ETHI Committee Meeting

     Good morning, everybody. Thanks again for coming here this morning.

     Today, in meeting number 88 of the Standing Committee on Access to Information, Privacy and Ethics, pursuant to Standing Order 108(3)(h)(vi), we are studying the Personal Information Protection and Electronic Documents Act, or PIPEDA as we've all known it.

    First of all, Mr. Angus would like to have the floor.

    Thank you, Mr. Chair.

    I'm very pleased to be back on this committee, which does incredibly important work, certainly with access to information. One of the other key elements is that our committee is the review committee for issues of ethics and ethical breaches.

    I want to take a few minutes to let the committee know that I will be bringing a notice of motion regarding the decision by this committee not to invite the Prime Minister to explain his being found guilty of ethical breaches. It is unprecedented in the history of our Parliament for a sitting prime minister to be found guilty. Normally, it is this committee where it would be dealt with. However, the committee overruled doing so, saying that the proper place would be in question period, and I think there was some logic to that.

    The problem is that the Prime Minister has not been answering questions in question period. In fact, the Prime Minister skipped question period on Wednesday, which is normally the day he answers questions, to do a town hall in Winnipeg.

    We were told that the Prime Minister would be accountable to the Canadian people. We were told he would answer questions. He's refusing to answer the questions, so it has to come back to this committee and all of us to ensure that ethical standards are being held to even in the highest office. Therefore, I will be bringing a notice of motion on Tuesday to that effect.

    Thank you.

    Thank you, Mr. Angus.

    We'll go back to the orders of the day.

    Mr. Therrien.

    Thank you, Mr. Chair.

    Ladies and gentlemen, members of the committee, I don't have a formal statement but I will make a few remarks that may situate the debate. I hope this will be useful.

    Last week, my office published a draft position paper on the question of online reputation. Of course, the first question that one might ask is why; what is the relevance of this? We have been told by Canadians that they are concerned about the growing risks to their reputation online. We want to provide people with greater control to protect themselves from these reputational risks.

    Those risks exist because protecting reputation is increasingly difficult in the digital age. Information about us is systematically indexed and easily accessed and shared. Online information about us can easily be distorted or taken out of context, and it is often extremely difficult to remove.

    Our report makes a number of key recommendations or decisions.

     First, it says that PIPEDA should be interpreted as providing the right to ask search engines to de-index web pages that contain inaccurate, incomplete, or outdated information. We think there is grounding in the current PIPEDA for that.

    Second, there should be removal or amendment of information at the source in certain situations.

    Third, and very importantly, we advocate for much more education on this issue, education that we can be part of within our public education mandate. However, we think, on this issue in particular, it would be important that provincial and territorial governments take up our recommendation that privacy should be part of the curriculum in schools so that children are taught at an early age, one, how to protect themselves, and two, how to behave responsibly as online citizens.

    While I think there is a legal basis in PIPEDA for the remedies found in our paper, it's also important that this issue be considered by you as elected officials. We know that this is a controversial issue and that a number of people, stakeholders, are of the view that this would unduly impact freedom of expression. We know that. At the same time, it's important that we act, that the OPC acts based on the current law. However, it is a very legitimate issue to examine what the right balance should be between protecting reputation and privacy interests on one hand, and freedom of expression on the other.

    When the Office of the Privacy Commissioner drafted the Draft Position on Online Reputation, and more specifically examined the role of de-indexing, we were not attempting to create new rights or powers. Rather, we were attempting to apply the Personal Information Protection and Electronic Documents Act, in its current form. However, as I just said, this raises questions in connexion with respecting freedom of expression. We think it is particularly important that elected representatives, who represent the Canadian population, examine this issue.

    In addition to studying the matter of the balance between privacy and freedom of expression, you may want to take advantage of this opportunity to examine certain important natural justice or procedural issues which private sector stakeholders, particularly search engine representatives, have drawn to our attention. More particularly, if a citizen asks a search engine or a private organization to de-index or erase some information, which procedural rights may those entities cite in defence of their point of view in favour of freedom of expression, and against the de-indexing or the removal of information?

    One question has already been examined by the committee in its review of PIPEDA. You may also want to examine the effects of possible differences between how these rights are exercised in Canada and in Europe, when studying the adequacy and appropriateness of Canadian legislation as compared to European law.

     My last point will be this. I recognize that de-indexing is not necessarily a perfect solution for protecting reputation, but I think it's important to ask because it is important to protect reputation, and I think it's important that I act on the basis of the law that I must administer and enforce. However, there is a question as to whether the law, as it is, is the best means to protect reputation.

    As you look at this question, I would ask you to consider what the alternatives are. The first question would be, is it worth protecting reputations? If you agree that it is, de-indexing and takedown are the tools I have under the current PIPEDA. If that's not good, what are the alternatives? There are not many alternatives, but maybe you should consider and hear from witnesses what the alternatives should be.

    Thank you.

    Thank you, Commissioner.

    We'll start off the seven-minute round with Mr. Erskine-Smith.

    Thanks very much.

    I want to get into a discussion of de-indexing a little bit and the online reputation report, but we are just finalizing our broader report on PIPEDA and I first want to clarify a few things, in particular with respect to enforcement powers.

    We've had some people come before us and say that, if the OPC is given additional enforcement powers and the ability to make orders and issue fines, businesses may be less open to coming forward and co-operating in the first instance with the OPC. I wonder if you could reiterate to this committee what you think the model should be for the OPC under PIPEDA in terms of enforcement powers going forward and what this committee should recommend, in addressing some of the concerns that business have expressed to us.

     I don't think that granting the OPC order-making powers would have that effect. I think it would actually discipline the conversations we have with the corporate sector currently if organizations know that their interlocutor has order-making powers. I think it would discipline the conversation.

    An important point to make here is that when I ask—and my predecessor asked—for order-making powers, it does not mean, in my view, that order-making would be the first reaction of our office when faced with an allegation or even a finding of non-compliance with the law. My job, I think, is to bring organizations towards compliance with the law, broadly speaking. To impose orders and fines is something that may be necessary in some limited cases with recalcitrants or recidivists, but this is not my first course of action.

    My first course of action to bring organizations to comply is to engage with them, to issue guidance on what we think the law provides, to consider initiatives that they may put forward, and to talk to them about how they can function commercially in a way that is compliant with PIPEDA. That's the first and by far the most often used strategy that I think I need to put forward, but there will be a few corporations/organizations that may not be amenable to that engagement. For those, I need order-making to ensure that the law is not moot and actually is applied.

    Just so that we understand, the enforcement power you have right now if there's continued non-compliance is for you to in fact take that business to court, effectively?

    Yes, it's to make recommendations, and if they are not applied, to bring an organization to court, which is a very lengthy process.

    You've suggested that you would exercise discretion. Should that discretion be the OPC's? Or should there be, in any recommendation we make or any legislation that's drafted, some guidance to say that in the first instance it ought to be recommendations, that it ought to be guidelines put forward to business, and that if they further break those recommendations or fail to follow them, fines and further orders could follow?

    You could do that. My preference, frankly, would be to exercise my discretion based on considerations that you think are relevant, but without dictating the order in which the considerations must apply. But I am absolutely in favour of considerations that I would be bound to apply.

    Here's my last question on this topic. You attend a number of conferences. You would be more familiar with privacy commissioners around the world and the enforcement powers their offices hold. Is providing your office with enforcement powers and the ability to make orders consistent with international practice, or is it getting ahead of international practice?

    It is not at all getting ahead. We are behind, so it would be more consistent with what is becoming the norm.

    How much time do I have left?

    You have about three minutes.

    I'll briefly turn to de-indexing. If I understand correctly, your interpretation of the current act is that it already applies to search engines and that de-indexing is already part of the potential interpretation of the act. Is that fair to say?

    Yes.

    How open to interpretation is that? Is it necessary to clarify that in the legislation? Or are the case law and the interpretation so clear that we ought to just leave it to the current case law and precedent?

    I think our interpretation is sound, but it is not without other views being expressed. If you agree that this deserves remedies, I think it would absolutely be helpful to clarify that in legislation.

    Maybe you could explain to this committee the right to deletion. We've talked about the right to be forgotten or the right of erasure, the right to deletion, and the right in this case maybe to de-indexing. They're all different gradations of the same idea in some ways. How far does the current interpretation of PIPEDA get us in terms of the right to deletion? You've said, okay, the right perhaps to de-indexing, but how much more broadly do we see the existing case law?

     Well, as I say in the paper, the basis in the current law for the remedies that I think exist is first and foremost principle 4.6, which is entitled “Accuracy”. The first principle is accuracy. The reputation of people should not be based on inaccurate information that is out there online about them. Although the heading is “Accuracy”, the words of the principle talk about “accuracy”, meaning that the information should be factual and objective; “complete”, which is a bit more subjective; and “up to date”, which is a bit more subjective also.

    I need to apply the law as it is, and the law as it is has these three characteristics of information. Some are more objective than others. I think that should be part of the debate.

    If I post something online—

    Mr. Erskine-Smith, your time is actually up.

    I'm out of time. Well, Mr. Saini will pick up.

    Thanks, Mr. Erskine-Smith.

    Next up for seven minutes is Mr. Kent.

    Thank you, Chair.

    It's good to have you with us again, Commissioner.

    You're aware of the concerns expressed by the former commissioner, Ms. Stoddardt, regarding possible constitutional challenges to some of the provisions or recommendations as they apply to minors. Did you or your office carry out a study, an analysis of the constitutionality, of some of the changes you advocate?

    The main constitutional issue that many people talk about is whether the remedies that, I think, exist would contravene freedom of expression. It's a charter issue, and we have looked at this extensively.

    I hear that Madame Stoddardt may have expressed views about constitutionality from a division of powers perspective, namely that if we apply federal legislation the way I advocate, this might trample on provincial jurisdiction over property and civil rights, interprovincial commerce, and so on.

    As I think you know, the Quebec government years ago launched a challenge to the constitutionality of PIPEDA on that ground, and that has been adjourned and has not been decided.

    I would say that that risk exists as soon as you have federal legislation that can be said to trample on provincial jurisdiction, such as over commerce exercised by companies in province A or B. What I advocate would simply be another manifestation of the application of federal law. Maybe it increases the risk that an organization would raise these issues if it is not in agreement with having to comply. However, conceptually, I think we're just applying the federal law as it is. It doesn't change the situation in terms of.... We're not further trampling on provincial jurisdiction; we're just exercising the authority of the federal law, perhaps thereby creating a greater risk, which a company may challenge, but the legal issues would remain the same, I think.

    Thank you.

    Apparently you received 28 submissions in your consultation on online reputation. You say a very large majority were opposed. What percentage of those 28 would have been opposed?

    We can get back to you on the percentage, but I think it's fair to say that it was the vast majority. We received 28 submissions, essentially from experts and media companies, which were very helpful. It certainly made us focus long and hard on freedom of expression issues, but there's the broader public. We consulted not that long ago, before I determined the strategic priorities of the office in 2015. When I decided that reputation would be one of the four strategic priorities, this was based on what we heard from Canadians. Therefore, although most of the 28 experts, let's call them that, were against—but not all; some were in favour of the right to de-indexing—I think the broader population is concerned.

    Now the broader population did not focus on the exact means, but did express serious concerns about their reputation.

     I wonder if you could just address the opposing opinions about whether or not online reputation de-indexing—removing information—should be regulated by the private sector or a public service individual.

    One of the legitimate concerns raised by stakeholder companies is that it should not be up to the private sector—search engines or organizations responsible for social media—to balance individual rights. Obviously, that is not a frivolous position.

    However, you need to look at the practicalities of the issue. As I say in my paper, as a matter of law, all organizations, including search engines, have an obligation to develop a process to ensure that the substantive rights are respected, namely to the accuracy of information. I think that's a legal obligation they have under the current law. Does it make it proper for them to balance individual rights? Certainly, that's something to consider because it's not frequent.

    As a practical matter, in Europe, we have seen hundreds of thousands of these requests made since the Google Spain decision of 2014. Should a tribunal be created? Normally, a tribunal of some sort would be created to adjudicate these requests. Should we create a tribunal that would look at hundreds of thousands of these requests every year? That would be more in line with the nature of the balancing that is at play, but I don't think it's very practical.

    Although that may not be where people would go intuitively, to ask companies to develop processes, as they are bound to do under the law, to have a first decision about these applications—of course, subject to the rights of individuals who are not happy to make a complaint to our office, independent tribunal, and ultimately, the courts—is a workable system, I think. It's not a perfect system, but it's a workable system.

    How much time do I have?

    You have about 15 seconds.

    I do have another question that was prompted by your reference to the right to accuracy in online material, but I'll leave that perhaps to one of my colleagues in subsequent rounds. Thank you.

    Thank you, Mr. Kent.

    Next up, we have Mr. Angus.

    Thank you very much.

    I just want to say that I'm very supportive of order-making powers, so that we have a regime that can do the work that it's intended to do.

    On the issue of online reputation, I have a number of concerns. I was someone who thought the idea of “right to be forgotten” was a really great idea, because there are so many horror stories of digital worlds gone wrong. I also see that it can flip and be used by people who want to be forgotten for reasons that maybe they shouldn't be forgotten for. I think that you exist in the digital world. Disappearing to me is a questionable factor, for example, if it's an issue of your being accused of sexual misconduct—nothing was proven, but you can have that record erased, so that you're not tracked.

    Is this something that we should be pursuing, given people's ability to misuse it?

     On the question of who will use this right, and what the European experience is—and I'll get to the question about whether it's appropriate to make people disappear, which I think is a bit of an exaggeration of the right—in the European experience, there is this perception that it will be used by people with a doubtful past who want to erase that doubtful past, whatever that past is.

    From the European experience, the figures would show that criminality, or factors such as that, has represented approximately 5% of the requests made. Most requests are made by people for other reasons. The record also shows that search engines grant these requests at the rate of roughly 40%. If these are being granted 40% of the time, there must be some merit to them. They're seen as meritorious.

    The figures that we have also show that in France—we are going to look at other countries—70% of the decisions made by the search engines that lead to complaints to my equivalent in France are upheld. I take that to mean that the search engines are doing an okay job.

    On the question of whether people should be able to erase their past—particularly sexual misconduct that may or may not have led to a finding by a court—that's obviously a very relevant and timely consideration. It will not be a foregone conclusion what the outcome will be. In many cases I think, properly applied, the request should be denied. Let me explain briefly why. If an alleged aggressor were to make a request, of course the reputation of that person would be a factor to be determined, but there is a question of accuracy then. The person would have to demonstrate that the facts alleged are untrue, and if the evidence was not there, the information would stay.

    However, more important is the public interest. What we advocate in the paper is that accuracy needs to be looked at in the context of the public interest. Some of the potential requesters of the right may be public figures. In that case, I think it's pretty clear that the request should be denied, because the public interest would be such that it be denied. Moreover, even for a person who is not a public figure, there is an important public and societal debate in Canada and other countries currently that makes this a question of public interest, and that public interest would have to be weighed against the reputation of the individual.

    I'm not saying that this leads to easy solutions, but I think, properly applied, all of these considerations would be borne in mind, and in many cases the request would be denied.

    Okay, I guess it's how this is going to be dealt with. Certainly, there are legal tools, and maybe legal tools are not strong enough. In cases of revenge porn, sexual harassment, anything to do with minors, law enforcement needs the ability to deal with those immediately, so we need to know that those tools can be put in place for that kind of online bullying—there's a clear risk, and it's an obvious risk.

    In the case where, if I make a tweet about my dear friend, Mr. Erskine-Smith, if I make some kind of outrageous comment, and he says, “That's not true”, he could threaten me with legal action for my tweet, and then I would have to decide whether to continue or to pull it down. So we have legal tools there.

    I am concerned about issues of accuracy and being out of date, because the Internet is not a book; it's not an article. It is an ongoing, messy expression of discussion and debate. People write all kinds of crazy stuff about me online that's out of date and incorrect. Maybe they just don't like me.

    But I'm worried about those tools being applied. I'm also worried about whether or not corporate reputation could be used, because we see SLAPP suits used against organizations all the time. To say, “This has hurt our online reputation, our corporate reputation, and we want this thing shut down”, to me, it's a very powerful tool to take something down off the Internet.

    Is it your office that would adjudicate these various scenarios?

     First it would be the organizations, then my office, and ultimately the courts.

    In terms of online reputation and the definition of it, people's online reputations get trashed in various forums all the time. Some people are more sensitive than others. David Irving, a Holocaust denier, felt his reputation was trashed and he went to court. Could he go to your office and say his academic rights were being undermined by being challenged?

    It's important to say that the examples you give are all of public figures. I think it's almost a foregone conclusion that, for public figures—maybe that's discrimination against public figures—

    Definitely.

    —they would have almost no leg to stand on.

    The question is what happens to ordinary Canadians, who may be defamed and who have to apply for a job, when the potential employer makes a decision based on what he or she sees on Facebook or Google, which may be inaccurate? That's the kind of situation I'm concerned about.

    Thank you, Mr. Angus. You're time is over.

    Next up, for seven minutes, is Mr. Saini.

    Good morning, Mr. Therrien. It's always a pleasure to have you here.

    II have just some old business and some new business, so let's start with the old business first. In the past when we had you here in front of the committee, you were in favour, at that time, of maintaining your ombudsman model. Then you published a report in 2016-17 in which you called for, and I quote from the news release, “amendments to the federal private sector privacy law to provide for order-making powers and the ability to impose administrative monetary penalties.”

    You've also stated that if the Information Commissioner got order-making powers, it would significantly disrupt the balance between your two offices. I know we've alluded to it, so I'd just like some clarity on the issue, just so we can have on the record that you believe that the powers given to the Information Commissioner should be balanced with your powers so there's no disruption. You would also have the ability to dismiss vexatious and frivolous requests.

    Certainly I'm in favour of order-making powers. Can you repeat the question about—

    That's because you initially stated that the ombudsman model was fine.

    It is in the public sector.

    Then in your 2016-17 report, you called for amendments that would give you order-making powers. Do you believe the powers that the Information Commissioner has should balance your powers so there's no disruption between the two offices?

    For the public sector, I do.

    How about in the private sector?

    Well, that would require a pretty extensive change in the mandate of the Information Commissioner. The balance doesn't come up the same way in the private sector. The Information Commissioner is responsible for access in the public sector only. The balancing of interests in the public sector is more vis-à-vis organizations, unless the Information Commissioner were given a mandate to be a champion for access to information broadly speaking, but that's not at all the current mandate of that commissioner.

    In your paper regarding online reputation, you raised some interesting points when it came to de-indexing, and you had some critiques of that. One critique you had was that the information was still available, so that if people wanted to find it, they still could. It actually has not been eliminated. You've just broken—and I use the word “broken”—the link between the information and that individual.

    You've also said that there is a role for the private sector in the balancing of rights. In the paper, you've written, “Search engines, in particular, already have in place mechanisms to consider de-indexing requests and remove content which is potentially harmful”.

    Could you just elaborate? What mechanisms were you talking about? Can you elaborate on what mechanisms there are right now?

     Let's talk about copyright. Search engines and other organizations have processes today whereby they do not put up material for access to the public that in their view would breach the copyright of copyright owners. To go back to the experience in Europe, the number of takedowns or de-indexings based on infringement of copyright is many times the number based on the protection of privacy. I think it's about 1,000 to one where search engines de-indexed or took down information based on copyright infringement as opposed to protecting privacy rights.

    This idea that corporations do not just make available everything that is available on the net, but that there is some kind of screening for legality—copyright being an example, revenge porn being another—all kinds of legal criteria are currently being applied by corporations that lead either to de-indexing or takedown. Frankly, I don't see why compliance with the federal private sector privacy law would be any different from an infringement of copyright or other laws.

    The other point you mentioned—and I think one of my colleagues mentioned too—was that the search engines should provide the first level of review of de-indexing requests, which is fine.

     If someone doesn't agree with that decision, then they would have to appeal it to a court, I'm assuming. If a search engine denies the request, what is the recourse for the person who's making the request for de-indexing?

    Initially it would be a complaint to my office for non-compliance with PIPEDA, and then to the courts.

    Do I have any more time?

    You have about a minute and a half.

    The other question that we had some debate about was in reference to youth. You've made some references in your paper that specific protections should be in place for them. You've given a different age range. What age does your office consider to be youth, because in the United States, the penal code considers someone 13 and under as a minor? The GDPR or the European Union privacy regulations have, I believe, the age of 16. You've given a range. Can you guide us on that?

    For consent purposes, we have proposed 13 as the relevant age. For the purpose of whether a youth can give meaningful consent to the collection, use, and disclosure of information, we propose 13 as the better age for this, but really it's a question of some arbitrariness because whether the consent is meaningful depends on the maturity of the child. We say that under the age of 13, it would be very exceptional for a child to be able to give meaningful consent. For the purpose of making a de-indexing or takedown request, we say the age of 18, essentially on the basis that there's no doubt that as of 18, they become, how do you say, majeur, they reach the age of majority and from that point on, there's no doubt they can speak for themselves and they could make a request.

    Your time is up. Thank you, Mr. Saini.

    Next up, for five minutes, is Mr. Gourde.

    Thank you, Mr. Chair.

    There are certain cases I don't like to talk about, but this week an important case was drawn to my attention. It is also really complicated because it involves access to private information and the right to access information.

    In some circumstances, Canadians sign contracts with governments. They must then provide information on their private life by filling out forms. They become consultants or self-employed workers because they have a certain specialty that allows them to obtain special contracts. If such Canadians are harmed because they are refused access to the information contained in their file, or because they are given redacted documents for reasons of national security or because this is privileged information, they find themselves in a bind and have no way to defend themselves.

    Would you advise that those Canadians turn to you to defend their right to access information on their private life and to have access to certain documents that might enable them to solve their problem?

    If I understood your question correctly, you are talking here about a request submitted under the Personal Information Protection Act by someone who had to provide personal information to the government as an employer or an entity that grants contracts, in order to establish the reliability of the person who wants to be employed or to provide services.

    Yes, the purpose is to ensure that that person is reliable and eligible. There is then an agreement between the government and the employee.

    So, the person submits an access request under the Personal Information Protection and Electronic Documents Act. Some information may be denied for reasons of national security. I think we are talking about the application of the criteria in the current act. In that context, the threat to national or public security is one of the grounds for refusing access to information. I am talking about applying the law. First you have to ask whether the government has applied the exemption properly. That's the main question.

    If the individual concerned believes that the government did not apply the exemption correctly, he may submit a complaint to us and eventually obtain recourse to Federal Court. This then becomes a matter of fact, I believe. The issue is to determine whether the exemption was applied properly.

    Thank you.

    That is all for me.

     Thank you, Monsieur Gourde.

    Next up is Mr. Baylis for five minutes.

    Good morning. You talked about the de-indexing and erasing of information. If I understood correctly, there are no procedures to erase information, or people have to be much more specific when they request the removal of information rather than de-indexing.

    When information is erased, we are not just removing a link; information is actually removed from the infrastructure.

    There's a difference between the two. In the first case, the individual himself provided information that can be found on the Internet, for instance, on a social network. In that context, the individual should have an absolute right. He or she should be able to exercise that right without difficulty and in fact withdraw his consent. The information was placed on a site after the individual consented to it, but he may revoke that consent.

    There were other criteria. In the context of such an approach, the fact that it is accurate or not does not raise any questions.

    That is true.

    The other case in point is more frequent. For the purposes of this example, let's say that person A makes the request. Suppose A publishes information on a social network and that B, a friend of A's, then shares the information about A more broadly. This is where B's freedom of expression is at play, and that is where we have to find a balance between A's right to protect his reputation, and what we must take into account to remove information; is the information accurate, complete and up to date, and how is public interest served, if it is involved at all?

    If I understand correctly, we are missing some specific procedures to make such decisions.

    The current act states that companies—and that includes social networks and search engines—have the obligation to develop procedures. However, there is nothing about the nature of those procedures or the rules that might underlie them. Principle 10 in provision 4.10 of PIPEDA states that it is incumbent upon the companies to create procedures to ensure the respect of substantive rights such as the right to accuracy of information. However, there are no regulations at all and that is a problem.

    That problem, if I understand it, should not reside with the company to decide. Are you saying that we should have an overriding principle or procedures if such a situation were to come up?

     One of the issues that arises is whether companies faced with a request for de-indexing or takedown must take into consideration the interests of the publisher of the information. The law is currently completely silent about this. In Europe, the interests of the publisher of the information are not normally taken into consideration. That has led to criticism in Canada that the interests of these stakeholders are not considered. That's certainly an issue worth considering. The law doesn't provide for it. One of the things that would add value to your recommendation would be to speak to these issues. What rights should publishers of the information have to have their interests taken into consideration, I would add without making the right to de-indexing moot. If the publisher is made aware of the request for de-indexing, and then publicizes the fact that a request for de-indexing was made, that can make the request of the individual quite moot. The publisher needs to have their interests taken into consideration, but the fact their interests are taken into consideration should not lead to the publication of what the person thinks is inaccurate and should not be in the public domain.

    Therefore, it defeats the purpose of it.

    Yes, it defeats the purpose.

    You said in Europe it's 1,000 to one copyright versus personal information, but as you're explaining that to me, it almost seems that personal information could be a form of copyright. If I were a painter, I'd have rights to my painting. Let's say I took a photograph and I put it up on my Facebook, I'm effectively the publisher and, theoretically, I have copyright to that picture I've taken.

    In a sense, yes, although copyright is a commercial right while privacy is a human right, so the analogy only goes so far. I understand what you're saying, though.

    Mr. Baylis, that's time. I know there's lots to talk about.

    Next up, for five minutes, Mr. Kent.

    I would like to come back to the right to accuracy that you referred to. Do you think imposing or directing corrections or removing inaccuracies would be easier for you as commissioner than absolute erasure, removal, or de-indexing of information?

    It depends on the context. The act speaks to this question. It says an application can lead to actual takedown, or to corrections, modifications, or comments. It may be, depending on the case, that adding a comment—Mr. A has informed us that fact y about him is incorrect—may be effective. I think it would rarely be effective, but it may be in some cases.

    I'm taking the act for what it is. It suggests a number of potential remedies, from actual takedown to de-indexing, to corrections, to making comments. Of course, making comments has a lesser impact on the freedom of expression of the person who put the information online, but it may not be very effective, depending on the case.

    I'm thinking of the case of Wikipedia, for example, and most often public figures, whose the web pages are constantly being rewritten and facts are constantly being exaggerated, misrepresented, or whatever. Would you see—with amendments, reform, and the strengthening of your order-making powers—the ability to affect Wikipedia specifically?

    The short answer is yes. For the longer answer I would go back to the statistics in Europe: search engines and organizations have generally done an okay job, based simply on the fact that the vast majority of complaints to the data protection authority have led to a rejection. Ultimately, yes, it would come to the commissioner—and really, ultimately, to the court—to decide these issues.

     Finally, do you consider that your request for amendments to the act, with the order-making powers and penalties, should be done with an intent to harmonize with European laws?

    It should be done in part, but not mostly. I'm making these recommendations because I think it's necessary to have the authority to address those who will not otherwise comply.

    So in some cases you might be getting ahead of European—

    No. Am I recommending order-making mostly to make Canada's laws adequate? No, but it's the main factor in asking for these powers. Without regard to Europe, I think it's important that I have these powers to ensure that the law is respected even by the recidivists, the recalcitrants, and so on.

    Thank you.

    Thank you, Mr. Kent.

    Next up is Ms. Vandenbeld.

    Thank you very much.

    I would like to ask about the education component you were talking about, particularly for young people. During the committee on the status of women's study on violence against young women and girls, we heard there is a lot of misinformation, particularly amongst boys, about what is appropriate, or even legal, to post.

    One study said that boys thought that posting something, especially if it's an intimate image of a girl, was not okay, but forwarding it was perfectly fine if somebody sent it to you. The fact is that many young people are uncertain about what is legal or what is right.

    I'm very interested in the concept about this rights-based privacy education program. I'm wondering who would be doing that program. Would it be your office? I know that the YWCA, MediaSmarts, and a number of other groups are doing this kind of education.

    All of the above.

    That's fantastic.

    One of the things we studied on the Status on Women committee was the Australian model. I don't know if you're aware that Australia in 2015 put together their Office of the eSafety Commissioner. It reports to the Australian Communications and Media Authority, which is their CRTC, and among the mandates of that commissioner is to do public education for young people on eSafety and to receive complaints.

    This is one of the areas that's very difficult, because young people often don't know where to go to complain. They don't know whether or not it would be your office, but that would be on the privacy side of things. If it's a legal issue, it would be the RCMP or other legal authorities.

    Would there be some merit in having a single eSafety commissioner who would oversee, particularly for children, the complaints process? It would be a single point of contact, and it could also do some of the education.

    I haven't given this much thought. Certainly the interests of youth would make this something to consider seriously. All the relevant players should look at this very seriously, including our organization, provincial privacy commissioners, civil society organizations like MediaSmarts, and provincial departments of education.

    In November 2017, I wrote to the Council of Ministers of Education and my provincial counterparts, and the reaction has been positive so far. The council has written back to say that individual provincial ministers will be in touch with provincial privacy commissioners to see how this can come to fruition.

    I would say we need to give some thought to your proposal, but I think if all the right players play their role fully and appropriately, we'll probably get to the right place.

    Thank you.

    I want to pick up on something Mr. Angus said about public figures. It was interesting to me because we as public figures have a much-reduced expectation of privacy. We've heard about things like female politicians having their faces photoshopped with pornographic images and things like that. I would imagine the legal recourse, regarding what you're saying about public figures and their expectations, would presumably be about things that are not within the law.

     That would affect the professional reputation of the individual....

    Okay. Where would you draw that boundary?

     Even when we were talking about cybersexual violence and cyber-bullying, at what point is it in the legal category in terms of the bullying and at what point is it...? Even the definitions of harassment have not caught up in terms of online harassment and our harassment policies. At what point—and of course these are difficult questions—would it fall under your office, for instance, as opposed to going to the RCMP or to a defamation suit?

    The police would be involved.... I think it's a question of degree and gradation. The police of course would be involved if the act were criminal in nature or if it had that tone to it. I think our goal and the goal of organizations, including search engines, is at a lower level of accuracy or completeness of the information.

    I think one of the virtues, perhaps, of what we're proposing is that there can be relatively quick access with conduct that is far from reaching criminal behaviour. The history in Europe is that 40% of requests are granted, so that's a real, practical remedy that's given quickly in a sizable proportion of cases. Police would be involved in much more serious cases.

    Thank you.

    Thank you, Ms. Vandenbeld.

    As we discussed previously, we're going to have the commissioner here until all the questions are exhausted. We only have a couple of extra ones once we're done our time here. We have Mr. Angus for the next one, and I think we have Mr. Erskine-Smith and Mr. Baylis for some simple points. Then we should be done.

    Mr. Angus, for three minutes.

    Thank you very much.

    I'd certainly hate to recommend—after my colleagues here have done such incredible work—that if we're going to be talking about issues of takedown, online reputation, and order-making powers, specifically on that, I think we're going to need to discuss this more.

     I'm not all that comfortable with looking at what Europe has done. It's helpful, but I think that if we look at Canada's role in dealing with copyright legislation over the last 15 years and the issue of takedown, we can see that Canada carved out a unique position, as opposed to the Europeans with their electronic commerce directive and to the U.S. with the DMCA. We have a notice and notice regime because there were serious concerns that the power of the rights-holder could infringe on development of the Internet and on rights.

     We established a notice and notice regime. That has put Canada in I think a very interesting place, so if we're going to be looking at protection of online rights and reputation and also making sure that we are somehow balancing the right to publish and to make commentary and to challenge, it's going to take I think a really fulsome and public discussion, because this is not just about changing regs. This is about how people interact.

    Absolutely.

    I'd like to ask you if you've looked at the Canadian regime in terms of takedown versus the Europeans and the Americans, because we have really carved out an interesting compromise position.

    We've certainly looked at the place of freedom of expression in Europe, Canada, and the U.S. It's different in the three jurisdictions.

     At the end of the day, I think it's important that I act based on the current law to protect the reputation of people, but at the same time, there are, as I say in the paper, extremely legitimate questions about the balance with freedom of expression. An important reason why I think it would be worthwhile for you as elected officials to look at this is exactly the reason you suggest: that there is a Canadian way of balancing these important interests.

     I cannot invent this. I have to apply the law as it is, but you may hear experts, stakeholders, and citizens on these very important questions—the fabric of the country—and make proposals and legislate.

    What you're saying is that these are issues that you've identified as serious and that require a deeper examination so that we can have the tools and your office can have the appropriate tools that are balanced. You're asking Parliament—

    Mr. Daniel Therrien: Yes.

    Mr. Charlie Angus: —to engage in this process.

     Yes, but in the meantime I have to apply the law as it is.

    Thank you very much.

    Thank you, Mr. Angus.

    We have run out of time, but again we have two further questions. These are from Mr. Erskine-Smith and Mr. Baylis.

    Mr. Erskine-Smith.

    My question relates more generally to the right to deletion. I understand from the report and from other things in your testimony today that we have a right to deletion under PIPEDA as currently interpreted.

    Just so that we're clear on this, my question is, where does that case law run out? We might want to codify some of that in our recommendations, but do we want to go further than the existing case law? To the extent that we want to go further, can you explain to this committee how much further we want to go and where the runway ends on the current interpretation?

    I'll start, and I'll ask my colleague, Regan Morris, to complete my answer, because he has read more about these issues.

    To me, the runway ends with the reasonable interpretation of the words of the statute as they are, so the substantive rights granted are to accuracy, completeness, and the up-to-date nature of the information. In some cases, de-indexing will be an effective remedy, but in others, takedown will be necessary to be an effective remedy to ensure compliance with these principles. That's what I would say.

    Regan.

    I'm not sure I have much to add to that point. It's a difficult question. I think it ties back to the commissioner's recommendation that Parliament look at these issues and at the balance between freedom of expression and privacy interests. That may speak to additional criteria being added to the legislation to address those issues and the appropriate—

     I have just a short follow-up, I guess. There's de-indexing. There's the right to take down information that you've posted. Then there's the right to have information taken down, not just de-indexed, of things other people have said to you.

    Just so I'm clear, your view would be that we should have a right to de-indexing that's clear in the act, and a right to take down information in certain instances, but you wouldn't go so far as to say there should be a right to take down information that other people have posted, and that rules like defamation law should be applied to that category.

    I think the position in the paper is that there's a balance when what's at issue are comments that someone else has posted about you, because it's not just your personal information that you've posted; it's someone else's views. They have some expressive rights, so it can't be an absolute. You have the ability to take down that information.

    What would we want beyond defamation law? We have defamation law, and I can sue and have something taken down. Do we want rules beyond that when it comes to things other people have posted? Defamation law does just that: it strikes the balance between freedom of expression and protecting reputation.

    I wonder, are we talking about different rules beyond defamation law when we talk about what other people post? I think I'm clear on the first two paragraphs.

    I would say two things, maybe, on that.

    An important distinction is between facts and opinions. Accuracy obviously relates to facts; opinion is freedom of expression and should not be touched by any other entities, as I'm advocating.

     Should we go beyond defamation? I think that if information put up by someone about somebody else is factually inaccurate, that can lead to an action under defamation law, but I think it would be more effective to either de-index or take down the information. I think we're playing with the same substantive considerations. It's a question of whether it's okay to have two remedies. I think it is okay to have two remedies: one that's faster, the other the existing defamation law principle.

    That clears it up. Thanks very much.

    Thank you, Mr. Erskine-Smith.

    Next up is Mr. Baylis.

     My question has been half or mostly dealt with. However, I just want to further understand it. I'll use Facebook as an example. If I publish something on Facebook, I am the publisher of that. You would agree that I have the full right to remove that. I have the full right of takedown.

    Mr. Daniel Therrien: Yes.

    Mr. Frank Baylis: If I publish something, or put it up there, and someone then takes a portion of it, or let's say all of it, and shares or puts it on their Facebook page, I come along and say, I want my page taken down. Then comes in the question of de-indexing or the rights I have over that other person's Facebook page who has used my information when I had put it up there with the right to be used. Let's say I did the same thing with a book I published. That gets into copyright as well. Once I put something out there, I have the right to take that information down myself.

    How do you see my right to impose a de-indexing or takedown of someone else's Facebook page for argument's sake?

    If the request were to be granted to remove what is on the other person's Facebook page, first of all, the requester would have to demonstrate that the information is inaccurate. If the source of that information is what the first person had just put up, that would be pretty difficult.

    The first requirement is to prove inaccuracy or incompleteness, or that it's not up to date. Let's assume that 10 years have gone by between the original posting and the second posting and the first individual now claims that the information is no longer up to date and current. Then it's more possible. Then the organization would have to distinguish the facts. Are they still accurate in the opinion of the second person? If there's a question of opinion by the second person, then that should not lead to the takedown of that opinion of the second person.

    Let us assume the information posted was accurate and at the point of takedown it was accurate, but the person posting it has, as you said, the full right for takedown. I've posted it accurately. It remains accurate and I want it down. I simply don't want to share that information anymore. However, someone in the meantime has taken that information and put it somewhere else.

    What do you see as my right in a situation like that to remove something that I've put up that is and remains accurate?

    Accuracy would be a factor, but the freedom of expression of the second person would have to be considered in that situation. Therefore, the right of takedown would not be absolute. There would need to be some consideration of the expressive rights of the second person before the request would have to be verified.

    I'll get to my point why I'm asking. Let's say I'm Facebook, the company, and Facebook itself says, once you posted this information I copied it to my second server, which I own, and now I'll take it off my first server and put it on my second server, which has Frank Baylis was this person—not is, but was—and this is all the information still available.

    How can I actually extract anything if we don't have some rights to remove that, without going through the point that it's accurate or not?

    I don't have an exact answer, but I would not give extreme consideration to the right of the organization to the information in question. At the end of the day, it is the individual's information and PIPEDA is written to protect....

    Let's assume it's not the organization, but some really interested guy is collecting information on thousands of people and he's doing this. It's just a person. He's doing it and putting it up there because that's what he likes to do.

    That's probably exactly what leads to profiles becoming inaccurate over time. This goes to individual control by individuals. If Daniel Therrien puts information on social media at a point in time, but I can delete and remove it because I no longer want it and it's my information, it should not be possible for others to scrape it off the internet, put it somewhere else and make it available say three, five, ten years later when I don't want that information to be out there. It's still my information. You cannot have control of the information if others can just, again, scrape it off the Internet.

     How would we write that?

    We will have a crack at it. We can write to you on this question. These are not easy questions.

    Mr. Baylis, is that fine?

    We said we were going to exhaust all the questions. Are there any further questions for Mr. Therrien?

    Mr. Gourde.

    My question is in the same vein as the one put by Mr. Baylis.

    In the House, we can debate a given topic for 10 or 15 minutes, but certain media can quote only the beginning of a sentence, the middle, or the end of another sentence that we may have said on another occasion. They put all of these bits together and create a whole new sentence. That sentence was never spoken in that way, but all of the words are there. Then it gets published on Facebook and reported on television or radio.

    As members, do we have any recourse against that? Everything is recorded by the parliamentary network but the sentence in question was never spoken verbatim; it was edited.

    I have not analyzed that question in detail, but I would say that your recourse would probably be to express yourselves as parliamentarians and public persons, and refute this practice by the media in question.

    Thank you.

    Thank you.

    As one who experienced that very thing in one of our national publications, where something that I didn't say was actually put in quote marks, I can relate to that exact problem.

    Thank you, Mr. Therrien.

    Ms. Vandenbeld.

     I don't want to open up another can of worms, but going by Mr. Saini's question, what if the server where this person took that information is in another country, outside our jurisdiction? We know that on the Internet, things are posted internationally.

    There are rules in PIPEDA regarding that law's jurisdiction and my office's jurisdiction over activities outside of Canada. There needs to be a sufficient link to commercial activities in Canada for PIPEDA to apply. In many cases, foreign companies have commercial activities that have an important link to Canadians. They offer services to Canadians, and that means that PIPEDA applies even though the company is outside Canada.

    Thank you again, Mr. Therrien. I'm sure we'll have you back at some point in the future.

    Thank you.

    I'm going to suspend for five minutes until we can come back to consider the draft report.

    [Proceedings continue in camera]