ArriveCAN app usage needs information safeguards: OPC’s Therrien

The ArriveCAN app -- which travellers into Canada must now use to submit COVID-19 related information upon arrival, according to a Monday announcement from the Public Health Agency of Canada -- should be reviewed for its information security safeguards and should have limits placed on the disclosure and possession of the information it collects, according to the federal Privacy Commissioner. Speaking at a Monday meeting of the House of Commons Ethics committee shortly following the ArriveCAN announcement, Privacy Commissioner Daniel Therrien told MPs that while his Office of the Privacy Commissioner (OPC) has had consultations with the government on "these general notions," they have not yet seen the precise details of the application. Therrien said the OPC will be meeting with public health officials later this week to discuss the app. According to the Monday release from the Public Health Agency of Canada, beginning July 5 just before midnight (EDT), fully vaccinated travellers into Canada must submit proof of their vaccination to the ArriveCAN app in order to avoid the mandated quarantine period, either on their own or in a government-authorized hotel. "Fully vaccinated travellers must also be asymptomatic, have a paper or digital copy of their vaccination documentation, and provide COVID-19-related information electronically through ArriveCAN prior to arrival in Canada," the release said. Travellers who are not fully vaccinated will also be required to provide "COVID-19 related information electronically" through the ArriveCAN app. In regards to the disclosure of personal health information through the app, Therrien said "it's one thing to upload it in a government app such as ArriveCan, but we need to look at the security safeguards around that application, and that we have not yet done. And there needs to be rules in terms of disclosure of that information." He added that under the exceptional circumstances of the COVID-19 pandemic, that the requirement of disclosure to the app by the government is legitimate, "but then there needs to be rules around limiting the further disclosures for other purposes, and that too we need to look at in greater detail." "It should be time-limited, because it is an exceptional measure and it should only last when required for the specific purpose of dealing with the pandemic," Therrien said. Later in the committee hearing, held to certify Therrien's reappointment as Privacy Commissioner, the commissioner reiterated his criticism of Bill C-11, the government's proposed update to the private sector privacy law. Asked by Liberal MP Patricia Lattanzio if the bill represented a step forward, Therrien said it was not. "Personally, I don't think so. Especially when the list of violations that can result in fines is extremely limited, contrary to the laws of other countries, and excludes the most central provision in privacy law -- which is obtaining consent meaningfully, and for organizations to be accountable in the way that they handle information," Therrien told MPs. "The extreme narrowness of the scope for offenses and violations and the extremely long period leading to the potential imposition of the fine leads me to say needs to be reconsidered completely." Therrien also continued to reject the proposition that the RCMP lied to his office in the investigation of police use of the Clearview AI facial recognition technology. In that investigation, the RCMP initially told the OPC that it did not use the technology, before acknowledging it did after Clearview's client list was leaked. "We did not conclude, actually, that they misrepresented the situation. They told us at first that they were not using the technology, and ultimately, essentially, they say because they did not have the systems in place to ensure that the use of new technologies was reported higher up in the hierarchy," Therrien told MPs Monday, "when they found out that the technology was used in part by some individual officers to test the technology and in part by a group of people concerned with child disappearances, then they told us that they were indeed using the technology." Therrien said that the OPC would be consulting with the police in the coming months to ensure better systems of accountability in the department. "A federal department or institution should not rely on information that was obtained illegally by a third-party partner -- if that's not clear, and if the RCMP argues that it's not clear, then what needs to be changed is the public sector privacy act." — Reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Hannah Daley at hdaley@thewirereport.ca

ArriveCAN app usage needs information safeguards: OPC’s Therrien

Broadcast | June 21, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

ArriveCAN app usage needs information safeguards: OPC’s Therrien

Broadcast | June 21, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Ethics committee calls for overhaul of Privacy Act to protect public servants’ data

Telesat deal good for Canada, Champagne tells INDU committee

Two years in, balancing change and privacy the main task for Philippe Dufresne

Tories shake-up membership of House of Commons committees

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us