:
Good afternoon, Mr. Chair, and my thanks to all members. I appreciate the opportunity to present at this committee.
My name is Karna Gupta. I'm the president and CEO of ITAC, which is the Information Technology Association of Canada. We represent 350 or more companies across the country, but 65% of our members are SMEs.
The ICT industry produces today about $160 billion of revenue for the country, and we make up probably 750,000 ICT and related jobs. It is a key to the future growth of the Canadian economy across all sectors. ITAC has long advocated a comprehensive digital economy strategy to improve Canada's growth and prosperity.
Today I want to talk about three key pillars of that strategy in the context of privacy policy.
First is innovation. When it comes to social media, we have only scratched the surface in innovation and spinoff benefits for consumers and businesses. Protecting personal information as this unfolds is essential. We need to find the best way to do this while promoting innovation and growth. Smart regulation is the second pillar of our strategy. The third is digital literacy. We need a national, digital skills strategy to help Canadians learn to use the tools for the 21st century effectively and safely.
You have probably heard a lot about Canada's innovation gap. The ICT investment gap between Canada and the U.S. is widening. The labour productivity gap between Canada and the U.S. persists at 10% to 20%. In a 2012 World Economic Forum report, Canada fell in the innovation ranking to 21st place from 15th the year before. No other top-ranked country dropped that much.
What does social media have to do with all of this? The adoption of ICT is the key driver for productivity, and the popularity of social media like Facebook, Google, or LinkedIn has spurred a tremendous amount of ICT development in all sectors. It shows an amazing potential for increased productivity and social change.
Let's look at some of the economic numbers. The World Economic Forum in 2012 ranks Canadians in 13th place in Internet use but in 6th place in the use of social networks. It is estimated that by the end of this year 60% of Canadians will own a smart phone, a rise in phone ownership largely driven by the use of applications and social media.
Canadians are adopting the technology, and we're well placed to capitalize on it. As for growth potential in the related industries, all of the current research predicts that Canada will add 70,000 jobs by 2015 as a direct result of cloud computing and more cost-effective ways of storing data.
One of the most promising spinoffs for Canada is data analytics, the ability to interpret large quantities of information and seize the market opportunity to solve social problems. It is estimated that the worldwide market for these services will grow to $15 billion to $20 billion by 2015. Canada has strong expertise in this space. For example, the Ontario Centres of Excellence along with the federal government, IBM, and seven other academic institutions have set up a virtual network to help small and medium enterprises manage the data sets to solve critical challenges. In Vancouver, police use data analytics to coordinate leads and resource deployment to improve public safety. They claim that property crimes are down as much as 24%.
Companies use data analytics to outperform their competitors and seek higher profits. Based on a recent survey, most companies that use cloud-based solutions outperform their peers by 68%. That's the link to productivity. All of this social media and social networking that spurs innovation drives productivity.
This is also a highly mobile and a global industry.
Our digital economy strategy needs to ensure that Canada is a destination nation for business to grow and prosper because the jobs and the economy we are talking about are highly migratory. They will go where all of the conditions are right. One important factor in ensuring this growth is a regulatory environment that supports what we call smart regulation.
Let's talk about some of the issues around privacy. Canada's current privacy framework is seen as a model by several countries in the world. It does a good job in the crucial area of protecting personal information and promoting innovation. Our members and a number of other sources tell us that the framework works well because it is principles based and it's neutral across technologies or business sectors. They say that the current framework adapts to the fast-changing area of social media and related industries where we cannot anticipate the future applications. It is very critical to underscore that we cannot anticipate a lot of the future applications. They also say that consistent rules across all sectors are better for investment and compliance by companies.
What do we have here? It promotes innovation by allowing collaborative and constructive dialogue with the Privacy Commissioner. New features come into play. This does not happen in the EU where the rules are more prescriptive. In fact, a study by one Harvard academic has found that the EU rules have led to reduced venture capital investment into companies that use online data.
Also, it's effective. The Privacy Commissioner's guidance, rulings, and impressive collaboration with her international counterparts has achieved a real change. It shows by the strong social media adoption rate in Canada. Ranking number six in the world is quite impressive.
Finally, I want to say a few words about digital literacy, another important pillar of our digital economy strategy.
To grow and prosper, Canadians need the skills to make effective and safe use of digital data. Our members play an active role in this. I also want to applaud the Privacy Commissioner for her active role in educating Canadians on the use of online media. There is an excellent opportunity to leverage existing organizations, like ITAC, to help build on this outreach program. We can be used as a portal to help IT businesses, especially SMEs, to understand and comply with the privacy rules.
In closing, Mr. Chair, the protection of personal information is extremely important and I know that our members take this very seriously. At the same time, Canada needs a digital strategy that promotes innovation and encourages businesses to locate here and grow here. As l have described, social media is helping to drive a number of our new and related industries in Canada, which shows great potential for our economy. It's at an early and fragile stage. We need to ensure that we have an environment that fosters these industries in order to realize that potential.
I thank you for your time, Mr. Chairman.
Thank you, members, for the opportunity to present to you.
:
Good afternoon, hon. members of the committee.
My sincere thanks to you for inviting me here, today. It is both a pleasure and an honour to say what I came here to say. I think this is a particularly important and current topic. It is urgent that we take a consistent approach to deal with this issue in Canada.
Before I begin, I would just like to reiterate that this presentation is both mine and Professor Leslie Regan Shade's, from the University of Toronto, with whom I prepared the brief that was submitted to you. So I speak for both of us, and I have no intention of taking credit for the work that we did jointly.
As you know, the right to privacy is a human right that is absolutely essential. This right entails important concepts such as human dignity, reputation, honour and joie de vivre. Equally essential, the right to privacy is closely connected to the rights and freedoms that are critical to safeguarding our democracy. These rights include the right to freedom of expression, the right to freedom of association and peaceful assembly, and, of course, the right to participate in public affairs.
It is generally acknowledged that the right to privacy has four broad dimensions. The first dimension is preservation of anonymity, meaning that a person is not identified or identifiable. Second, we have freedom from surveillance, which means not being monitored or watched by external entities. The third dimension is the preservation of a private space, which has to do with having a space deemed inviolable, a sanctuary. The fourth and last dimension of the right to privacy is obviously everyone's right to have access to sound management of personal information. It has to do with an individual's ability to control access, circulation, sharing and accuracy of their personal information.
It does not come as a surprise when I say that the development of social media raises major problems for each of those four dimensions. That being said, our presentation today essentially focuses on the fourth point, the management of personal information, which is quite clearly considered as a fundamental component of the right to privacy.
The protection of personal information calls for nine specific criteria to be applied. Everyone about whom information is collected should: be properly informed that information is being collected; voluntarily participate in the collection; be able to identify the actors who are collecting the information; know the ways in which the information is being collected; be able to identify the nature of the information collected; know what uses will be made of the information; be able to identify the actors who may have access to the information and the rules that govern the confidentiality of the information; be able to assess whether the information is properly protected; and be able to access the information collected and rectify or remove personal information collected elsewhere.
We feel that those nine criteria should be used as benchmarks for assessing the measures taken by social media sites in order to protect the personal information of Canadians. But we are seeing many problems with that. One of the main issues with the protection of personal information on social media sites is the proliferation of standards and protection policies in relation to privacy. We are concerned about the lack of an exhaustive, clear and consistent framework that provides social media users with a set of clear standards on the protection of personal information. Users would then know what their rights are, regardless of the platform or social media they choose to use.
That is why we conclude that it would be fully appropriate for authorities in charge of the protection of privacy in Canada to draft and adopt a social media site privacy charter, in partnership with Canadian civil society. All social media that have activities in Canada should comply with the charter.
If time permits—please stop me if that is not the case—I will conclude my presentation by describing all the elements that, in our view, should be included in that type of charter.
For now, I would like to talk about the problem relating to the protection of personal information on social media sites. We believe that this problem has three parts and that it largely stems from the business model preferred by social media sites.
We believe that this problem has three parts and that it largely stems from the business model preferred by social media sites.
Generally speaking, a social media site can create value and generate profits by monetizing its users' personal information. That is usually done in two ways: by charging interested individuals and businesses a fee to access the personal information of users and to interact with them—that is the model preferred by dating sites and some professional networking sites—and, more recently, through advertising offers that rely on collecting, handling and analyzing personal information available on social media sites.
A social media site like Facebook aggregates an audience and it sells it to advertisers. That is its job, its business model. The specific nature of the product offered by Facebook to its clients truly relies on its ability to provide marketing and advertising products that are tailored to the tastes and preferences of every user. In other words, personal information is currently a currency of exchange between users, social media sites and their business clients. Any changes in the practices that govern the collection, analysis and handling of personal information therefore have a direct impact on service delivery and, in turn, on the revenue generated by businesses that use social media sites.
In terms of the protection of personal information on social media sites, we have identified three components that each come with specific problems. Let us give you a quick overview.
The first component has to do with collecting, handling and sharing personal information. In this regard, we have observed the following problems.
First, minors, and more specifically children, are always vulnerable to the personal information collection processes used by marketing agencies. The development of games, interactive applications and marketing processes on social media is extremely attractive to children, who do not have the tools they need to effectively protect their own privacy. To our knowledge, there is no legislation in Canada to protect minors' personal information online from violations by commercial actors.
Second, we are seeing an explosion in personal information collection and handling policies. Application and game developers are investing massively in social media sites. All these developers and marketing agencies have their own confidentiality and privacy policies. The rise in contractual agreements with social media users, resulting from the incorporation of applications in social media sites, makes it difficult for users to know exactly to what extent and which parameters are being used to protect their personal information.
In addition, on certain social media sites, we are observing the absence of real control available to users for identifying and selecting the third parties that will be able to access their personal information and, where applicable, for determining what information is collected and denying permission to transmit that information. Once you agree to have an application on your Facebook page, it is very difficult to determine what the developer of that application will do with your personal information and who they will share it with. It is very difficult to maintain control over that information.
There is also an absence of exhaustive studies of the risks that the new cross-tabulation and facial recognition techniques present for privacy and personal information protection. In other words, most users now have a number of accounts open on various social media sites. Each of those sites has its own purposes, its own objectives, and users have to figure out which confidentiality policies seem to best meet their needs.
The risk is that, with the new techniques for cross-referencing data, you can track an individual's entire private life by multiplying the inquiries done on social media sites the user visits. The danger is there, and the problem is growing.
Finally, we are seeing that social media sites are vulnerable to cyber attacks. For example, in June 2012, LinkedIn had six million user passwords stolen. In 2011, I believe, someone got access to the account of the Facebook president and founder and managed to reveal his most intimate photos in an entirely public manner. The issue of privacy on social media sites is not at all regulated.
The second aspect of our brief and my presentation has to do with the information available to users on changes to the collecting, handling and sharing of personal information.
In that respect, we are seeing that the problem is that there is a real lack of transparency about the real and anticipated effects of any change to the confidentiality parameters relating to the privacy of users who have accounts on social media sites.
In the past few years, changes to the confidentiality parameters, which are often made unilaterally, have led to deep controversies and resistance within the user communities, have been of concern to privacy rights organizations and have led to class action lawsuits.
Imposing changes to the confidentiality parameters on social media sites poses three very specific problems for users.
First, it deprives users of the ability to determine themselves the level of protection they want to apply to their personal information.
Second, the many changes to the confidentiality parameters generates real confusion over the years for users and decreases their trust in the privacy policies in effect on social media sites.
Third, unilaterally imposing changes to the confidentiality parameters on social media sites shows the lack of healthy and productive dialogue between users and managers of social media sites on the issue of privacy.
The third and final aspect of our brief focuses on education concerning the risks associated with social media.
:
Thank you for your question.
I know you attended the WCIT in Montreal. As you heard from the rest of the world, we live in an open world, so you cannot control everything and contain it in a lockdown mode. We need to make sure we have the ability to manage the risks that are out there.
The Privacy Commissioner today is doing a very credible job engaging the industry, in setting up what the frameworks are, and what needs to be. The consultation process is ongoing.
If you have specific prescriptive rules of a certain type, what may happen is you might be looking backward rather than forward. You have to change it every so often. This world is moving very fast.
At the same time, you've all heard the terms “crowd sourcing” and “crowd funding”. If you want to spur innovation and growth in the country, you need to allow the digital world to come into Canada, live here, grow here, and nurture industries here. You have to be inviting.
As a nation we need to strike a delicate balance, that we not only create a condition whereby we not only attract companies coming in and businesses grow, but at the same time we make sure we have the right protective tools and the ability to deal with them.
For example, today any Federal Court has the power to award punitive damages if the company is out of line in any area. The Privacy Commissioner could lay down certain rules and guidelines if somebody is out of line. For industry not to be engaging in this conversation and just having a set of rules would be very difficult because again you're looking backward rather than forward.
:
There was a tradition, probably about three years ago, when a lot of the software development work went to India, Malaysia, and Indonesia, for labour reasons and other reasons. Nowadays, as the investors start looking at solving some of the problems, they often use what is known as crowd sourcing. They put it in the open world in terms of somebody telling them how to solve this problem. That becomes part of the innovation cycle for most of these young start-up companies in Canada. Pretty much in any sector in Canada, they use what is known as crowd sourcing to solve their problems.
I'll take it one step further. This really started in earnest probably in Massachusetts and California. It's called crowd funding. It's now come north and to the rest of the world.
You know about the issues with VC funding in Canada. Most of the start-ups in any of your constituencies are crying for venture capital funding to survive. A lot of the time they are surviving because individual investors come in with smaller amounts of money. I sit on some of the boards of these small companies, and they are raising funding from individuals. It is done with a crowd-funding model. They go out and indicate that this is the type of problem they are trying to solve for society or the business or in general in the market and ask if anybody is willing to invest money in this and come with them on this journey. The investment amounts could be somewhere between $100 to $10,000, depending on where you fall.
Today these two are the lifeblood of Canadian business in the start-up community. Just in Ontario, there are 14 regional innovation centres. If you go to any of the regional innovation centres, whether it be MaRS, ventureLAB, or Communitech,crowd sourcing and crowd funding are the topics that come up all the time. This is a true input into our economy in terms of creating jobs, starting new innovation, and starting new companies. One of these days, these companies will grow into bigger companies. This has a real, measurable impact.
Your second question was whether we know by dollar amount what this open-market model, using social media and reaching out to the market may look like. I don't know. It could be massive. The size of the worldwide market just for the data analytics, all of the research and that side of the business, is a very large number. It is approaching, as I mentioned in my opening comments, somewhere between $15 billion and $20 billion over three to four years. That's the size.
If we want to play in the digital world, and if we want to be a knowledge-based economy rather than just a natural resources based economy, we need to play in that world and have all of the tools available to support that. I cannot give you a number as to how big the impact of social media or open platforms like that would be on the economy.
We feel the main problem is that there are so many policies on the confidentiality of personal information, sometimes on the same social media site and among platforms.
Within a single site, like Facebook, dozens and dozens of different applications are offered. When you register for each of those applications, there is a confidentiality policy that you must agree to. When you have 15 or 20 of those applications, it is almost impossible for the average user to be able to specifically control access by third parties to their information. That creates a volume of confidentiality policies that is simply untenable for the average user.
Add to that the fact that the average user often has a number of accounts on different sites. Each site has its own general confidentiality policy. Each of those sites also has third parties, such as game developers or marketing companies, that do business with them. You very quickly reach a volume that is simply unreasonable. It's unreasonable to expect that a user who is required to add more and more contractual agreements is a master, with full knowledge, of the decisions that are made with respect to personal information.
If you take for granted the fact that very young children have access to these sites and use them and that these sites take them in when they don't have the training, resources, or skills necessary to pay attention to the information provided, you end up in a situation where the exercise of real control is just wishful thinking. Pushing this on the user, saying that it is the user's duty to take responsibility overlooks a policy economy of personal information that, among other things, operates on this generalized confusion on the part of the user.
Furthermore, the issue of privacy for children is particularly serious. We are suggesting a national, pan-Canadian policy. It would also include a very clear component on critical media education, particularly digital media. It would be in the school curriculum, and children would be required to develop skills at a young age and early in their schooling.
You know, there are two ways to see the problem currently. We can see the users of social media as consumers who want access to services, or we can see them as citizens. We can also see them as both. In the end, the final question, the question you are going to deal with, is which of the two you want to make a priority.
Is your priority a group of consumers who have individual rights, or is it creating a body of citizens who are informed about their privacy?
The two aren't incompatible, but they are both fundamentally under stress. It will be important to make a choice.
:
Thank you for your question.
The first thing the charter would do is create expectations. I think the industry would like that. Very clear expectations would be created for the industry, along with a framework establishing parameters for what we consider to be normal and usual privacy protection rules in Canada.
Basically, expectations would be created in three highly specific areas. First, clarifications would be made to the procedures for collecting, processing and analyzing social media users' data. The current problem is a lack of transparency. Users don't know what is being collected, where that information is going and what kind of control they can have over that data.
Second, as I already mentioned, we would also need ways to allow users to participate in the discussion process on privacy issues. Our approach would include much broader participation. A charter would aim to achieve not only greater transparency, but also greater inclusion in the decision-making process.
Finally, the charter would provide specifically for companies' commitment to co-operate with the Canadian Parliament, provincial parliaments and various federal and provincial privacy protection organizations. Once those commitments have been made, we would establish a relatively consistent normative framework for the whole country. Businesses would thrive within a clear and specific framework.
I disagree with the theory that giving businesses greater responsibility will scare them off. Doing business in the digital world and social media in Canada is currently very profitable. I am not at all worried when it comes to that.
:
Thank you very much, Mr. Chair.
Welcome to our guests.
We stated earlier how significant and important privacy is. Of course, there had been some discussion that consumers need to know there is a place where they can be protected and that their privacy can be protected.
Of course, we also talk about digital literacy. I happen to come from an era when phones had party lines, and I knew the ring for ours was two longs and a short, which wasn't really too far removed from Morse code. Nevertheless, we're looking at that type of generation gap.
You also made suggestions about the schools and how they are able to deal with these things. Until we come up with standards.... All the schools are doing it. It isn't a case of suggesting it doesn't occur now, but they're not really focused on any one particular area. I think it's important that we look at that, but also we should be able to use the commissioner's role as far as education is concerned to expand that.
I would hope that all the industry actors would get involved in that, as well as the academics, to give her the sort of information that would be important.
One of the other things that was mentioned is that we want Canada to be a destination for this particular type of industry. I believe it was mentioned that if the conditions are right, people are going to come here, so we have to make sure we get it right.
A discussion also took place on the digital strategy. I assume that industry and all people who are interested in this will be looking at a digital strategy that's going to promote innovation. We also have to look at this from a worldwide focus as well, the cultural citizen. We're a cultural citizen of where? Is it simply our own province, our own region, our country, or is it global? I think that's significant as well.
I was wondering if you could comment on the digital strategies that would promote innovation while still protecting the privacy as we see it and where we can get people working in this direction.
:
Thank you for your question.
I think a comprehensive digital society is probably at the very core of a lot of these issues. It's not only the social media; you're talking about e-commerce and you're talking about mobile technology. By and large, we are dealing in a global arena and fighting for resources to be successful. If I am building an industry or a company, I'm looking for a resource that can best deliver the product regardless of whether they're from Ontario, Quebec, or Hong Kong.
On the global scale, we want to make sure that we have the conditions right to attract the top talent from everywhere in the world, so that they look to Canada as a destination place. We need to be the country where these innovations are spurred. We need to be the country where these industries are built if we want to build a knowledge-based economy.
To create those conditions, we need to have the framework that supports all of the pieces. Privacy and the social media is only one aspect of it. The other aspects are equally important. We need to have the appropriate intellectual property regime. We need to have appropriate taxation policies. We need to have proper education standards. All of these dots need to be connected. When we look at a digital strategy, these are all part of the conditions. We cannot just optimize on one. All of them need to be dealt with, and that's what industry is looking for.
One of the things we need to understand as we build in this world is that, fundamentally, the biggest part is the education. We all need to understand that if we put something online it is not always private. All communication is not always private. There is a separation of data that, as the professor mentioned, certain things are completely private offline, but anything you put online in terms of communication is not always private. It's online and it has a longevity much beyond what we're looking at.