PRIVACY and SOCIAL MEDIA in the AGE of BIG DATA Report of the Standing Committee on Access to Information, Privacy and Ethics
Total Page:16
File Type:pdf, Size:1020Kb
PRIVACY AND SOCIAL MEDIA IN THE AGE OF BIG DATA Report of the Standing Committee on Access to Information, Privacy and Ethics Pierre-Luc Dusseault, M.P. Chair APRIL 2013 41st PARLIAMENT, FIRST SESSION Published under the authority of the Speaker of the House of Commons SPEAKER’S PERMISSION Reproduction of the proceedings of the House of Commons and its Committees, in whole or in part and in any medium, is hereby permitted provided that the reproduction is accurate and is not presented as official. This permission does not extend to reproduction, distribution or use for commercial purpose of financial gain. Reproduction or use outside this permission or without authorization may be treated as copyright infringement in accordance with the Copyright Act. Authorization may be obtained on written application to the Office of the Speaker of the House of Commons. Reproduction in accordance with this permission does not constitute publication under the authority of the House of Commons. The absolute privilege that applies to the proceedings of the House of Commons does not extend to these permitted reproductions. Where a reproduction includes briefs to a Standing Committee of the House of Commons, authorization for reproduction may be required from the authors in accordance with the Copyright Act. Nothing in this permission abrogates or derogates from the privileges, powers, immunities and rights of the House of Commons and its Committees. For greater certainty, this permission does not affect the prohibition against impeaching or questioning the proceedings of the House of Commons in courts or otherwise. The House of Commons retains the right and privilege to find users in contempt of Parliament if a reproduction or use is not in accordance with this permission. Also available on the Parliament of Canada Web Site at the following address: http://www.parl.gc.ca PRIVACY AND SOCIAL MEDIA IN THE AGE OF BIG DATA Report of the Standing Committee on Access to Information, Privacy and Ethics Pierre-Luc Dusseault, M.P. Chair APRIL 2013 41st PARLIAMENT, FIRST SESSION STANDING COMMITTEE ON ACCESS TO INFORMATION, PRIVACY AND ETHICS CHAIR Pierre-Luc Dusseault VICE-CHAIRS Scott Andrews Patricia Davidson MEMBERS Charlie Angus Brad Butt Dean Del Mastro Charmaine Borg Blaine Calkins Earl Dreeshen Alexandre Boulerice John Carmichael Colin Mayes OTHER MEMBERS OF PARLIAMENT WHO PARTICIPATED Mike Allen Jinny Jogindera Sims Joe Preston Dean Allison Daryl Kramp James Rajotte Kelly Block Jean-François Larose Hon. Geoff Regan Marjolaine Boutin-Sweet Laurin Liu Kennedy Stewart Rod Bruinooge Hon. Lawrence Mac Aulay Merv Tweed Sean Casey Joyce Murray Chris Warkentin Hon. Denis Coderre Tilly O’Neill Gordon Richard M. Harris François Pilon CLERK OF THE COMMITTEE Chad Mariage LIBRARY OF PARLIAMENT Parliamentary Information and Research Service Miguel Bernal-Castillero Dara Lithwick Maxime-Olivier Thibodeau iii THE STANDING COMMITTEE ON ACCESS TO INFORMATION, PRIVACY AND ETHICS has the honour to present its FIFTH REPORT Pursuant to its mandate under Standing Order 108(3)(h), the Committee has studied privacy and social media and has agreed to report the following: v TABLE OF CONTENTS PRIVACY AND SOCIAL MEDIA IN THE AGE OF BIG DATA ......................................... 1 THE COMMITTEE’S STUDY ..................................................................................... 1 THE PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT .............................................................................................. 1 CONCERNS SPECIFIC TO PRIVACY AND SOCIAL MEDIA ................................... 2 A. The Changing Practices of Individuals and Social Media Companies .............. 3 B. Balancing Innovation and Regulation ............................................................... 5 C. Shifts in Why and How Personal Information is Collected, Used and Disclosed ............................................................................................... 8 D. Accountability and Openness ......................................................................... 11 E. Obtaining Consent in Social Media Contracts and Agreements ..................... 14 F. Retaining and Deleting Personal Information ................................................. 19 CHILDREN AND SOCIAL MEDIA ............................................................................ 22 A. The Targeting of Children by Social Media Companies ................................. 23 B. Achieving Informed Consent .......................................................................... 25 C. Balancing Children’s Privacy Rights with Parental Duties and Concerns ...... 27 D. The Importance of Digital Literacy ................................................................. 29 CANADA’S LEGISLATIVE FRAMEWORK IN AN EVOLVING LANDSCAPE .......... 31 A. Current Amendments before the House of Commons (Bill C-12) ................... 35 B. The Enforcement Powers of the Privacy Commissioner ................................ 36 PRIVACY-ENHANCING MEASURES AND BEST PRACTICES ............................. 40 A. Privacy as the Default Setting ........................................................................ 40 B. Do Not Track .................................................................................................. 42 C. Privacy Charter .............................................................................................. 44 EVIDENCE SPECIFIC TO CERTAIN PRIVATE COMPANIES ................................ 44 A. Google ........................................................................................................... 44 B. Nexopia .......................................................................................................... 48 C. Facebook ....................................................................................................... 49 D. Twitter ............................................................................................................ 52 E. Acxiom ........................................................................................................... 54 F. BlueKai ........................................................................................................... 56 vii INTERNATIONAL EXAMPLES ................................................................................ 58 A. The European Union and Enforcement Powers ............................................. 58 B. The United States of America and the Federal Trade Commission ............... 60 THE COMMITTEE’S TRIP TO WASHINGTON, D.C. .............................................. 61 A. U.S. Legal System ......................................................................................... 61 1. Definition of Privacy ................................................................................ 61 2. Legislative Framework ............................................................................ 62 3. Federal Trade Commission .................................................................... 63 B. Balancing Innovation and Regulation ............................................................. 65 C. Collection, Use and Disclosure of Information ............................................... 67 D. Accountability and Transparency ................................................................... 68 E. Consent .......................................................................................................... 69 F. Security .......................................................................................................... 69 G. Right To Be Forgotten ................................................................................... 71 H. Do Not Track .................................................................................................. 72 I. Powers of the Privacy Commissioner of Canada ............................................. 72 APPENDIX A — COMPARING DEFINITIONS IN SOCIAL MEDIA PRIVACY POLICIES AND TERMS OF SERVICE ......................................................................... 75 APPENDIX B — ENFORCEMENT POWERS GRANTED BY PRIVACY LEGISLATION AROUND THE WORLD ........................................................................ 77 LIST OF RECOMMENDATIONS .................................................................................. 83 APPENDIX C — LIST OF WITNESSES ....................................................................... 85 APPENDIX D — LIST OF BRIEFS ................................................................................ 89 APPENDIX E — MEETINGS WITH INDIVIDUALS AND ORGANIZATIONS IN WASHINGTON OCTOBER 3 TO 5, 2012 ................................................................ 91 REQUEST FOR GOVERNMENT RESPONSE ............................................................. 93 SUPPLEMENTARY REPORT OF THE NEW DEMOCRATIC PARTY OF CANADA ................................................................................................................ 95 viii PRIVACY AND SOCIAL MEDIA IN THE AGE OF BIG DATA THE COMMITTEE’S STUDY On May 8, 2012, the House of Commons Standing Committee on Access to Information, Privacy and Ethics (“the Committee”) agreed to undertake a study on the efforts and the measures taken by social media companies to protect the personal information of Canadians, and to report the Committee’s findings back to the House of Commons.1 On May 29, 2012, the Committee held its first hearing on this matter. Jennifer Stoddart, the Privacy Commissioner of Canada, appeared before