Information & Ethics Committee on Feb. 10th, 2022

[Dr. Teresa Scassa]

That question gets at something that is really at the heart of the digital and data society. There is such a huge volume of data being collected that it becomes impossible to rely on individual consent for all uses. Mechanisms have to be in place to supplement consent in some circumstances.

We don't have the time, the energy, nor the ability to manage consent for all of the data that is collected about us, and with everything that we do. Consent remains important, but it's not enough. Other measures need to be in place. There can be many socially beneficial—

[The Chair, Conservative, Pat Kelly]

I'm sorry. Once again I'm going to have to do this. Our panellists will have to stop asking you questions, when they're actually out of time.

I'll move on to Monsieur Villemure.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Thank you, Ms. Cavoukian and Ms. Scassa.

Ms. Cavoukian, we are all well-informed people, but we had no idea what was going on.

Is a presumption of consent the same as meaningful consent? We have been told that people could not give their consent, so it was assumed that they did.

What do you think about this?

[Dr. Ann Cavoukian]

I don't think we can make any assumptions that there was a presumption of consent, not at all. I know consent is difficult. I agree that doing this on a large scale can be extremely difficult. I understand all of that. However, at the very least, provide notice, meaning you publicize. You are the government. You're PHAC. You publicize that you're doing this.

At the very least, you go to the Privacy Commissioner, you alert him, and ask for his input and assistance in making sure the public is aware of what's taking place. You alert him that it's being strongly de-identified and aggregated, and therefore the commissioner feels it's appropriate, something like that. You don't do it quietly, in my view. I think that's big mistake.

[René Villemure, Bloc, Trois-Rivières, QC]

It's clear, then, that the presumption of consent does not equal consent. Similarly, publishing statistics on COVIDTrends is not the same as making the information public.

You spoke about trust earlier. In my opinion, the way they do things at PHAC triggers distrust more than anything else.

Would you say that the agency's way of doing things is unethical?

[Dr. Ann Cavoukian]

I totally agree with you. This grows distrust. There's already such fleeting trust anyway. Trust of government is diminishing on a daily basis, and this just leads to the further erosion of trust. I'm very concerned about that. Certainly, one would say you should be able to trust your government. I don't believe we're in a position to do that right now.

[René Villemure, Bloc, Trois-Rivières, QC]

During his appearance, the minister said there was no need to worry, that all of the data were de‑identified. Conversely, the Privacy Commissioner said that he was very concerned.

In your opinion, why was the commissioner merely informed, not consulted?

[Dr. Ann Cavoukian]

It's a very good question, sir. It baffles my mind. I honestly have no idea. When I served as commissioner in Ontario, I was always consulted. If I hadn't been consulted, especially on something like this, I would have been extremely concerned, because that's my business—to get under the hood and look at what's taking place.

I cannot imagine why the government—PHAC—did not consult properly with the Privacy Commissioner of Canada, Daniel Therrien, who is an excellent commissioner in this role. It makes no sense to me.

[René Villemure, Bloc, Trois-Rivières, QC]

Situations like this one contribute to the erosion of public trust in government. In your opinion, this isn't a good thing.

On a scale of 1 to 10, how would you assess this operation by PHAC?

[Dr. Ann Cavoukian]

I hesitate to put a number on it, sir, only because I would probably give it the lowest number and I don't want to be unfair. I haven't examined everything.

This contributes to the erosion of trust enormously. There is already so much distrust out there. Let's leave it at that.

[René Villemure, Bloc, Trois-Rivières, QC]

Okay. I completely understand your answer. I will assume that, for the moment, it is below 5.

People can't understand what is happening. Even if the government published statistics and press releases, it underestimated the need for people to understand what was going on. The government constantly threw up obstacles to transparency. It made the situation opaque. Like you, I learned about what was happening from the news. The ethicist in me was very worked up. I can't believe the government is continuing to deny the evidence.

Have you seen situations like this before?

[Dr. Ann Cavoukian]

I must admit that this was staggering to me. I had not seen anything on this scale with such a large number of individuals' mobility data being accessed without any notice to the individuals. Forget about consent, but just notice.... It's about public awareness, so that someone would know what was taking place.

When you take this to the Privacy Commissioner.... Had they consulted, the commissioner would also examine the benefit of engaging in this kind of access to the data versus what the results would be. They track people's movements. What is the benefit of that? I don't know. I say that as a question. None of this is open.

[René Villemure, Bloc, Trois-Rivières, QC]

Dr. Tam also agreed that it wasn't very useful.

Do you think that this would have been possible if the European Commission's General Data Protection Regulation had been in force?

[Dr. Ann Cavoukian]

They have such strong privacy laws. The GDPR—the general data protection regulation—came into place in 2018. It is one of the strongest laws that exist. I was delighted that it includes my “privacy by design”, which strengthens it even more, builds privacy and embeds it into the code of your operations. I don't think they could have done this.

[René Villemure, Bloc, Trois-Rivières, QC]

I totally agree with you. I worked on the GDPR with the European Commission.

I am very surprised by what can happen.

Given the current state of affairs, what do we do?

[The Chair, Conservative, Pat Kelly]

I'm sorry, but we're out of time on this one. We'll have to go to Mr. Green.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you, Mr. Chair.

Welcome to all the guests. A really important discussion is being had.

Dr. Scassa, I thought your intervention provided some very direct points, which will hopefully be picked up in our study as recommendations. I want the opportunity to expand on that.

One of the issues I've had is the one that you've raised, which is the relationship between public and private data collection. I suggested in a previous meeting that it might be the case that our government institutions are basically outsourcing privacy breaches. I want to start from that frame through you, Mr. Chair, to Dr. Scassa, who identified this relationship between public and private data, and suggested, perhaps, that too much emphasis was being put on the government's possession of it and not enough on the private collection of it.

Dr. Scassa, in your opinion, could this program have been guilty of potentially outsourcing a privacy breach, for lack of a better term?

[Dr. Teresa Scassa]

That's an interesting question. I'm going to give a different example of the Clearview AI situation. You had a private sector company that created a facial recognition database based on scraped data that was then used by the RCMP. The Privacy Commissioner has already said that you can't have a legitimate use by a government actor of data that was collected illegitimately. That relationship is always interesting and it's an important one.

One of the challenges is that, on the one hand, you want to facilitate the use of data for socially beneficial purposes. The private sector is collecting vast quantities of data. There are legitimate questions in some cases about the quality of the consent, the quality of the collection practices and the kinds of data that are collected. In this case, we're looking at mobility data, which are very sensitive, but there are lots of other very sensitive data as well.

It becomes really important to think about that massive amount of data that's being collected under all sorts of privacy policies, which we don't have the time or even the skills to read and understand completely, that may become a product that is then sold to government, as well as to other actors, for their analytics. Right there, if there are flaws in that collection and it is sold, you carry over those flaws and those issues into the subsequent uses of those data.

That relationship is tremendously important.

[Matthew Green, NDP, Hamilton Centre, ON]

Let me put the question in another way. If the government had acquired the information directly, would that have been a cause for concern, in your opinion?

If there wasn't a third party, but the government was actively tracking citizens in this way through the security establishment or through cellphone towers, like we've seen with police using StingRay, for instance, or other Pegasus-type of—well, I guess that's still third party.

[Dr. Teresa Scassa]

I see your question and it's an interesting one. If the government is engaging in that kind of surveillance and there are certain rules that the government has to follow, specifically with respect to their collection of that data, and here it's being sourced from the private sector, it does fall under a different set of rules now. It's de-identified and so on, and it doesn't have the same weight or impact that surveillance data would, or the same implementations necessarily as surveillance data would have, depending on how it's used in the context. However, it's also data that the government doesn't really have the capacity to collect in that fine-grain and detailed way.

Again, the privacy issues are very important, but the ability of governments to use the best available data to make important public policy decisions is also important. The trick is finding that appropriate balance between the two.

[Matthew Green, NDP, Hamilton Centre, ON]

I agree with the appropriateness and the idea of what is deemed to be legitimate, even for the commercial interest. I referenced Google streets. You've been talking about Fitbit and Google.

I had my insurance policy renewal come up, and they talked about me putting an app on my phone that would track the speed to be able to give me a reduction in my rates, so I'm really concerned about the pervasiveness of the commodification of personal data and the way that it's being used as a bit of a panoptic prison.

Could you comment, Dr. Scassa, on international gold standards? We've referenced the European model, but in your opinion, which country has the highest standard of privacy and consumer protection and the separation between commercial and public interest? If you were to recommend to this committee an intervention that we can do to be the gold standard, what would that intervention be?

[The Chair, Conservative, Pat Kelly]

You have 20 seconds left.

[Dr. Teresa Scassa]

Mr. Chair, the gold standard that is usually the reference point would be the GDPR in Europe and the rules that have been put in place there, with the proviso that there's no way to copy what's in the GDPR and transplant it to the Canadian context. Every country has its own particular context. It's not a question of saying, “Well, that's the one that we need to have”, but the GDPR sets an excellent standard.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

[The Chair, Conservative, Pat Kelly]

All right. With that, we're out of time.

We're going to the next round. The next two questioners will have five minutes each, beginning with Mr. Patzer.