Proceedings of the Standing Senate Committee on
Transport and Communications
Issue No. 24 - Evidence - October 31, 2017
OTTAWA, Tuesday, October 31, 2017
The Standing Senate Committee on Transport and Communications met this day at 9:33 a.m. to continue its study on technical and regulatory issues related to the deployment of connected and automated vehicles.
Senator Dennis Dawson (Chair) in the chair.
[Translation]
The Chair: I call to order this meeting of the Standing Senate Committee on Transport and Communications. This morning, the committee is continuing its study on connected and automated vehicles.
[English]
Today we have two panels of witnesses. For this first panel, I would like to welcome Ms. Sharon Polsky, President, Privacy and Access Council of Canada.
[Translation]
Thank you for joining us. I invite you to make your five-minute presentation, which will be followed by senators’ questions. Ms. Polsky.
[English]
Sharon Polsky, President, Privacy and Access Council of Canada: Thank you, chair and honourable senators. Thank you so much for inviting me to join you this morning and for the important work that you do.
Since 2002, the Privacy and Access Council of Canada has taken a leadership role in advocating for Canadians who deal with Canada’s dozens of privacy and access laws.
PACC is an independent organization that is non-governmental, non-partisan, non-profit and not funded by government or industry. We are the certifying body for Canada’s privacy and data protection practitioners, and our members in private and public sector organizations are in organizations as diverse as law, technology, law enforcement, academia, health care and, of course, government.
We know from experience just how well our laws work to protect our privacy and how well they work to enable Canadians to exercise their right to gain access to information. We also understand that good intentions and benefits to be enjoyed from innovative technologies such as intelligent vehicles can lead to pernicious, unintended consequences.
In addition to being president of PACC, I have enjoyed a long career advising clients in government, the public sector and private sector organizations across the continent about technology, laws and trends that affect access and privacy.
Like many, many PACC members, I am painfully aware that the vast majority of Canadians trust that laws protect our privacy. Sadly, most Canadians know very little about the country’s access and privacy laws or their rights and responsibilities or how to protect their own data. Most of them actually rely on the first line of most privacy policies that says, “We protect your privacy. We respect your privacy.”
Unfortunately, that’s as far as most people go, and they don’t read beyond that to recognize that the very carefully chosen language that we have really no option but to agree to gives the organization licence to do with our information as they wish.
When Nissan transfers Canadians’ personal information to the United States or to other countries that have a patchwork of definitions as to what constitutes personal information, the protections of Canada’s privacy laws are irrelevant.
Ford Canada’s website assures consumers that personal information will be kept according to a retention schedule and then be destroyed. But retention schedules can specify that data can be retained forever, but we’ll never know because they are internal corporate documents.
The information highway used to refer to the Internet. Now, with emotionally aware vehicles that can scan our eyes, our fingerprints, our faces and communicate with other vehicles and with smart buildings, smart street light systems, smart bicycles and the smartphones that we all carry, the information highway is our roadways. They are the information highway.
IBM has cautioned that modern vehicles are data centres on wheels where up to 80 per cent of innovation is driven by software and may contain as much as 10,000 vulnerabilities.
The effect of ransomware is going to be astounding. Like other databases, in-car personal profiles stored in the cloud are an accident waiting to happen.
All of this has been foisted upon an unsuspecting Canadian public assured by industry and government that nobody cares about privacy. Senators, nothing could be further from the truth. Just ask any of the millions of people wondering if they too are victims of the Equifax breach.
We have been lulled by messaging about the benefits and economic potential of intelligent vehicles. I agree, they are important to help us get from point A to point B more quickly and safely, to keep older drivers safe behind the wheel longer and to help parents watch their children from afar. It is comforting to know that if the air bags in my GM vehicle deploy, OnStar can send an ambulance to my location, even if I’m unconscious and can’t tell OnStar where in the world I am.
The data from our interactions with intelligent vehicles can be important to advance innovation and economic prosperity, and smart vehicles can make the ride more fun.
Some automakers collect information about us from online, offline and third-party sources such as social media. Others have integrated voice-enabled technology into their vehicles with personal assistants. But do you really want insurance rates influenced by the questions you ask your car’s Siri or Alexa?
I ask you: What child on the way to hockey practice consents to their conversations on social media being collected or their location being gathered and analyzed? Yet the Global Automakers of Canada industry group is clear that consumers consent to their vehicles collecting personal information and learn all there is to know about this Faustian information bargain at the time of purchase.
Our research results are quite different. We found no mention of data privacy, collection, use or access in any vehicle owner’s manual that we examined. None. We also found there is no way for us to halt the data collection. We can put our smartphones on airplane mode to halt the data collection, but we, the vehicle owners and drivers, have no such ability. And we have no way of stopping our vehicles from collecting and sharing that information with we don’t know who.
So I ask you: Who will protect any of us against assumptions made about us when our vehicles reveal that we regularly drive to a mosque or a church or a synagogue, a massage parlour, an AIDS clinic, a mental health facility or a pot shop? At the U.S. border it could get interesting.
When there is an access request, who is the ATIP coordinator going to ask for responsive records? The vehicle owner, the public body, has no way to know which nameless partner or affiliate your vehicle shared employee information with. So how can an organization meet its legal obligation to provide access or comply with the Digital Privacy Act’s requirements to record all security breaches when they have no idea if data gathered by the vehicle systems has been breached?
What civil servant consents to their in-car conversations about anything, from the mundane to fundraising to national security, being analyzed by car companies or nameless partner affiliates in another country? In many Canadian jurisdictions, that breaches privacy law.
And really, what are we to expect when automakers like the General Motors Family of Companies put the onus squarely on us to obtain consent for all of this from anybody who uses our vehicle? That’s a proxy that’s not permitted under Canadian privacy laws.
Senators, this gives you a taste of just some of the access and privacy issues that must be resolved before connected, autonomous and other intelligent vehicles become a literal road to hell paved with good intentions.
I welcome your questions.
The Chair: Thank you. Those are challenging comments.
Senator Bovey: This is pretty frightening stuff. Thank you for your insights and for your clairvoyance in asking the questions. I want to talk about car rentals. I rented a car this summer and was intrigued when my daughter connected her smartphone to find that all the email addresses of the former users of the car were on its console. Needless to say, I didn’t connect my cellphone.
That said, I think your questions are very much our questions, so I’m going to cut to the chase: What recommendations or aspects need to be included in Canada’s privacy laws, and what kinds of regulations should we be recommending to the government in terms of automated vehicles as they come forward with their federal responsibility for regulations?
Ms. Polsky: Senator, I’m glad you’re looking forward to these very important issues.
As you say, vehicles of any sort capture our information. I was quite entertained to learn from a sales manager that when you connect your car and your phone and it downloads your entire database, apparently the car actually doesn’t download anything. Then he assured me that you could delete the information that hadn’t been downloaded.
Senator Bovey: That’s really interesting because we saw all the lists of the addresses of the people where the previous drivers had gone.
Ms. Polsky: Precisely. That maybe gives an indication of the veracity of the information that consumers are given, or that sales and tech people in the dealerships are given. It’s a fractured framework.
As for what to recommend, I think we are all aware by now that Canada’s privacy and access laws have not kept pace with technology. They were developed at a time when fax machines were being developed and when putting a man on the moon was a great accomplishment. Now, the smartphones in our pockets have more computing power than they went to the moon with, and the laws have not kept pace.
Consent really is a fantasy. If we want to do business with an organization, we really have no option but to consent. That needs to be changed. There are a lot of people who will criticize that view and take it to an extreme and say, “But if we expect an organization to have to get consent for absolutely everything they do, it will bog down business and it will destroy commerce. It’s not workable.” That’s an extreme, I suggest, but there has to be a better way, and that consent mechanism is at the end of the process.
I would rather you recommend that privacy requirements be built in, like the privacy by design concept started by Dr. Ann Cavoukian, former Information and Privacy Commissioner of Ontario, which is now a global standard. If you build something that is privacy-aware to start with, then you don’t have the problems after the fact. It’s not a band-aid solution after a breach. Whatever you are building will safeguard — keeping in mind, of course, that we can’t create perfection and there will always be glitches, security problems and technology changes, but at least start from a solid framework.
Senator Bovey: I’m going to come back to my core question. What regulations need to be incorporated in the Privacy Act and what work is being done to update the privacy law? I well understand where they started. My former husband, when he was archivist of B.C., helped write the B.C. legislation, so I know what gyrations everybody went through. That was 25 or 30 years ago, right?
So what gyrations do we need to go through now to make sure that people’s privacy is protected? Surely this is a matter of legislation as well as regulations, and it will dovetail into the question of autonomous vehicles.
Ms. Polsky: The regulations, I think, are going to have to require automakers, first of all, to comply with Canadian privacy law. Enough authority has to be granted to our country’s access and privacy commissioners so that they can enforce the legislation that is on the books. For companies to flaunt it, I think, is not doing anybody a favour. It’s great for the economy, but is not good for us and our privacy.
The regulations will have to require that independent, audited testing be done to ensure the systems that are built really do regard and protect our privacy and enable us to have access to our information.
Taking it a step even farther back, I realize education is a provincial matter, but as a matter of public policy, national economic policy and a cybersecurity strategy, we think that education has to incorporate mandatory learning for children starting in kindergarten. I’m not kidding. PACC has been promoting this for a long time. Children already have devices in the cradle, and now there’s a great movement to teach kids to code. That’s like saying I’m going to teach my 10-year-old how to fix a carburetor but not tell them what a stop sign means.
It’s not helping. We need kids to be taught so that they can grow to become the legislators, the car designers and the technologists who will design things — laws, products, technology — that are privacy-embedded. It’s a long-term strategy, but we have to start. We’re already behind the curve.
Senator Bovey: I agree.
Senator Galvez: Thank you very much, Ms. Polsky, for opening our eyes. It’s frightening, but what is more frightening is that we had automotive companies here, and we asked a lot of questions; one of my colleagues, who is not present, made a point of asking security, hacking and privacy data questions every time. We were told not to worry, but we have to worry.
This has been in my mind since Facebook has been here. We know we don’t have a choice. We just have to press agree; we don’t read anything and then that is it: Our data is out.
Focusing on solutions, I have read about this privacy by design concept, and I think you are right in the sense that we have to control things upstream, not downstream. When the thing is done, it’s breached; so it’s upstream.
When we think upstream, we have been told that there are three levels of exchange of data. There is inside a car, which is where the people will have Internet, and then there is the second level of communication, which happens through the infrastructure and the other traffic. The third level of communication is with the GPS satellite that will drive us from point A to point B.
To whom does this responsibility belong, and who has ownership of the data? I am trying to understand. Who do we ask: the car company, the municipality, the owner? Could you elaborate on that, please?
Ms. Polsky: I can add to it as to who will be interested in that data; is it us? Imagine if we are driving an intelligent vehicle that takes some control and there’s a collision. I’ve had lots of discussions with lawyers, insurance lawyers and litigation lawyers, and nobody can answer this question definitively: Who owns the data and who will be held liable? Apportioning blame is great and it’s going to clog the courts further, for sure, but is it the car, is it the driver, is it the vehicle designer, the software developer, who could be in any country, of course? Insurance companies take ownership of the data in your car? We don’t know.
This is, as I say, a problem that has to be sorted out sooner rather than later. Perhaps it’s up to you to indicate and make recommendations to provide guidance as to who will own the data. If it’s my personal data, the law says I have certain ownership of it, but my ownership of it is not certain.
Senator Galvez: Thank you.
Senator Griffin: Thank you for being here. As my colleague just said, this is rather frightening. I think both colleagues have literally said that.
To follow up further, Senator Bovey asked you about regulatory instruments, but the Government of Canada has other instruments at its control. One is to set an example, and the other is financial instruments. Those two along with regulatory are basically how it encourages behaviour.
In terms of setting an example and in terms of financial instruments, do you see any possibilities there to help advance the situation?
Ms. Polsky: Economic impact, of course, is critical, and having innovative technology and being able to develop it, whether it’s to improve long-haul trucking or long-distance medical care, there are so many positive potential uses for all of this technology that I’m sure the government must be looking at the positive economic impacts.
How to encourage and incentivize compliance by the automakers is a challenge because I’m sure they are a very strong lobby. I am also certain that social media giants, such as Google, Amazon, Apple — name any of the big ones — are incorporating their technology into vehicles, sometimes for free with automakers just bearing the cost of updating the software, so they’re getting their software into the cars. They’re creating vehicles, and they are the ones who are saying that there should be no data sovereignty, whether it’s through NAFTA or the Trans-Pacific Partnership or other vehicles — no pun intended — that we should not be allowed to say where our information resides.
I think it’s incumbent upon our government to stand on behalf of Canadians to protect our privacy, your privacy, all of our rights as Canadians in Canada and make it very clear.
Senator Griffin: Following up from that, what’s your opinion about the Office of the Privacy Commissioner of Canada having more power to be more proactive in terms of anticipating potential problems and trying to head them off?
Ms. Polsky: Several years ago and on various occasions, I have been quite clear that Canada’s privacy laws are toothless. When Jennifer Stoddart was stepping down from her post as the federal commissioner, she said at a public forum that the privacy law is toothless. The commissioner does not have the power necessary to enforce the privacy legislation. The privacy law itself is not adequate.
Canadian companies jumped up and down and spent billions of dollars to get ready for SOX, the Sarbanes-Oxley financial information protection act out of the United States. Why? Failing to comply with it would visit millions of dollars in fines and jail time. They had no such compunction to turn themselves inside out to comply with Canadian laws that have very lax, if any, penalty, and very few commissioners who, from the federal level on down, except for Alberta, have any real enforcement power. There is no incentive. There needs to be.
So I strongly suggest that the Privacy Commissioner be given adequate power to compel the production of documents, and this applies across the country now that there’s the Supreme Court decision, courtesy of the University of Calgary and the Alberta commissioner. All commissioners need to have the power to compel at least examination of documents claimed to be under solicitor privilege. They need to have order-making power. They need to be able to conduct investigations not only after the fact or after a complaint but also of their own volition. When they see a problem, they need to be able to move on it. I suggest the commissioner also needs to have a budget and a mandate for education.
Senator Griffin: Thank you for that very fulsome answer.
The Chair: This has been an issue that has been brought up. We didn’t start this committee thinking privacy and thinking access to information, but it’s certainly been one of the thematics that has come back most often. As you just said, historically, you had to have a complaint for the Privacy Commissioner to act. I think that even though we’ve been making recommendations to the Minister of Transport, we’ll also be making recommendations to Industry Canada and to the Privacy Commissioner. I think that’s certainly one of the things we should be looking at.
One of the problems is that the technology is going so fast. We had some witnesses who talked about what Senator Bovey talked about. You put your Bluetooth in a rented car and — pardon my French — it sucks up all of your information. If you go back to Enterprise, Hertz or whatever, they have 42 different models of cars with three different models of Bluetooth technology in each one of them, and they can’t keep up. Even if they wanted to erase it, they said they can’t keep up with the progress.
Some of them might have bad intentions, and I don’t doubt that. Some of them don’t have bad intentions; they just don’t have the know-how to protect us.
Then there’s the other side. A lot of that technology and a lot of that information is going to be used in algorithms to protect you. If you want the car to start understanding what’s going on, it’s got to have enough information to be able to predict what actually will be done on the road.
There is a fine line between how much information and how much of it is used for the right reasons. As you said before, you have a Lincoln Continental and are driving down Highway 20 in Quebec. You’re getting close to Drummondville, and they say, “Your favourite steak house is having a special on porterhouses today, and if you want to come between noon and one o’clock, you’ll get 50 per cent if you give this code.” That’s going to happen.
Senator Mercer: When will that be?
The Chair: It’s on Tuesday at noon. That type of information can be humorous, and it is, but it can also be dangerous in the sense that they also know that here is your favourite strip joint, and it’s also coming up in 20 minutes, so the car owner will know more about where you’re going than your wife does. I’m trying not to be too funny because you’re not allowed to be funny anymore. But where do you draw the line on the type of information that you’re letting them use for making the car a better product and what is being used to invade your privacy?
Ms. Polsky: Where shall I start on your comments, Mr. Chair?
Do we let them use our information? We have no choice. It’s really a power imbalance. A few years ago, I remember seeing media reports that the automakers had agreed not to collect certain information. There was an industry agreement. Well, if they can agree today, they can “unagree” tomorrow. We have no choice. The limits have to be imposed on them.
As for car rental companies, sure, I have rented cars; I also don’t connect my cellphone. Yes, other people’s information is in there. You go to a hotel, use their computer or the printer, and other people’s information, their Internet searches, their documents are all there because, as I said earlier, people don’t know. They have never learned because most people who use computers and digital devices today were never taught. Their teachers weren’t taught; their parents don’t know this stuff. It is the blind leading the blind, as we are all being told, “Don’t worry your pretty little heads.” I have been told in those terms. “Trust us.” Well, the trust hasn’t been earned, in my humble submission.
As far as car rental companies go, there is another aspect. If there is an accident — and I have been through this; I have been contacted by members of law enforcement. “What do we do? Someone had a accident in a rented car.” They are not able to get the information from the car company. The car company refuses to give the information because it is the individual’s personal information. So it is an impasse. Nobody knows what to do.
As for algorithms, yes, they are necessary. The artificial intelligence being developed now is training itself, again taking that step of we don’t know what it is doing, what vehicles and technology are doing with our information. It’s getting worse, not better. Of course, companies say this is proprietary, so you are not allowed to even examine it for any purpose. A lot of algorithms perpetuate the status quo. They are built on historical information. It doesn’t change anything. There is a problem.
Again, we have to go back to the very beginning with education, with imposing limits on the car manufacturers, with clarifying who owns the data, with providing individual Canadians with control of our own data, and actual control as opposed to privacy policies and consent forms that say, “You consent to us doing anything with your information that is not unlawful.”
The Chair: But one of the challenges of Senator Bovey, when she doesn’t give her Bluetooth to the car, is that she doesn’t have hands-free in the car.
Ms. Polsky: Then you do like some of us dinosaurs and you use a little Bluetooth earpiece that is also hands-free. It is perhaps lower tech, but, there, we are sold the benefit of the convenience, the fun. It is enticing; it’s great. Of course, it is like children in the class. We all want to be in the in group; nobody wants to be left behind. The marketers, the technology and the psychologists behind the marketing have us. They know how to push our buttons and say, “Get the latest, or you’re going to be the only one who doesn’t.” I still drive a car, not a computer on wheels.
Senator Mercer: I apologize for not being here for your presentation. I recently bought a new car, and it has all these bells and whistles on it. I am a little nervous about what everything is. However, I do use the Bluetooth on it because it is my car, and it is the only one I use.
Do we need a mistake before we tighten up the privacy laws? Do we need something to go wrong? Do we need somebody to do something wrong or some awful thing to happen to some person because the laws aren’t tight enough before we tighten them up?
Ms. Polsky: Perhaps you are talking specifically about intelligent vehicles, but these problems have been happening daily. When Alberta brought in its legislation, in, I think, 63 paragraphs, the word “reasonable” was used 67 times. People would say, “What’s reasonable?” I would say, “It’s going to be up to the courts.” I kept saying that, perhaps, when there is a major breach and the courts step in and say enough is enough, things will change. That happened long ago; 500 million Yahoo accounts breached, gone, in the wind. Every major company, every minor company, companies that we don’t know that we deal with, banks and credit unions in Canada that only deal in Canada, when there was the Heartbleed breach, they got nailed. Why? Because a Canadian company dealt with a third-party company that dealt with a third-party company and, somewhere down the line, dealt with an American company that got caught in the breach. So the Canadian companies, the Canadian banks, had to bear the cost of reissuing account cards and all of that. It has already happened.
Senator Mercer: My point is that it appears to me that there needs to be some major crisis. Yes, we’ve all heard of these major breaches. What we need are those very specific individual examples that are going force people around here, both here and in the other place, in the House of Commons, to sit up and take notice and say, “We have to fix this.” By saying there are 22,000 files out there that have been compromised, unless you have specific examples of a young family whose livelihood has been threatened because of a breach or some other thing that is happening — I don’t know all of the things that could happen, but I am sure there are many — we need those examples to drive us. Unfortunately, government sometimes is not proactive; it is reactive. If they’re not going to be proactive, we need to make sure that they are aware of incidents that will drive the proactivity.
Ms. Polsky: Senator Mercer, these incidents have been happening to individuals; they are in the media. I don’t mean to offend, but I have to ask: Has any of this happened to any of you or somebody very close to you? Once it happens to us individually, then we stand up and take notice. If it only happens to others, it bears no relevance to our lives. When it happens to us, then things will change. I have seen this with legislators before, whether it is the cost of drugs or treatment, or whatever, things don’t change until it happens to them or their children or someone close to them.
Senator Mercer: Perhaps, chair, it might be a subject for a future study, a separate study of this committee because we are Transport and Communications.
Thank you.
Ms. Polsky: My pleasure, and I would be happy to provide you with some examples of individual instances.
Senator Mercer: That would be helpful.
[Translation]
Senator Boisvenu: I want to apologize for being late. I learned about the room change at the last minute, and we had to make two round trips by shuttle. I also apologize for my bad case of the flu.
I have a pretty brief question. We know that companies such as Google and Facebook lobby governments very aggressively, including the Government of Canada. We recently saw how Netflix managed to avoid having to pay a tax.
Are you concerned about those companies’ lobbying efforts? They sort of manage the hidden side of computer data. Are you worried that their influence on governments — both Canadian and American — may lead to lowered confidentiality and privacy standards and remove those companies’ obligation to protect that information?
[English]
Ms. Polsky: From my research, I understand that some of those major companies are indeed pushing to have their preferences protected at our peril. That is a problem. The Googles and Facebooks have such control over what we see when we search the Internet. Because you and I could put in exactly the same search terms, but the algorithms that the chair referred to will produce different results because of my search history and your search history and your preferences. They have tremendous powers.
Then, our information that is with them in the States, we are assured it’s in Canada, except these companies have multiple systems. If the video system here goes down, you have an alternate somewhere else. They have the same, typically in the United States and in other countries, where, as I said earlier, the definition of personal information might be different. Once it’s in that jurisdiction, as you know, we have no control over it.
Then there are the international agreements. Whether it is the Beyond the Border or the Five Eyes, our information gets, behind the scenes, traded and shared. I am sure some of you are on the national security committees. You’re better aware of it than I am.
Where are the lobbyists? What information do they get, and what control do they have? Yes, it is a concern. I appreciate that national security of course is important; I am not suggesting otherwise. But we, too, have to be granted some protection, including from the lobbyists and the large companies.
[Translation]
Senator Boisvenu: I certainly don’t doubt your good knowledge of this field, and we appreciate your being here this morning.
In your opinion, how can the Government of Canada protect itself from that influence, so that priority would first be given to the protection of confidential data and not to the management of that data by the companies?
How can the government protect itself from that external influence?
[English]
Ms. Polsky: If we are talking about governments protecting themselves, as we have seen with some jurisdictions, including federally, there are already laws on the books saying that you are not allowed to take public information out of the country. Yet when public sector employees travel, they take it with them on their devices.
I go back and say there needs to be much better learning. Not just training on how to use devices, but learning and understanding with correct information, valid content, so that people understand how to use a VPN system, how to use the technology that is already available so that they are not carrying information out of the country, so that it truly can remain in Canada, so that the government has computer systems that are updated and well built, well designed with privacy embedded in them, so that it protects the government’s information, our information and our economy and our potential.
[Translation]
Senator Cormier: I thank you for your presentation and apologize for arriving late to this meeting.
You talked a great deal about education, and that is what I am most interested in. As I listen to you, I am thinking about protecting confidential information. Our society is currently in an era where the line between the public and the private is increasingly blurred. We now see that all sorts of information on our private lives is being shared much more easily than in the past. That is part of the way we use social media. I will talk about young people, but not only them, as I think a cultural shift has occurred in our society in that respect.
You talk about education, and I think it is extremely important in this context, but I would like to hear you say more about what it would mean in concrete terms, if there were regulations or legislation.
How could parameters be established in education to help protect information shared by Canadians?
[English]
Ms. Polsky: Senator, I liken it to the situation with vehicles 100 years ago, when they started to appear on our roads. There was no formal driver education for about 50 years, until long after the millionth person was injured or killed by a car. Then there was insurance. There was a financial incentive.
We’re getting close. Computers on desktops started to be popular in the early 1980s, so we are almost at about the same timeline, and like with early cars, nobody has been taught.
I would suggest that it be made mandatory as part of the curriculum. Not optional curriculum where a school can choose to have the students learn it or not, but a mandatory part of the curriculum starting at the earliest grades and building as the children get older. Starting education in high school or middle school or university or teaching them to code, that’s really way too late. They are already spewing their personal lives all over the Internet.
Their parents are putting commentary about, “When I was pregnant, I took this drug.” Well, 20 or 30 years later, when the child wants to go to university or pass a clearance test or get life insurance, their mother’s comments online way back when might come to haunt them. The parents need to be educated.
This needs to be part of the mandatory curriculum for teachers as they train to teach our children, the next generation of developers, legislators, police and technologists. It needs to be at the outset.
[Translation]
Senator Cormier: I am far from being an expert on the issue, but wouldn’t one of the solutions be to restrict the type of information the owner or renter of a car can enter into the system? Is there no way to restrict that information and to create regulations to attain those goals?
[English]
Ms. Polsky: Perhaps, but then I go back to say it’s on the shoulders of the developers of the vehicle. Limits have to be imposed on them as to what they will require.
It’s like any app you download. It’s very convenient. You don’t know what else it’s downloading from your phone, whether it is going to turn the camera on by itself, as many do, and we don’t know it.
Having limits would be great, but that again puts it on the auto manufacturers and designers and the system designers instead of allowing us — all of us — some level of true control over our own information.
Senator Bovey: I’ll be very quick with this one.
Canada’s Privacy Commissioner attended the International Conference of Data Protection and Privacy Commissioners last month. Of course, automated and connected vehicles were part of the discussion, and a resolution was passed to put the onus on governments and industry with regard to respecting users’ rights.
That resolution urged all parties present to follow 16 suggested guidelines when it comes to protecting the privacy rights of AV and CV users.
Do you think this committee should be recommending these types of guidelines, that they be issued as regulations by the government in order to protect privacy rights?
Have you had an opportunity to read those regulations, and would you recommend them as our starting points to recommend to government?
Ms. Polsky: I have not looked at the one that you are referring to, but I have seen recommendations from Canada’s Privacy Commissioner and from other international commissioners’ forums.
The short answer is yes, because suggested guidelines by privacy commissioners are wonderful, but they are suggested guidelines. There needs to be something much more concrete with much more force behind it.
Senator Bovey: Mr. Chair, I think we should look at the 16 guidelines coming out of that meeting last month as a starting point.
The Chair: We have a lot of starting points.
Senator Galvez: From your experience, do you think there is one country out there — maybe in Europe somewhere — that is ahead of us and could serve as a model from which we can take some ideas?
Ms. Polsky: I think Canada has to ramp up for the GDPR that’s coming in in Europe, the General Data Protection Regulation that will be in force in Europe in May 2018.
Not only does that set the bar very high for privacy, for consent, for access and for individual control of personal information, but its existence draws into question Canada’s adequacy for exchanging information with the EU. There is potentially a huge economic impact.
So I would look first to the GDPR and increase the protections for Canada and Canadians based on that so that there is consistency.
The Chair: Thank you. I think we’re up to 18 or 19 new challenges that this committee is facing just this morning.
Senator Mercer: Just when we thought we were doing well.
The Chair: As you can see, our next witnesses are here.
Ms. Polsky, thank you for your presentation. You are leaving us with a lot of food for thought and a lot of challenges, but as I said before, at the rate things are going we will probably have you back for a second round on this debate when we get to analyze a second report further down the road.
We will introduce our next witnesses, Thomas Small, Director, New Product Development at New Flyer Industries Canada, and by video conference, John-Paul Pelletier, Vice President, Engineering at Motor Coach Industries.
Thomas Small, Director, New Product Development, New Flyer Industries Canada: Good morning, and happy Halloween.
John-Paul Pelletier, Vice President, Engineering, Motor Coach Industries: Good morning.
The Chair: I will ask you to give your presentations and then the senators will ask questions.
Mr. Small: I’m Thomas Small, Director of New Product Development at New Flyer Industries.
Mr. Pelletier: And I’m John-Paul Pelletier, Vice President of Engineering at Motor Coach Industries.
Mr. Small: To give you a little bit of background about MCI and New Flyer, they are both part of the New Flyer group of companies, which is the largest transit bus and motor coach manufacturer and associated parts distributor in North America, and headquartered in Winnipeg, Manitoba. We produce heavy-duty buses and coaches customized to specifications. Combined, New Flyer and MCI have more than 70,000 vehicles operating in North America, and both are seen as technology leaders in our industry.
Autonomous vehicles, or AVs, are on the New Flyer and MCI technology road map, but our philosophy is to follow automotive and truck. We use many of the same suppliers as automotive, but our production volumes are obviously significantly lower in bus and coach versus automotive.
Connected vehicles are also on the New Flyer and MCI technology road map. Telematics is available today, called New Flyer Connect. This enables real-time vehicle health monitoring of individual vehicles and fleets, and currently we are testing remote downloading of software to control modules.
Automated driving levels have already been established by the Society of Automotive Engineers under SAE standard J3016, and they are defined in Levels 0 through 5. NHTSA has adopted the SAE definitions and levels, and in a review of the Library of Parliament, they are established there as well.
To give you a perspective of the levels and what they mean, Level 0 is where a human driver handles all the driving functions, and Level 5 means no human intervention is required and no vehicle controls are necessary.
Mr. Pelletier: In terms of the deployment of connected and automated vehicles, on the regulatory front there are some U.S. jurisdictions that have some level of autonomous vehicle legislation. With that there are some risks to manage, as well as insurance and liability challenges with AVs, such as determining who is at fault in a collision. Right now, for us it is unclear whether the mechanisms and government policies for licensing these vehicles are at a federal, state or provincial, or municipal level.
In terms of the technical deployment of connected and automated vehicles, we currently have passive systems in place, which provide warnings. We have 360-degree bird’s-eye cameras as well as backup cameras, and we are in the process of launching lane departure warning for motor coaches in mid-2018. We also have active systems available on our vehicles, such as collision mitigation systems that will apply the brakes ahead of a collision, adaptive cruise control and electronic stability control.
One major system challenge for heavy-duty vehicles is the steering. To get to Level 2 autonomous, we need braking controls as well as steering, but those systems are not yet commercially available on heavy vehicles such as trucks and buses.
Automation is potentially unreliable in inclement weather with snow, rain or fog, especially when you incorporate cameras. No guidelines have been developed for the performance of these systems, so we don’t know what bar we should test and validate these to.
The real-time connections to global mapping are currently undefined. In addition, we have vehicle-to-vehicle, vehicle-to-infrastructure and vehicle-to-environment communication in its very early stages.
A further challenge is the transition period during which you will have human drivers interacting with fully automated vehicle systems.
There is also a cybersecurity measure that will need to be solved, as these are open systems, and they will need to be protected.
From a social standpoint, there is the public acceptance of a bus or coach without a driver. There are also several thousand bus, coach and commercial vehicle drivers or operators that are currently employed. It will challenge fare enforcement, passenger assistance and security on these vehicles if there is no operator, and there is the public acceptance of anything less than perfection from an automated vehicle.
Some long-term challenges we see are significant impacts on privacy, energy, land use and transportation demand, as well as employment. This is beyond the scope of what Thomas and I can define with any type of expertise.
However, we would expect that energy consumption would or could be reduced with optimized control in idling. There is also a maintenance and wear component that would be significantly reduced. We would see land use being reduced as automated cars eliminate the need for parking lots. Buses and coaches would also eliminate this to a lesser extent than a vehicle. The public transportation impact is difficult to predict for buses, with automated vehicles and potential ride sharing and on-demand cars available. As jobs do disappear, they would evolve to new opportunities with automated buses, coaches and commercial vehicles.
We’d also like to point out that there is a very high development and validation cost with these types of programs, as you develop and test autonomous and connected vehicles.
To summarize, New Flyer and MCI will follow the automotive industry. While we lead our respective industries in bus and coach, we are typically late adopters of automotive technologies. We will leverage the automotive supply chain to gain their experience and expertise. We will only offer reliable systems as our cargo is precious. Buses and coaches will carry anywhere from 40 to 120 passengers. We will follow all regulations as well as customer specifications needed for driver assistance systems, and, as we mentioned, New Flyer and MCI are developing a road map to full autonomy, Level 5 autonomous buses and coaches. The development costs are very high to integrate and validate these very complex systems. Thank you.
The Chair: Thank you, Mr. Pelletier and Mr. Small.
Senator Bovey: Thank you both for being with us this morning. I am well aware of the work that New Flyer has been doing, obviously, as a senator from Manitoba. I’m very proud of the work you’re doing.
Some of us have had the opportunity to visit some of the manufacturers of automated vehicles in California, and a couple of us had the opportunity to meet with graduate students in Stanford a few weeks ago and look at their take on all of this. I was really surprised at how many of those graduate students were from Canada. Given the work that you’re doing, I wonder if you’re looking at pulling any of them home to help with the development of this technology north of the border.
I ask that knowing that you have plants on both sides of the border, that you have many sales on both sides of the border and that you’ve been looking at all sorts of new technologies which range from some of the battery-operated electric vehicles. Could you talk a little bit more about that? Am I correct that you have opened a new testing site in Manitoba?
Mr. Small: Battery electric vehicles are definitely one of our key focuses. We just launched those this year. We’re going to build on the order of 75 in 2018, with orders spilling into 2019. We’re expecting to increase those numbers.
Even though most of the development is done here in Winnipeg and we coordinate everything from here, we actually opened a vehicle innovation centre in our Anniston plant in Alabama. For New Flyer, the transit bus manufacturer, near 50 per cent is our market share of the replacement cycle of 6,000 buses per year.
We actually have a full range of propulsions and lengths for heavy-duty transit, and we’re in almost all of the cities across Canada and the U.S. Our largest market share is the U.S., which drives us to build in the U.S. to Buy America requirements.
Our vehicle innovation centre is established to educate and do some development of vehicles in the U.S. We will bring in anybody from technicians to learn about how to troubleshoot and repair autonomous or electric vehicles, to politicians to give them a feel for what this industry is and how to accomplish that.
As part of new product development, we have increased our capacity on the electric front. Basically, 50 per cent of our engineering staff is electrical and controls engineering versus the mechanical. So you can see how we’ve shifted from a pure mechanical, with some electrical in controls, to basically where we’re 50-50 now today.
In terms of talent, absolutely, we look at all sorts of talent in order to accomplish our goals.
Mr. Pelletier: Collectively between New Flyer and MCI, we’re in the process of developing our plan. That plan will definitely include bringing in expertise. If we can bring back people who want to come back to Winnipeg who have been doing research in the U.S. or elsewhere, we will certainly look at doing that.
Senator Bovey: I want to thank you. I think this endeavour in the middle of our country is an important one as we take a look at what’s going on south and east and west of the Prairies. Thank you very much.
[Translation]
Senator Cormier: Thank you for your presentation and for joining us this morning.
The U.S. government recently published guidelines encouraging the automotive industry to make vehicle cybersecurity an organizational priority by, among other strategies, developing incident reporting mechanisms and self-auditing processes.
I am from New Brunswick, a province where cybersecurity is becoming an increasingly important specialization. What measures has your organization undertaken to make cybersecurity an organizational priority? Are you having conversations with other provinces, including New Brunswick, where cybersecurity is extremely prevalent?
[English]
Mr. Pelletier: From a business perspective, cybersecurity is definitely very high on our radar in terms of protecting our business. With connected vehicles, it’s definitely a very high priority. As we figure out how to implement this technology, it’s certainly an area of expertise that, with the traditional electrical and mechanical engineers that are normally designing and developing our products, we’re going to have to go elsewhere to get that type of expertise.
At this point, I’m not aware that we’ve really engaged other provinces on how we’re handling this. What I would say today is that our vehicles are closed systems, so while we do offer some communications leaving the vehicle, there isn’t a way for somebody from outside to get into the vehicle system to take over any of the controls. So they are closed, but as we open these systems, if we are doing either remote downloading or we are going to have some form of external systems able to control our coaches, that’s a problem that we will need to solve. I would say it’s in the very early stages for us.
Mr. Small: Absolutely. We have our telematics system, New Flyer Connect, which right now is information sharing. We pull information from the vehicle. Right now, we’re not pushing information to the vehicle on a widespread basis. We are in the middle of testing program updates, like you would have for applications on your cellphone, for example. At this point, we are testing that, with cybersecurity on the forefront and understanding those risks.
[Translation]
Senator Cormier: You talked about an increased need for specific expertise on cybersecurity. Have you had conversations with educational institutions in Canada, for example, that could help develop that kind of expertise?
[English]
Mr. Pelletier: I have not personally spoken to any educational institutions.
I know that, in terms of our IT systems and computers and cybersecurity, we do rely a little bit on our colleagues in that part of our business. I think there is some ongoing discussion, but I don’t know that there has been anything formalized. I think your suggestion or that thought is an excellent idea.
Both Thomas and I work, at least locally, through some industry and academic committees that we both sit on, where we do get to provide some input into academics, whether it’s the University of Manitoba or Red River College, which is very close to where we are right now. We do provide input about what needs our company has, and there are also other industry representatives that would provide similar needs to those institutions for what they require. So it’s a very good suggestion to engage the academic institutions on that.
It’s going to be a requirement that we will have to deal with as we move along.
Senator Mercer: I want to go back to comments in your presentation about steering systems. We’ve all encountered, those of us who are in cities all the time, buses that, at an intersection, are about to make a turn, and there is a vehicle in the other street that they are turning into that may be too far ahead in the intersection. It causes a problem. This problem is magnified when the bus doesn’t have a driver. The bus is there. The car is there. Normally, hand signals go back and forth, and the car backs up or pulls over to the side. But you don’t have that when you have a driverless bus. You have the bus coming around, and, because of the cameras, it will stop, obviously, or at least we hope it will.
How is the technology being developed to handle that situation? From my years of living in cities — and I’ve lived in cities almost all of my life, some big ones and some smaller ones — this is a common problem. It happens at intersections every day.
Mr. Small: That absolutely needs to be identified and dealt with. When we mention steering systems, we’re talking about the mechanical and electrical components for driving the steering. You referred to the control of an interaction between an automated vehicles versus human drivers. That is one of the key challenges that we need to understand because the automated vehicles will probably be programed to follow the rules of the road and not be aggressive at all, whereas human drivers can be aggressive and can bully automated vehicles.
How to approach that needs to be addressed. Currently there is no definition of how that can be accomplished. We expect things to expand.
Senator Mercer: It seems to me the problem would be magnified even more if the automated bus were turning a corner and encountered an automated car. You will have humans in the car, but they would then have to take the option of taking control of the car, which we know will be an option.
I’m getting on the bus to go to work in the morning, and it’s an automated bus. How do you ensure that I put my coins in the box? For transit companies all over the country, they want to know this answer.
Mr. Small: That’s one of the points we raised in our opening remarks. We could debate this ongoing. First of all, will the public accept a fully automated bus, for example? For light rail, you normally have a platform that you had to gain access to by doing some sort of action where you paid in advance. For a transit bus, that’s not the case, so how do you enforce the fare collection? Do you actually need to have an attendant on the bus who takes care of ensuring fares are paid and if there is some sort of assistance required for someone with a disability, maybe to secure a wheelchair or even just general security? Even though drivers, today, are not security guards, their presence is an authority on the bus. Would we still need to have an attendant on the bus, where they’re not actually doing a driving function but are still keeping the peace and assisting others and making sure fares are paid? That’s an open question.
[Translation]
Senator Boisvenu: If I may, I will ask two questions in French. You mentioned in your presentation that many vehicles are already equipped with the technologies. Some of the examples I am thinking of are lane change warnings, emergency brakes, intelligent cruise control and 360-degree cameras. What I gather from your presentation is that those technologies are currently very rare in heavy vehicles. Is that the case?
[English]
Mr. Pelletier: Those technologies are currently available on our MCI coach products. They are also available on other commercial vehicles.
[Translation]
Senator Boisvenu: Am I to understand that autonomous cars will be deployed well before heavy trucks equipped with that same technology — for example, up to automation Level 5? Does this mean that automobiles are being developed much more quickly than heavy trucks or buses?
[English]
Mr. Pelletier: I wouldn’t necessarily draw that conclusion. I think that commercial vehicles, trucks, are pursuing this as quickly as the automotive industry and personal cars.
[Translation]
Senator Boisvenu: We know that, in Quebec and perhaps elsewhere in North America, coexistence between truckers and car drivers is often strained, with one side criticizing the other for lacking visibility and respect. Will that coexistence between autonomous cars and autonomous heavy trucks have an impact on the relationship between truckers and car drivers?
[English]
Mr. Pelletier: I would reiterate what Thomas said. As the autonomous driving evolves and you adopt vehicle-to-vehicle communication, where the vehicles are actually sending information about where they are and what they’re doing, that would take out the human, emotional piece, where a truck driver may make a decision that, “I’m larger than a car, so I’m going to push my way into this space. The car is going to have to move out of my way.”
I would think that, as we move to autonomous vehicles, once the human piece is eliminated, that would improve. Until the human piece is removed, you’ll continue to see that conflict, in my opinion.
[Translation]
Senator Boisvenu: During a recent trip to Europe, I noticed convoys of heavy trucks, with both a tractor at the front and a container in the rear. Two or three trucks follow one another in single file, but only the first vehicle has a driver, with the other trucks being integrated into the fleet without a driver. Is that kind of technology being used in North America?
[English]
Mr. Pelletier: I think it exists, and I think it can be done.
Mr. Small: We believe the technology will outpace regulation. We believe that we will have the technology that can fully drive a vehicle, that can interact in the environment. There will be a case where there’s a transition between human drivers and fully automated vehicles, and what that transition period looks like is speculation at this point, but we believe that regulation will lag the capability of the technology.
Mr. Pelletier: I would just add that I think it’s possible to do what you have said today. You can platoon trucks with two vehicles following a pilot vehicle that is driven by a human driver. I think that’s been done and can be done.
The question now becomes, is that permitted? What mechanisms do you need to follow to get that permitted? For example, if you’re going to drive a platoon of commercial trucks from Nova Scotia to British Columbia on the Trans-Canada Highway, would that be allowed? I think the answer today is no.
Mr. Small: You’re going across municipalities, provinces, and each has their own legislation for driver vehicle licensing, for example.
Mr. Pelletier: I would say technically that it’s possible. Are you allowed to do that? The regulations aren’t in place for that, as far as we know.
Senator Griffin: Thanks for your presentation. I have a couple of, I hope, fairly quick questions.
The first one is related to how automated vehicles could be very useful to special needs groups. In development, have you had very much consultation with seniors, with groups representing people with disabilities? Also, have you had consultations with the provinces and territories as to what they perceive as the needs in the future?
Mr. Pelletier: I’ll start, and then I’ll leave the second piece to Thomas.
In terms of consultation with people with mobility challenges, MCI just launched a fully accessible commuter coach, which is specifically targeted to improve accessibility for people that have mobility challenges. We launched this product at the American Public Transportation Association event that was just a few weeks ago.
We did several consultations with disabled communities in both Canada and the United States to gain their endorsements of this product. Again, if you think of a motor coach versus a transit bus, the transit bus has moved to a low-floor design, and I think New Flyer was the first to adopt that, probably 20 years ago. The motor coach is still a high-floor design, and currently when you have somebody with a mobility device, you’re actually lifting them into the vehicle with a lift, where you’re taking them from the ground level and then lifting them up about four feet on a lift that resides in a compartment on the vehicle itself.
The new product that MCI developed was specifically to address this, and it was to provide a space on the coach for people with these mobility devices so that they would have quick access similar to a low-floor transit bus. We do engage regularly with those communities in defining what our products should be today and what they need to be in the future.
Your next question I’ll leave to Tom.
Mr. Small: Can you repeat the second part of your question?
Senator Griffin: The consultation with the provinces and territories.
Mr. Small: The New Flyer transit bus, as JP mentioned, we’ve been a low-floor design since 1990. So wheelchair, scooter access, you can just drive up a ramp. There’s no lift or stairs on a transit bus anymore. The circulation for those who need wheelchair access is quite straightforward.
We do have consultation with ADA in the U.S. and similar Canadian associations. ADA is quite prevalent in all of our designs. Basically the Canadian side mirrors what the ADA proposes, and we comply with all ADA requirements.
How this differs with an automated vehicle, as I mentioned earlier, those who use the service are comfortable with securing themselves, but at times there are some that need assistance. It depends on the local requirements; what local communities require through our customers defines what type of securement methods there are for wheelchairs and scooters, et cetera. There are those that do need some assistance.
Going back to whether an automated vehicle needs an operator or an attendant, this is what needs to be defined. That is normally defined by the local transit authority in their specifications for defining buses. We build to specification. If there’s a requirement for a particular type of wheelchair securement in that local community, that is what we provide.
Senator Griffin: Thank you.
Senator Bovey: Just as I said, thank you both for appearing. I have one more question.
You made it very clear that technology is outstripping the development of regulations. We have been charged by the Minister of Transport to come up with some recommendations for the Department of Transport to develop what regulations they should be developing.
Can you give us any thoughts as to what regulations you think we should be recommending to the federal government?
Mr. Small: First off, from an automated vehicle, what method and what parameters are required for qualifying an automated vehicle. We have driver licensing today for human drivers. What is that in the future? How is a vehicle regulated to drive on the road? Currently they are at a provincial level, and in the U.S. at a state level. That’s one of the key things.
What are the testing requirements of an automated vehicle? They are kind of one and the same. And what is the global — or maybe it’s a North American, maybe it’s a Canadian or a U.S., but how do you define all of that? Right now we don’t have a definition that we need to meet. We don’t have a requirement. We are making those up as we go, but we are leveraging the automotive side.
Senator Bovey: Thank you very much. That’s very helpful.
[Translation]
Senator Boisvenu: You made a comment earlier that left me quite puzzled. You were talking about a convoy leaving Halifax en route to British Columbia and the complexity of interprovincial regulations. We know that many of those regulations come under the provinces and some of them come under the municipalities. The Trans-Canada Highway often passes through municipalities, as it is not a highway that links the two coasts without any obstacles.
I am trying to understand how all those regulations can be harmonized before the technology is deployed. I have a feeling that the technology will arrive, and that the obstacle to his development or use will in fact be the barriers in terms of interprovincial regulations. That is how I see things. Is that right?
[English]
Mr. Pelletier: I would say yes, you’re correct.
The Chair: Thank you, Mr. Small and Mr. Pelletier.
Honourable colleagues, as you know we will not be meeting tomorrow night. As you also know, the sessional order is finishing tomorrow, so this will be the last time I chair this committee after seven or eight years. I have had three prime ministers, six or seven leaders of the Liberal Party and six or seven deputy chairs over the last eight years. I want to thank Michael MacDonald for having stood up and supported me while I was away sick last year. I don’t know who will replace me, but I know it will not be me.
I have had seven clerks. The first three left pregnant, but I had nothing to do with that. It started becoming a habit, so they started sending me male clerks.
I really want to thank the support staff and the interpreters.
[Translation]
I know that I switch from English to French without warning anyone and that it is always a little frustrating for the interpreters. I do that and will probably continue to do it, as I am not leaving the Senate. I am not going home. I just won’t be back as chair.
[English]
We have the report to finish, so I hope that I will still be on the committee so that I can participate in that. We have Bills C-23 and C-49 coming to the committee, and I hope to be active in those activities.
To the witnesses, I am sorry; that being said, thank you very much.
(The committee adjourned.)