my knowledge is lacking. As you know, we were made aware of this meeting less than a week ago and we’ve only owned Nexopia for a month. That said, my own background in digital media is fairly extensive. I own and run Ideon Media, a Canadian digital advertisement network. I also own and run Maple Media, a Canadian digital publisher. I was the original vice-president of Digital Media for Rogers Media in Toronto, and I built one of the early dot-com web developers called Blue Spark.
Nexopia was founded, as many of you know, in 2004 by an Edmonton-based teenager as an open community for Canadian youth, a sort of MySpace for Canadians. The site grew rapidly and attracted professional investment a few years later. With the meteoric rise of Facebook, however, sites like Nexopia and MySpace retreated to a core user base. Nexopia had over two million members a few years ago, but focuses on a core of about 200,000 today.
Comscore Canada currently lists 70 social networking sites larger than Nexopia in Canada, including major U.S. sites such as Facebook, which has about 22.4 million monthly unique visitors, according to Comscore Canada in September 2012. LinkedIn has about 5.3 million; Pinterest has about 2.8 million; MySpace, 1.4 million. And there are sites that are closer to Nexopia's size, such as Tagged, with 219,000; Multiply, with 181,000; and Hi5 with 152,000.
Over the past few years, major newspaper, magazine, and broadcast media websites have introduced extensive social networking capabilities, allowing users to post personal profiles in addition to participating in online forums. Meanwhile, social networks like MySpace have begun to integrate original content relevant to their core audience. In MySpace's case, it's content like music and entertainment. The line between social networks and media sites has become blurry indeed.
Smaller sites like Nexopia generally focus on a niche, and Nexopia focuses on young Canadian adults, aged 16 to 24. The focus has worked. Nexopia members are more engaged than members on most other social networks, with about six minutes and 14 pages per visit, compared to an average of about five minutes and 10 pages for the Comscore category overall of social networking sites.
Nexopia fills a vital niche for young Canadians. In addition to being the only major Canadian-based social network, Nexopia allows young Canadians to meet others who may not already be in their offline social network, as opposed to Facebook and LinkedIn, which focus on real-world identities. This social discovery function of meeting people who users don’t already know is particularly important in Canada, where members may live in smaller physical communities and have trouble finding like-minded others. It's also critical for young Canadians who may not yet have been able to find like-minded others who share their experience.
Nexopia’s ambition is to be a clean, well-lit community place for social discourse, and as such, Nexopia is a rigorously moderated community. There are about 20 moderators who review every picture before it's posted, every forum post, and every abuse complaint.
Nexopia does not use profile or other personal information to target advertising. This is both a commitment to the community and also a practical reality, because such advertisement targeting really only works at a large scale. Advertisers who are interested in Nexopia’s demographic become less interested when the membership is subdivided into smaller and smaller segments, simply because there are then too few members to constitute a meaningful advertising campaign.
Partly because of Nexopia’s success among young Canadians and its open nature, Nexopia attracted the interest of the Privacy Commissioner in 2010, and in March 2012 the Privacy Commissioner issued a detailed finding.
This report includes 24 recommendations. In case you haven't read it, it's broadly in three areas: first, the completeness of the site’s privacy policy and the ease with which informed consent could be given; second, the openness with which profiles were being shared, particularly among non-members and with members who were not friends; and third, assuring members that when they leave the community, their data is permanently deleted.
For a number of reasons, the prior owners chose to sell the company following the release of the commissioner’s recommendations. I purchased Nexopia Incorporated from the prior owners on September 30, 2012—about a month ago. Since that time, we've been actively engaged with the Privacy Commissioner to ensure that all privacy issues are addressed.
Some of the required changes to the site will require significant time and development. We've worked out a schedule with the commissioner’s office for dealing with all of the commissioner’s concerns and expect to be fully compliant with the commissioner’s recommendations by April 30, 2013.
I'm happy to report that we've already completed the implementation of some of the recommendations.
We believe that young Canadian adults deserve an online home. In our view, this should be a clean, well-lit community with ample moderation that also integrates relevant content in areas such as music and entertainment. Nexopia members have been incredibly loyal over the past few years, and we intend to reward that loyalty with new investments in functionality and content.
Most Canadians experience the Internet primarily as a U.S. phenomenon, with a few local sites from Canadian newspapers and broadcasters. We are deeply committed to the belief that the Canadian experience is enriched with Canadian-owned and Canadian-operated websites. However, the scale economies of running an online business mean that the same costs in content and technology are simply spread over a user base and advertising market one-tenth the size of the U.S. This creates financial and technological hurdles that can be a challenge.
In the past year we have witnessed many of the large Canadian media companies backing away from advertising-driven, online-only initiatives. During 2012, Rogers Media closed down virtually every online-only acquisition it had made over the last few years, including branchez-vous.com, sweetspot.ca, and canadianparents.com. Also during 2012, Transcontinental shuttered WOMAN.ca, and Torstar closed parentcentral.ca. Last month, both Torstar and the Globe and Mail announced paywalls, which may or may not have been wise long-term financial decisions, but the resulting smaller audience will most certainly erode their ability to attract digital advertising. There are precious few successful online-only initiatives that focus on Canadian consumers and Canadian advertisers, and we are proud that Nexopia is one of them.
Canadian privacy regulations serve an important role in protecting Canadians and in levelling the playing field among digital corporations. But launching a major advertising-sponsored online initiative already takes significant capital resources and several years. I ask that you tread carefully when making this any more challenging than it needs to be.
Mr. Hayes and I would be pleased to try to answer any questions the members of the committee may have for us.
Thank you, Mr. Bartus and Mr. Hayes, for coming. We really are appreciative that you have come on relatively short notice. As you know, as a committee, we are looking at what steps we need to take as legislators, if any, in terms of ensuring that we're developing the incredible online potential for innovation and for communication, while also ensuring protection of Canadians' data.
We've learned again and again that our Privacy Commissioner has a very high level of respected expertise worldwide in being able to adjudicate these issues, probably much greater expertise than we parliamentarians do. We would prefer, at least in the New Democratic Party, to rely on the Privacy Commissioner's judgment as much as possible.
I understand that there were 24 recommendations following the investigation into Nexopia. You are now the new owner, so you are dealing with what was done before you came on.
We were under the impression, from reading the Privacy Commissioner's report, that there were four recommendations that the previous owners of Nexopia had refused to implement. Will you be in compliance with the 24 recommendations? Is that the plan?
:
Both. I think it's probably the latest chunk and the reason the timeframe is April and not December.
There are a couple of issues. One of them is the technical definition of what needs to be deleted—for example, a posting in a forum that another person started, so one person starts a thread and somebody else contributes to that thread and then that person leaves. It's both technically challenging and really without precedent anywhere else on the web for that whole thread to disappear. So that person's comments....
For example, if you go to a newspaper site today and you comment on a story and then you decide that you no longer want to be a member on that newspaper site, or whatever it might be, they don't delete your comments in those threads in any one that I've come across.
So I think to some degree there wasn't an engagement with the definition of what the owners were supposed to delete.
The second challenge is this. Nexopia has had a long track record of cooperating with law enforcement authorities on different investigations and didn't want to compromise that. Again, it's hard for me to speak on behalf of the previous owners, but there were a number of reasons—some voiced in those recommendations and findings and some voiced privately—that caused them not to move.
The technical part of deleting older data is less challenging than defining what exactly they were supposed to delete.
:
Is this an official question?
If you Google Nexopia, it's one of the first things that comes up. You'd have to be incompetent to not know this was an issue, and the previous owners brought it up as well. It's a pretty obvious issue.
I would not have bought it had I not, in all candour, found a privacy lawyer who understood the process and who to call. I wouldn't have known who to call or what to ask. I would not have bought it, but we were able to engage and they were able to provide direction, and then they stood by their word. They did what they said they were going to do. They certainly weren't on the hook to do it, but they have played the role we hoped they would play.
We haven't finished implementing all the recommendations, but like anything else, when you really engage in what it is, the true deletion thing that your colleague brought up earlier...once you're really engaged in what it is, it gets a little easier. You get them up closer and ask if you can do this or that and if you can get that done.
Again, I don't want to speak too much for the prior owners, but I think they froze up a bit at the enormity of it and they said they were done.
:
What consumers mostly want out of advertising is no advertising. If that's not available, then targeted advertising is the next best thing. Targeted advertising is, as Mark says, if you happen to ski and you see ads on skiing, presumably that's a more welcoming experience than seeing ads on diapers, if that's not what you do.
Most of our experience—I will talk now as an online person. The experience of watching television is largely one of irrelevant advertising. We have been sitting through ads and asking, “How did I sign up to be targeted with this ad? This doesn't make any sense to me.” Online, it's an extremely measurable media. So what advertisers do is they literally pay more for an ad to a relevant person. It is done through exchanges. I can list names of them, but they are much like the New York Stock Exchange. An impression goes up and everybody bids on that impression in microseconds. If somebody says, “That guy has been skiing and I want to sell ski equipment”, they will pay more. They may $2.50 CPM—cost per thousand impressions—rather than the 25¢ CPM. As you have had people testify to you, that's a more efficient market. That ski advertiser wants to reach somebody who is skiing, so they will pay for that data.
How they get that data is an interesting question. Typically, in the U.S., many publishers will sell them that data. They will say in the privacy policy that they are going to sell data. I may not be up-to-date with which sites, so I won't name the sites, but in the U.S. there are many car sites—places where you go to buy or price a car or that sort of stuff. They will sell their data to the big data brokers—Blue Kai Inc. and eXelate are both leaders in this in the U.S. The data guys will in turn sell it to the exchanges, so that when you buy an impression on a large site—Yahoo!, Microsoft, or whatever it is—you will pay a very low CPM if it's not targeted and a little more if there is some data behind it.
That's a very efficient marketplace. I mentioned that it's not as well developed in Canada because the scale is smaller. It seems like a lot of people to us; it's just not a lot in some of these larger countries. So the scale is smaller.
The other thing is that the publishers, by and large, don't sell their data as freely. I don't think that's a privacy law thing. I think to some degree it's an evolutionary thing, but they simply don't sell that data as freely.
If you are trying to target auto intenders—it's a term in our industry for somebody who is about to buy an auto—it's a lot easier in the U.S. than it is in Canada. There aren't as many sites that have auto data that will sell it.
To your point, is it scary, is it efficient—that's beyond me to say. It does make the advertising a lot more efficient if you are trying to serve up an ad to somebody who is relevant.
In terms of Nexopia's own business, it's just not at a scale where that is an interesting proposition. We have about 200,000 members. Let's say they are about half male and half female. If you want to target a young Canadian, particularly right now one who lives in the west coast—Alberta and B.C. as the primary audience—Nexopia is a great place to do it. But once you start cutting it down to people who live in Edmonton, people who are women, people who are a certain age, you're not going to have a lot of advertisers. You're only going to reach 10,000 people.
So that business works a lot better if you are a very large company. You guys all know the names of large companies.
Does that cover all or some of it?
:
Looking at the site, which we have just gone on without a password, I see that it goes right up to 55 or 57 years of age. So you have quite a breadth of people communicating on this site. The issue that concerns me most is what happens to the data.
We were told early on in our study that the information divulged by people entering any type of social media site is...it's a very open and free type of release of information. Clearly, people give all kinds of information, to the point that we see situations of horrific tragedy like the one in B.C., a situation with a young woman who likely regretted the information that was on the site, but had no recourse—she couldn't pull that information back.
One concern I have is how secure the data is. Are you aware of any breaches of the database? Have there been any questions about the security of the database?
And going back to the issue of full deletion of the data—you talk about six months to two years—I would think that if I had given you my data and wanted to have the information deleted, I would like to have it deleted the day I made that decision, regardless of the business model. I come from a business background, so I understand that there are complications with that, but I am concerned about this part of it.
As to your commitment to the full deletion of that information, are you committed to this being where you are headed?