Appearance before the House of Commons Standing Committee on Access to Information, Privacy and Ethics on Privacy Implications of Camera Surveillance
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
October 28, 2010
Ottawa, Ontario
Opening Statement by Patricia Kosseim
General Counsel, Office of the Privacy Commissioner of Canada
(Check against delivery)
Introduction
Thank you Honourable Members of the Committee for inviting us to appear before you as you resume your study on the privacy implications of street-level imaging technology. I am Patricia Kosseim, General Counsel and Head of the Legal Services, Policy and Parliamentary Affairs Branch of the Office of the Privacy Commissioner of Canada, and I am joined today by Me Daniel Caron, Legal Counsel, and Dr. Andrew Patrick, Information Technology Research Advisor. On behalf of the Privacy Commissioner, I would like to relay to Committee members her regrets for not being able to be here with you today as she is currently out of the country.
Before taking questions from members of the committee, I would like to provide a brief overview of some of relevant developments in this area since former Assistant Commissioner Elizabeth Denham appeared before this Committee during the last session of Parliament on October 22, 2009.
Prior to Google Street View being launched in Canada last year on October 7, 2009, our Office, along with our provincial counterparts from British Columbia, Alberta and Québec, issued a Fact Sheet on street-level imaging entitled “Captured on Camera: Street-level imaging technology, the Internet and you”, where we offered Canadians more information on the privacy implications of street-level imaging technologies. We outlined our views that companies rolling-out such technologies:
- Need to be proactive and creative to ensure that Canadians know when they may be photographed;
- should employ proven and effective blurring technologies for faces and vehicle licence plates;
- must offer fast and responsive mechanisms to allow any images to be blocked or taken down upon request; and
- must have a good reason to keep original, unblurred images and must limit how long they keep them and protect them with appropriate security measures.
Since former Commissioner Denham’s appearance before this Committee last year, our Office has continued to stress the importance of ensuring that privacy remains an utmost consideration in the development of new products and services. However, events of the last year show that organizations need to build greater personal information protections into their new products while they are being developed. The incident involving Google’s collection of Wi-Fi payload data from its street-level imaging vehicles is an important lesson in that regard.
Google Wi-Fi Incident:
In May 2010, Google discovered that, in an effort to collect information about Wi-Fi access points to enhance the company’s location-based services; its Street View cars had inadvertently collected payload data from unsecured wireless networks. Google then grounded its Street View cars, stopped the collection of Wi-Fi network data on May 7, 2010, and segregated and stored all of the data already collected.
Pursuant to section 11(2) of the Personal Information and Protection of Electronic Documents Act (PIPEDA), the Commissioner may initiate a complaint in respect of an organization’s personal information management practices if she believes there are reasonable grounds to investigate the matter.
On June 1, 2010, our Office sent a letter to Google stating that the Commissioner, as per her statutory discretion, had initiated three complaints against the company, namely:
- Google’s collection, use or disclosure of payload data was done without the individual’s prior knowledge and consent;
- Google’s collection of payload data was done without prior identification of the purposes for which personal information was collected; and
- Google’s collection of payload data was not limited to that which was necessary for the purposes identified.
In the course of the Commissioner’s investigation, representatives from our office went to the Google Mountain View facility on July 19, 2010 to review samples of the data collected by Google. Following the investigation, which included several exchanges with Google, the Commissioner issued her preliminary letter of findings on October 19, 2010.
Findings:
As stated by the Commissioner during her appearance before the Committee on Tuesday, October 19, 2010, her investigation found that Google had inappropriately collected personal information from unsecured wireless networks. In some cases, that personal information was highly sensitive, including complete e-mails, user names and passwords, and medical conditions of specified individuals. Unfortunately, this collection of data was inadvertent and due to an error that could have been easily avoided if Google’s own procedures had been followed.
Essentially, the engineer who developed code to sample categories of publicly broadcast Wi-Fi data also included code allowing for the collection of payload data -- thinking that this type of information might be useful to Google in the future. The engineer had identified what he believed to be “superficial” privacy concerns, but contrary to company procedure, failed to bring these concerns to the attention of Product Counsel whose responsibility it would have been to address and resolve them prior to product deployment.
The investigation revealed that a number of privacy protection principles found under PIPEDA had been violated. Accordingly, in her preliminarily letter of findings, the Commissioner recommended that:
- Google re-examine and improve the privacy training it provides all its employees, with the goal of increasing staff awareness and understanding of Google’s obligations under privacy laws.
- Google ensure it has a governance model in place that includes:
- effective controls to ensure that all necessary procedures to protect privacy have been duly followed prior to the launch of any product;
- clearly designated and identified individuals actively involved in the process and accountable for compliance with Google’s obligations under privacy laws.
- Google delete the Canadian payload data it collected, to the extent that Google is allowed to do so under Canadian and U.S. laws. If the Canadian payload data cannot immediately be deleted, the data needs to be properly safeguarded and access to it should be restricted.
At this time, the Commissioner considers the matter to be still unresolved. The matter will be considered resolved upon receiving either by or before February 1, 2011, confirmation that the company has implemented the above recommendations, at which point she will issue her final report and conclusions accordingly.
We look forward to Google’s implementation of our recommendations and hope that they will henceforth ensure – both in procedure and in practice - that effective measures for protecting personal information are built into their new technologies at the very early stages of product development.
Conclusion
Our Office will continue to ensure that the protection of personal information remains a key consideration for organizations prior to launching new products or services, so that Canadians may benefit from innovative products developed with the protection of their personal information in mind.
Thank you.
- Date modified: