Information & Ethics committee  Privacy laws are designed to be context-specific. They ought to be, and should be, adaptable to those kinds of situations. In a situation where there are heightened concerns—let's say in a global pandemic or a war—some of the choices that get made and the balance that gets struck may well be different from those in other situations, which may be more mundane and don't raise those issues.

Information & Ethics committee  I think it depends a little bit on the kind of data. It's an interesting question to pose: Can you opt out? Well, you can opt out, certainly, or you ought to have the right, I would say, to opt out of a program like this. It doesn't seem to me that.... This is useful information, to be sure, and I think you can make a compelling case that it's valuable to have that sort of information, this kind of data.

Information & Ethics committee  I'll take a slight detour just to note that the Privacy Act, the part in terms of the obligations that the federal government has with respect to privacy, should not be overlooked at all. If anything, there's a core element there when we talk about the increasing desire for government, and some would say the need for government, to have more data in order to make better data-driven decisions, which may necessarily implicate data collection issues.

Information & Ethics committee  Thank you for that opportunity. I'll note that I've had the pleasure of appearing before this committee through multiple Parliaments. This committee has issued multiple studies on this question and made recommendations. There isn't a lot to rewrite here. It's one of these issues that just never seem to rise to the level of actual legislation.

Information & Ethics committee  In the particular circumstance, I think there were a number of things that could have been done better in terms of the transparency of what took place. I think Christopher Parsons, who appeared before you, did a good job in his brief before the committee of identifying the lack of transparency and how this suddenly appeared on a website—

Information & Ethics committee  —and the fog of information.

Information & Ethics committee  Yes, absolutely. Let me pick up on and extend some of the comments I made at the beginning with respect to PIPEDA on the private sector side, which would of course implicate the obligations that Telus and BlueDot would have faced. That's legislation that's more than two decades old at this point in time.

Information & Ethics committee  Yes, on the issue of the tribunal, there was some opposition to that. A tribunal was proposed in Bill C-11. I actually had less of a problem with it. I thought that as long as it was an expert tribunal—which unfortunately Bill C-11 did not have; it had a mandate that one of the tribunal members have privacy experience, and I would think that if it's going to be authoritative, it needs to be a true expert tribunal in this area—there might well be value.

Information & Ethics committee  I'm in line with the evidence that's been put forward to date. I'm not an auditor. I'm not in the position, let's say, that the Privacy Commissioner would be in, to be able to go in and fully verify those statements. I'm able to go on the same publicly available evidence that they would be and that you would be, and based on that evidence, yes, it was de-identified.

Information & Ethics committee  I think this represents one of the really exceptional challenges. We started to see that considered in the former Bill C-11, which included references to potential consent or potential rules even around de-identified data, and so—

Information & Ethics committee  No, I don't think the current rules are sufficient. I appreciate that the committee's mandate may be to focus on this specific incident and whether it was legal or not, but I fear that would miss the forest for the trees. There is an opportunity here to use this particular incident to highlight both the enormous value that the data can have, and then, by extension, the necessity of ensuring we have an effective data framework in Canada that includes adequate privacy safeguards, both within the federal government with the Privacy Act and in PIPEDA.

Information & Ethics committee  No, that was really the point that I wanted to drive home with my opening statement. I think that at the moment both the Privacy Act and PIPEDA simply are not fit for purpose.

Information & Ethics committee  I must admit I'm not sure that I can answer that beyond having read the same transcripts that you will have seen, and therein lies part of the problem. Can I confirm for you that it was fully—

Information & Ethics committee  I can only go by what the committee has been told by Telus and responses from the minister. Based on what I've seen put forward, the indications are that that's the case. I think it would have been better to have the Privacy Commissioner there operating as an independent agent to provide the kind of insight and review that may not have occurred in this case, and that's one of the shortcomings that we've seen.

Information & Ethics committee  I think it's hard to say that it has been fully transparent given the limited disclosure and the fact that the Privacy Commissioner wasn't more actively engaged. It's quite clear that this could have been done far better.