Information & Ethics committee  In terms of harmonizing rules and considering how rules are done in different places, it's tremendously important but also tremendously difficult. Ideas about privacy and the appropriate limits of the private sphere, as well as how your personal information should be handled, vary tremendously from place to place, so it's very difficult to come up with a common standard on issues like privacy or data protection.

Information & Ethics committee  In terms of the rights of the consumer in terms of deletion and understanding, again, transparency plays an important role at the outset. Users should be able to understand what information about them companies are holding, and then requesting that the deletion is of that information, or the removal of that information when they leave the service, or the correction of that information, are important aspects to pursue.

Information & Ethics committee  Journalists' source protection is a very important principle of freedom of expression and needs to be protected. We're moving away from PIPEDA here, but I think the law is not as strong in Canada as it should be. It's a cardinal rule that needs to be safeguarded that journalists don't need to divulge their sources.

Information & Ethics committee  I think consent is certainly a prerequisite, and I think you must have some form of consent within any system, but in a lot of the examples that you mention, consent is not the only thing that comes into play. There are also regulations and rules that govern these relationships.

Information & Ethics committee  It's well established to have different rules in place for protecting children in terms of gathering their information and tracking their information. I think there's a huge challenge online in implementing that, because it's quite difficult, I think, in terms of people who navigate to a particular website to know how old the users are.

Information & Ethics committee  Because you can't necessarily know how old the person is who's on the website, I think the best option is to look at those websites that are directly targeting children, or that have a target audience geared towards younger web users, and to maybe expect a stronger standard to be imposed on them.

Information & Ethics committee  I haven't examined the case. I haven't read the case. I've read only second-hand accounts of it. What I will say is that one of the things that struck me was that it demonstrates some of the challenges in jurisdiction you have in these kinds of cases. This is not specific to the right to be forgotten.

Information & Ethics committee  [Inaudible—Editor] against relying on market incentives or thinking that companies that have a direct interest in keeping their users' information secret or following better practices will necessarily do that. Ashley Madison is a great example of a company that had a direct interest in having strong security and strong privacy protections, had nothing good in place, and didn't follow any industry best practices to safeguard user information or protect users' privacy.

Information & Ethics committee  Certainly, it was a failure of that company, but I think you could say that the fact the company was allowed to operate the way it did, with such shoddy security practices, was potentially a failure of legislation or a failure of enforcement, in the sense that there were basic security mistakes being made that weren't necessarily being monitored or followed up on.

Information & Ethics committee  That was the original case at the ECJ, yes.

Information & Ethics committee  No. I think the judgment of that specific case was terrible. That's a lot of what I was speaking to in terms of the lack of clarity and in terms of the solution that was proposed. As well, specific to that case, I don't think it's a very good test case in terms of the right to be forgotten.

Information & Ethics committee  My understanding of the way in which it's applied is based on the initial rollout of the ECJ decision. I believe the data protection regulation does address that, but I haven't reviewed that specific aspect.

Information & Ethics committee  I'll start by endorsing the distinction that Professor Scassa made between data protection and a right to deletion and a right to be forgotten, because that is a key distinction. The way it was handed down was the first problem we saw. There was a decision by the European Court of Justice that didn't even really mention freedom of expression, and included statements that, for example, the right to privacy generally trumps people's right to obtain information.

Information & Ethics committee  I'm not entirely convinced of the need for order-making powers. It's not something that I necessarily oppose, but I do think it raises some issues in terms of the procedural fairness of investigations, which the OPC itself has mentioned. To me, the bottom line is necessity. I think the reason I'm not completely sold on the order-making power is that we've previously heard from the Privacy Commissioner that most of their recommendations are ultimately complied with.

Information & Ethics committee  At the moment, I wouldn't make a recommendation in favour of the right to be forgotten. The reason I'm a bit couched in that is that I do see some potential problems that could be addressed, but if you want a recommendation on whether or not to legislate that, I would be against it.