Information & Ethics Committee on Feb. 3rd, 2022

[Matthew Green, NDP, Hamilton Centre, ON]

I'm sorry, Mr. Chair. I have 30 seconds left for Dr. Tam.

Through the chair, do you intend to use this information beyond its intended procurement or do you intend to have a process through which this information will be destroyed?

[Dr. Theresa Tam]

We're using this for the purpose of the pandemic and looking at the mobility.

[Matthew Green, NDP, Hamilton Centre, ON]

Beyond that, you do have plans to share it with other departments? For instance, when we have a—

[The Chair, Conservative, Pat Kelly]

You're out of time, Mr. Green. Be real quick and I'll let Dr. Tam have three or four seconds to reply, if she would like. Then we'll move on.

[Dr. Theresa Tam]

As Mr. Allison has said, the reports are shared with provinces, territories and the departments that are making policies.

[The Chair, Conservative, Pat Kelly]

Thank you.

Moving to the next round, we'll start with Mr. Calkins for five minutes.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Minister, thank you for being here today.

In order to have useful information or useful data, how many times a day would a Canadian citizen's cellphone need to be pinged in order to be valuable to PHAC?

[Jean-Yves Duclos, Liberal, Québec, QC]

It might be useful to repeat again that the data are not individualized. The data are aggregated, de-identified and anonymized. They have no personal value role and no personal value usefulness. It has nothing to do with personal information.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

You're missing the point of my question, Minister.

If my phone was pinged at 3:00 a.m., once a day, you would find it consistently on my nightstand, beside my bed. It would be of little to no value in the managing of COVID-19.

My question is this: In order for the data to be useful, how many times a day would a Canadian's cellphone location have to be provided to the government in order to make an effective decision? How many data points are there per day?

[Jean-Yves Duclos, Liberal, Québec, QC]

As I said, Mr. Chair, the information that we use is not personal information, so I'm sorry, you should ask those questions to someone else, certainly not [Technical difficulty—Editor] or someone in PHAC. The data we're using are anonymized, de-identified and aggregated.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

If you don't know how many times a day a Canadian cellphone is being tracked, how do you know the data is useful? Like I said before, if we're only pinging that phone once a day, how can you be making informed decisions about Canadians' whereabouts or their movements? How many times a day would you need to know where somebody is in order to usefully track people moving around and curb the spread of COVID‑19?

[Jean-Yves Duclos, Liberal, Québec, QC]

That's a better question about the usefulness of the information. I'll quote the experts and top world researchers from the U.S. Centers for Disease Control and Prevention and from the European Commission's joint research centre. They say that mobility explains transmission and spread and can reduce mortality and mitigate the need for lockdowns. In basic words, that means saving lives and saving jobs.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

You talked a lot about de-identified data. Are you talking about data in its purest form? Do you actually have raw data points?

[Jean-Yves Duclos, Liberal, Québec, QC]

No, Mr. Chair. As I mentioned earlier, the data of which we speak today are data that you can access immediately on your telephone by clicking on COVIDTrends. You can also go to the WeatherCAN application. In recent months, 1.7 million Canadians have done that. You'll see the data. These are mobility data that we have. You'll find out why these data are obviously not individualized and not personalized. They're de-identified, aggregated and anonymized.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

De-identified data.... Data is stored in bits and bytes or ones and zeros on a medium. When you delete a file, Minister—and you don't have to have a Ph.D. in computer systems technology or computer science to know this—all you delete is the link on the file allocation table that references the data on the stored medium. Anybody with any skill whatsoever—anybody under the age of 35 today—could probably go back and look at any particular data point on a data medium and re-identify data. It's not a complicated thing to do.

Minister, what assurances can you provide to this committee and to Canadians that their information cannot be re-identified?

[Jean-Yves Duclos, Liberal, Québec, QC]

We're talking about the deletion of a file. Whether the file is deleted or not makes no difference. The file has no personal information value or content. That file has no individual-level data. It's de-identified, anonymized and aggregated. That file has no value for anyone who would seek personal information.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

In your briefing at the start, you mentioned that the information you have would be useful for other levels of government. Has the Public Health Agency of Canada shared this information with other agencies provincially or municipally, or with any other actors, since you've come into possession of this data?

[Jean-Yves Duclos, Liberal, Québec, QC]

Ms. Thompson, Mr. Allison and Dr. Tam made reference to that. Do you want to mention that again?

[Kathy Thompson]

Yes, certainly. Thank you, Minister.

Mr. Chairman, we provide some report summaries that we share with the provinces and territories to help inform their decision-making and their situational awareness with respect to public health and population mobility. In addition, as the minister already mentioned, we prepare summaries of reports that we publish on COVIDTrends.

That is who we share the information with.

[The Chair, Conservative, Pat Kelly]

Thank you.

Ms. Saks, you have five minutes.

[Ya'ara Saks, Liberal, York Centre, ON]

I'd like to start by thanking both the minister and my colleague from the Bloc, Mr. Villemure, for making it absolutely clear that the data that PHAC receives through its arrangements with BlueDot and Telus cannot be repersonalized, that the disaggregated, anonymized data that is received by the agency cannot identify the Canadians who are moving about their day throughout this pandemic.

That's a really important point. I want to thank the minister and my colleague for clarifying that to us in the committee room and to Canadians.

I'd like to talk about transparency, because that is something that my colleague Mr. Brassard raised and that there has been some confusion on. On March 23, 2020, the Prime Minister announced the BlueDot contract, and and then on March 26 Health Canada entered the contract with regard to anonymized, disaggregated data. On April 22, 2020, PHAC engaged the Office of the Privacy Commissioner as it moved forward with this useful tool in monitoring the pandemic and the movement of the pandemic throughout our communities.

On September 22, 2020, the privacy management division issued its analysis confirming that the data from both Telus Mobility and BlueDot is not considered personal information, and therefore does not engage the Privacy Act. Furthermore, Canadians were able to engage with Dr. Tam through the COVID tracker to know exactly what was being assessed for the safety and health of Canadians.

I can go on—into the record of January 25, 2021, when consultation was held with the public health and ethics group to assure yet again that the data that was utilized for the health assessments was anonymized and not personalized.

Minister, since there seems to be some confusion about how we engaged with the Office of the Privacy Commissioner, and how the government moved forward in making sure that its contracts received data that was clear of any personalized information, could you maybe go a bit deeper into the details of the steps and the diligence taken by the ministry and by PHAC to ensure that the privacy of Canadians was ensured throughout this process?

[Jean-Yves Duclos, Liberal, Québec, QC]

Thank you, Ms. Saks, for not only a great question but a great summary of the situation, which I believe will serve to assure and reassure everyone in the committee and anyone else listening and watching us today about the use and the usefulness of those data.

On the link to the Privacy Commissioner, the Privacy Commissioner and his office have an incredibly important job to do in the Government of Canada. Their advice, their input and their guidance are key to everything we do, including through a pandemic. A crisis is no excuse for not protecting the privacy of Canadians. That's why we've done that since the start and will continue to do that as we keep fighting the virus.

As you alluded to, PHAC was engaged from the very start with the Office of the Privacy Commissioner, immediately in April and biweekly thereafter. There was also a process in the Government of Canada to assess whether the information that was being gathered was subject to privacy laws. The determination was made that it was not subject to the Privacy Act. Therefore, the work continued, using, as you mentioned, disaggregated, de-identified and anonymized data.

We will continue to work with the Office of the Privacy Commissioner as we proceed through the crisis. As I have said, protecting the privacy of Canadians is an absolute key priority. Whatever we do must fulfill that obligation.

[The Chair, Conservative, Pat Kelly]

Ms. Saks, you have 30 seconds for a question and answer.

[Ya'ara Saks, Liberal, York Centre, ON]

At this time, perhaps Ms. Thompson or Mr. Allison can just clarify to me if a multibarrier security approach was used when PHAC received the data, to ensure additional privacy and security measures were in place. Yes or no is fine.

[Christopher Allison]

I can answer that, Mr. Chair. Yes, a multiple-barrier security approach was in place to protect and ensure that the data was used appropriately.