Information & Ethics Committee on Feb. 28th, 2022

[Dr. Michael Geist]

Yes, on the issue of the tribunal, there was some opposition to that. A tribunal was proposed in Bill C-11. I actually had less of a problem with it. I thought that as long as it was an expert tribunal—which unfortunately Bill C-11 did not have; it had a mandate that one of the tribunal members have privacy experience, and I would think that if it's going to be authoritative, it needs to be a true expert tribunal in this area—there might well be value.

I recognize that the Privacy Commissioner has voiced some opposition to that, but I think that at a minimum we need to get a piece of legislation on the table. We can talk about what that administration looks like through committee study, but we're not even getting out of the gate on this issue.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you very much.

[The Chair, Conservative, Pat Kelly]

Thank you for that.

We will now go to Mr. Green for six minutes.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

I definitely appreciate the idea of.... Going back to the forest, I would agree that this set of circumstances has opened us up for a much broader conversation.

My questions will be directed to Dr. Geist and are about some of the comments he made about the Privacy Act being outdated, being inadequate, and the need for the highest standards. I've been calling it the gold standard. In fact, the focus of my questioning has been along these lines for the entirety of the study, because I am looking to get out of this study recommendations that could strengthen our legislation so that we're not continuing to chase the ambulance, for lack of a better term, on individual instances of privacy breach but are creating a standard that meets or I would even suggest surpasses the GDPR. I say that because of the way in which information is being used politically—disinformation and all these other types of things—so it really does come down to being able to profile the end consumer of it.

So my question, through the chair, to Mr. Geist is this. Taking your time to walk through your top priorities to tweak the rules for Canada in a new and improved, modernized Personal Information Protection and Electronic Documents Act reform, what would that look like for you and how would that be the highest standard that Canada could put forward in this moment?

[Dr. Michael Geist]

I'll take a slight detour just to note that the Privacy Act, the part in terms of the obligations that the federal government has with respect to privacy, should not be overlooked at all. If anything, there's a core element there when we talk about the increasing desire for government, and some would say the need for government, to have more data in order to make better data-driven decisions, which may necessarily implicate data collection issues. In the case of the Privacy Act, that is even older in terms of when it was drafted and the failure to update it.

[Matthew Green, NDP, Hamilton Centre, ON]

Dr. Geist, this is a great opportunity. Maybe start there. What would be your top priorities for the Privacy Act?

Then could you use the remainder of your time to get into PIPEDA? I do believe you're quite right, that it is a process of holding both sides, government and private sector, accountable, because what we heard suggested...about what is legal versus what is ethical. Doing indirectly what you can't do directly remains a problem if we don't have a modernized reform on both sides.

Feel free to expand on that in whichever direction you'd like to take.

[Dr. Michael Geist]

Thank you for that opportunity.

I'll note that I've had the pleasure of appearing before this committee through multiple Parliaments. This committee has issued multiple studies on this question and made recommendations. There isn't a lot to rewrite here. It's one of these issues that just never seem to rise to the level of actual legislation.

Among the things we could do, I mentioned off the top the ability of the Privacy Commissioner to play a more proactive role in terms of public education and research about the relationship Canadians have with their governments in terms of the data that gets collected. We could also strengthen protections—for example, limitations on the data that government collects, so information is only collected where it is strictly necessary for its programs or activities. That hearkens back to one of the earlier questions of keeping the door open to other kinds of uses. There's a need to ensure that in fact it's the opposite: not only that we carefully circumscribe what gets collected, but that we identify that right from the very beginning.

In terms of breach disclosure-related issues, there is a need to ensure that if the data that is collected is put at risk—and we have had incidents in the past—the individual users themselves are adequately informed. Privacy impact assessments are necessary to ensure...and embed those within the law where some of these new programs are launched.

Then, when we think about this kind of issue in particular, which really opens the door to these large datasets, we need to think about the interaction that the federal government may have with private sector participants, because this represents a relatively new situation. It used to be the government might collect the data itself. Now we have, effectively, platforms or intermediaries that may be collecting some of that data and making it accessible to government. We need to establish effective precautions and safeguards in that regard. Was appropriate consent obtained? Is it de-identified? Have you worked with the Privacy Commissioner to ensure that's the case? Even if it was de-identified, what level of consent was obtained, as in this kind of case? Those are some of the things we could be, and I think should be, thinking about with respect to the Privacy Act.

In terms of PIPEDA reform, the way I would do it, to be totally candid, is to sit there with the GDPR text on the one hand, look at PIPEDA on the other, and then add in the bill that comes forward and engage in a benchmarking exercise to see where we stand. That's not to suggest that there can't be Canadian-specific reforms; I think there unquestionably can be. However, it is universally acknowledged that....

An easy one, of course, is the enforcement side of things. We don't have strong penalties. Our federal commissioner doesn't even have order-making power. That puts the federal commissioner in a position unlike almost any other privacy or data commissioner anywhere in the world in terms of not having the necessary tools to ensure effective compliance.

Then—

[Matthew Green, NDP, Hamilton Centre, ON]

I do apologize, because I have about 15 seconds left. As I tend to do, I invite both you and Mr. Charbonneau, who I know has lots of experience in this.... If there's a written submission on that particular question about those two features, the Privacy Act and PIPEDA, that you would like to make, I would love to see that referenced and be included in our recommendations and our study.

Thank you both.

[The Chair, Conservative, Pat Kelly]

Thank you, Mr. Green.

Now we'll go on to Mr. Williams for five minutes.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair.

Thank you to our witnesses today. This has been great to listen to, and to see what the gold standard is, especially with GDPR and seeing what's happening across the globe.

One of the things I want to focus on today, to start, relates to GDPR. When we look at permanent versus temporary measures, has anything been written in that legislation or that protection in the EU to look at the difference between where we've had the measures through COVID and having to act on that side, which is a temporary basis, versus what would be permanent? Have you seen anything in there that would relate to that kind of thinking?

I'll start with Dr. Geist.

[Dr. Michael Geist]

Privacy laws are designed to be context-specific. They ought to be, and should be, adaptable to those kinds of situations.

In a situation where there are heightened concerns—let's say in a global pandemic or a war—some of the choices that get made and the balance that gets struck may well be different from those in other situations, which may be more mundane and don't raise those issues. The same, of course, is true depending on the sensitivity of the information. If we're dealing with sensitive health or financial information, the kinds of safeguards we'd expect may be different from questions about where I might have gone for lunch yesterday.

I think that the law itself is able to account for these different kinds of circumstances. The problem is that, if you don't have effective enforcement of those rules and you haven't modernized some of the consent-related provisions and the like, you're working with a very weak hand in terms of ensuring you have effective protections.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Doctor.

Until we have more safeguards and, as you said, legislation in place that changes these rules, should Canadians have the option to opt out of data collection during, let's say, a pandemic or an emergency? I'm talking about something that's temporary instead of permanent. Or, in your thinking, would it make sense that we can't, that there are going to be safeguards in an emergency to keep that? When we look at a permanent versus a temporary situation in these laws, how are those rights of Canadians protected, in your opinion?

[Dr. Michael Geist]

I think it depends a little bit on the kind of data. It's an interesting question to pose: Can you opt out? Well, you can opt out, certainly, or you ought to have the right, I would say, to opt out of a program like this.

It doesn't seem to me that.... This is useful information, to be sure, and I think you can make a compelling case that it's valuable to have that sort of information, this kind of data. You see it play out in a number of different places. There's a lot of talk about waste water, for example, and trying to measure COVID-19 levels that way, as well.

We are anxious to get more data. The ability to opt out in those circumstances would seem to be appropriate. There might be circumstances, though, where the dependence of public health does require certain kinds of disclosures. We get that, of course, when we go into certain places and are required to disclose our vaccination status. That strikes me as entirely reasonable.

It seems to me that there are differences, depending on the circumstances in which this might be used and the data that's involved.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you.

I do agree with you. I think when there's certain data, when we have to have personal data, there seems to be a different way.... We have to have safeguards with that. You mentioned waste water. It's not really easy to identify where that's from. There is facial recognition and certain other technologies, but what I'm focusing on is data that we're getting from individuals. I think that's where we are at.

Mr. Charbonneau, the committee has heard before from privacy commissioners that we should have done more to inform Canadians before the mass surveillance was undertaken. Would you advise the government to do that before it begins the next surveillance program, which is at tender stage right now?

[Jean-Pierre Charbonneau]

Let me emphasize once again that we have the Office of the Privacy Commissioner. Basically, the goal of that institution is to help political leaders and the public to see things clearly and, potentially, to find compromises or to assess risks for the public. It's impossible for everyone in Canada's population to provide an opinion. We have to have one entity representing the public and responsible for monitoring and protecting privacy—

[The Chair, Conservative, Pat Kelly]

Thank you. We're out—

[Jean-Pierre Charbonneau]

…and determining how the government is behaving.

[The Chair, Conservative, Pat Kelly]

I am sorry, Mr. Charbonneau.

I have to go to the next questioner. Mr. Williams didn't allow very much time for a response.

We will go now to Ms. Saks, for five minutes.

[Ya'ara Saks, Liberal, York Centre, ON]

Thank you, Mr. Chair.

Thank you to our witnesses. Through you, Mr. Chair, I'd like to start with Dr. Geist.

I've read a fair bit of your work. Like my colleague, Mr. Fergus, I appreciate your insights. They are thought-provoking.

I want to talk about transparency, because that's something that's come up for you many times in terms of your own writings with regard to the government on a multitude of issues to do with the Internet.

On March 23, 2020, the Prime Minister's website announced publicly, and he did a press conference about it, engaging PHAC with BlueDot in order to collect that information and use it for the purpose of the pandemic. Then, only on March 26 did PHAC actually enter the contract with BlueDot. Then regularly after that, Dr. Tam, through COVIDTrends, Twitter and other platforms aside from the hard-to-read government website pages that we all get kind of bleary-eyed from at times, regularly updated what was happening through COVIDTrends and made announcements on an almost weekly basis. Then, in addition to that, there were the subsequent announcements about interacting with third party privacy assessors on the process. Then finally there was another public engagement on the correspondence with the OPC, the Office of the Privacy Commissioner, on a contract. Let's be clear: The contract was from 2020 until March 18, 2022, so throughout that time, we've heard about regular biweekly engagements with the Privacy Commissioner. A briefing was submitted, I believe, on February 14, 2022, wherein PHAC gave a final briefing and concluded that, according to section 3 of the Privacy Act, the data did not contain personal information.

So there was regular engagement on this. You've talked about what we could have done better with respect to the transparency. We're clear about the de-identified, anonymized part of it. In terms of that public conversation that you've alluded to, could you say how we could have done it better in terms of the spaces we're working in?

[Dr. Michael Geist]

Sure. I can try.

I would start by noting that my read of the commissioner's response was that he felt that his office should have been more actively engaged in this process, so I recognize it—

[Ya'ara Saks, Liberal, York Centre, ON]

But I'm talking about the public transparency here, because that's what you alluded to.

[Dr. Michael Geist]

Fair enough. In terms of public transparency, I think your point highlights how this issue is often addressed by organizations, whether in the government or in the private sector, which is to say, “Hey, it was all there. All you had to do was go out and find it.” Most people don't know what BlueDot is. Even if they did, they still wouldn't necessarily know where the data was coming from or how it was collected down the line. So the need for full public education on this in terms of how that data would be collected in the first place, and then made more broadly available, is really important.

I was actively involved, for example, in the COVID Alert app discussions and was part of one of the studies that fed into that. There was a recognition that because you needed the public to actively install that, there needed to be a significant education program so that they would both trust it and understand it. You need to do the same kind of thing in this context where that kind of data is being collected—

[Ya'ara Saks, Liberal, York Centre, ON]

So we're bleeding between consent and transparency here. I'm trying to understand where we could improve the government's transparency to the public on what we were doing. You're bleeding into the issue of consent on the actual interaction on the data.

That leads to my next question. We did have Telus for Good here, and Pamela Snively from their office went through a really detailed explanation of how their data platform is used not only by PHAC, in a very controlled setting with supervision, but also by universities like the one you are a part of and many other research institutions across the country, and how Dr. Ann Cavoukian in “Privacy by Design” actually extolled and praised Telus for Good in terms of the de-identified data that was used and the privacy standards they use.

In your opening comments, you stated that the pursuit of the perfect should not prevent the good. Now I can get back to what you were talking about. I really wanted to separate it out. What further steps do you feel the government could have taken to be transparent on the data?

[The Chair, Conservative, Pat Kelly]

You have 15 seconds left.

[Dr. Michael Geist]

I'm just going to respond that in fairness, I don't think my response is shifting over to consent. I think my point with respect to COVID Alert and my point here is that if you want people to trust in these programs, you need to explain in as many forums as possible and as clearly as possible what data is collected and what's being used. That happened with COVID Alert. I'd argue that it did not happen in this context.