PHAC data dive legal but not necessarily ethical, Parliamentarians told

The gathering of mobility cellphone data by the Public Health Agency of Canada (PHAC) followed the current laws but may not have been ethical or engendered trust in the federal government, two witnesses told the House Ethics Committee Monday. The committee has been investigating PHAC’s contracts with Telus Corp. and Blue Dot Corp. to provide scrubbed information about Canadians’ travel during the pandemic. Those testifying were Michael Geist, Canada Research Chair in Internet and E-Commerce Law and a professor at the University of Ottawa and Jean-Pierre Charbonneau, a former speaker of the Quebec National Assembly and a cabinet minister in Parti Québécois governments. Geist stressed no laws were broken by the process. “It does not appear there is a violation of the law, that the data itself was aggregated and de-identified and the public notice may not have been seen by many but that too is not uncommon,” he said in his opening statement. “The activities were arguably legal, the notice met the low legal standard. Telus, I think, is widely viewed as seeking to go beyond even the strict statutory requirements and the statute itself had the potential for public health benefits.” Nevertheless, under questioning from Bloc Québécois MP René Villemure, the law professor stated that the current laws are not sufficient. In his opening remarks Charbonneau said it all came down to questions of transparency and of trust. “Telus collected data and was asked to do so by the Public Health Agency of Canada but it did so without the awareness of Canadians,” he noted. “So firstly, transparency was not a part of this even though it was defended by the minister. We also know that the Privacy Commissioner was informed of the intentions of the government but wasn't a part of the process.” During his appearance before the committee, Privacy Commissioner Daniel Therrien testified that he was informed of PHAC’s plans but was rebuffed when he offered consultations on the process. The government preferred to go with other experts, Therrien said. “We need to realize trust is a founding factor in a democracy,” Charbonneau later added. He said the Office of the Privacy Commissioner is a mechanism in law that should be respected. Canadians cannot be expected to protect their own privacy so the government must ensure that it is protected. Geist agreed that government statements about the public’s ability to learn about PHAC and the data dive fall short of believability. “It is a fiction to suggest there are millions actively monitoring privacy policies or similar web pages for policy amendments.” Conservative MP Damien Kurek asked whether the data collected by Telus and Blue Dot could ever be re-identified. “The question of whether data can ever be re-identified, can Humpty Dumpty be put back together again, is one of the really exceptional challenges in this area,” Geist told the MP. Charbonneau took a shot at Health Minister Jean-Yves Duclos who appeared before the committee earlier this month. “The minister says ‘just trust us’ but for the public to trust a politician their behavior needs to be worthy of trust,” the former provincial cabinet minister said. “When a government does not make use of the entity that it created to protect people’s privacy well, how can we wholeheartedly trust the government and the minister?” Many of the witnesses who have appeared so far have called for the updating of the Privacy Act and the Personal Information Protection and Electronic Data Act (PIPEDA). All have pointed to the General Data Protection Regulation (GDPR) of the European Union as a good example to follow. Monday’s witnesses were no different. “It means updating our laws so they contemplate these kind of activities and provide a legal and regulatory roadmap for how to implement them in a privacy protected manner. The need for reform applies to both the Privacy Act and the PIPEDA,” Geist asserted. “If Canada is looking for a modernized privacy law and wishes to meet international standards the starting point is the European Union’s GDPR.” Both the Privacy Act and PIPEDA are over two decades old, he noted. Given the broad range of territory GDPR covers, most multinational corporations are familiar with the rules and know how to comply with them. He cited testimony from Christopher Parsons as a blueprint for updating Canada’s privacy laws. Geist stated the government tried to address some of the issues when it introduced Bill C-11 in the last Parliament but that legislation never even made it to committee. It died on the Order Paper when the election was called last summer. There is no indication when it will be re-introduced. “It’s one of those issues that never seems to rise to the level of legislation,” he said. Updating both pieces of legislation is necessary since the Privacy Act covers the government and PIPEDA covers the private sector. At one time, it was governments who collected information on citizens. Increasingly, they are farming that work out to intermediaries like Telus and Blue Dot, Geist stated. –Reporting by Paul Park at ppark@thewirereport.ca and editing by Jenna Cocullo at jcocullo@thewirereport.ca.

PHAC data dive legal but not necessarily ethical, Parliamentarians told

News | February 28, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

PHAC data dive legal but not necessarily ethical, Parliamentarians told

News | February 28, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Pornhub parent company broke privacy law by failing to obtain valid consent for content uploads: OPC

AIDA needs to be scrapped, civil society groups tell committee

Dufresne recommends changes to Digital Charter Act

OPC finds privacy protections of EdTech company lacking

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us