Information & Ethics Committee on Nov. 28th, 2022

[Bianca Wylie]

I know what the Privacy Commissioner shared back. However, the reason we both raised.... The privacy commissioners all had the concern with the app being mandatory, rather than voluntary. That came from the Privacy Commissioner, because there's no one else in the government who has a mandate to look at the application of the technology.

In this situation, when we're talking about trust and people's concerns, we need to break out of the privacy paradigm and into the question of appropriate use and ethics.

[Greg Fergus, Liberal, Hull—Aylmer, QC]

What you are talking about is a political issue, rather than a specific directive or failure by the government to protect Canadians' privacy in the face of a public health threat to Canadians and Canada.

[Bianca Wylie]

To me, this is not a political topic at all. We can bring in two facets of the existing government, open government.

What was the public health impact of ArriveCAN? This has not been communicated clearly to the public.

In terms of decision-making about the use of technology, I'd like to share with everyone here that there was a major cultural deference to the Public Health Agency of Canada, which makes a lot of sense in a pandemic. However, deference to the Public Health Agency of Canada on the use of technology does not make any sense. This is not something where the implications of applying technology and all of its related infrastructures that are upstream of both PHAC and CBSA...these are totally different issues that don't sit neatly in the realm of privacy.

This second piece here is important, as well, which is that we understand why the Public Health Agency of Canada—nothing in the Quarantine Act said that we had to have an app, nor a mandatory app—had the authority to exert that decision, when it was against what all of the privacy commissioners recommended for public trust. If there was a good reason, back to open government, it should have been communicated, but it wasn't.

[Greg Fergus, Liberal, Hull—Aylmer, QC]

In your opening remarks, you said no public service should be delivered through an app. Doesn't that fly in the face of the modern age we live in, when people have a growing appetite for easy-to-use services? During the pandemic, for example, the federal government created an online service to deliver the Canada emergency response benefit, financial support for people in need who had lost their jobs.

The trend is towards delivering user-friendly services to people while protecting their privacy.

[Bianca Wylie]

We need to make a distinction here between the Internet and the web. You can have technology that is designed for the Internet and for mobile devices that is not apps that are available through the app store.

When Google and Apple and their iOS systems become implicated in the delivery of our public services and we're not in charge of how Google and Apple develop their mobile operating systems, we are creating a dependency in our technical infrastructure that is a major liability.

We can have modern technology. It doesn't have to live in the apps.

[The Chair, Conservative, John Brassard]

Mr. Fergus, I'm sorry. We're 45 seconds over.

If you want to pick that up later, I would encourage you to do that.

You have six minutes, Mr. Villemure. Go ahead.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Mr. Malone, you've worked for many tech companies.

[Matt Malone]

No, I was a lawyer in California.

[René Villemure, Bloc, Trois-Rivières, QC]

What type of law did you practise?

[Matt Malone]

I worked for clients in the tech and digital sector.

[René Villemure, Bloc, Trois-Rivières, QC]

All right.

You said in your opening remarks that the government had not taken any reasonable steps to protect people's personal information. Can you give me an example of a reasonable step the government should have taken?

[Matt Malone]

Yes, I think the ultimate recommendation that this would come down to if we were in an alternative world would simply be to follow the government's own recommendations and the directives that it has in place, like the directive on automated decision-making, for example. That directive encourages source code in applications to be rendered public by default. In this case, that did not happen—distinct from other health apps designed to prevent the transmission of COVID-19.

Additionally, that directive also sets out that there should be meaningful explanations of how the artificial intelligence such an app might be using is being used to make decisions affecting Canadians. In this case, it's very difficult to get those explanations; we never got them. A large part of that was because the subcontracts from the primary contractors that the CBSA and PHAC used were essentially trade secrets and confidential information. Before the government operations and estimate committee on November 14, a representative from PSPC said very clearly that this information is information that is treated as proprietary, which was very concerning to me.

[René Villemure, Bloc, Trois-Rivières, QC]

You don't think it's confidential information.

[Matt Malone]

No, I think that there should be maximum transparency and accountability, as intended in the Access to Information Act. The manual for that act says very clearly that the underlying contracts with businesses that are doing business with the Government of Canada should be open by default. There should be no presumption of confidentiality.

I don't understand why the presumption of confidentiality exists, when it's only a subcontract. I think that all of those subcontracts should be rendered public. I think it's in the public interest to know them, all the more so because of the fact that the largest of the contracts was granted in a non-competitive bid.

[The Chair, Conservative, John Brassard]

Pardon me, Mr. Villemure. I'm stopping the clock. That was the second time the interpreter couldn't understand your question. Can you please speak slower?

[René Villemure, Bloc, Trois-Rivières, QC]

Of course. Thank you, Mr. Chair.

Please carry on, Mr. Malone.

[Matt Malone]

Essentially, I think the problem is that...subcontracts should be rendered open by default.

[René Villemure, Bloc, Trois-Rivières, QC]

You mentioned GC Strategies and the many subcontractors that were used.

Do you think having so many people involved can indirectly influence public policy?

[Matt Malone]

I'm not sure I would have enough knowledge to answer that question, quite honestly.

[René Villemure, Bloc, Trois-Rivières, QC]

All right. Thank you.

Ms. Wylie, you talked a lot about trust and the risk of eroding that trust.

You contacted the Privacy Commissioner, and he gave you his response. Are you satisfied with that response?

[Bianca Wylie]

No.

[René Villemure, Bloc, Trois-Rivières, QC]

Why not?

[Bianca Wylie]

It's not enough. One, we look at our technology in the frame of privacy. We're downstream from questions such as these. Should this exist? Should we build it? Should we buy it? If we buy it, how are we going to build it, how are we going to maintain it, and how are we going to sunset it?

There are numerous issues that happen upstream of what the commissioner has a mandate to oversee. So there's a lot that doesn't land there, and that to me is an ongoing concern.

[René Villemure, Bloc, Trois-Rivières, QC]

Would you say that the commissioner focused on how the ArriveCAN app worked, as opposed to why it existed?

[Bianca Wylie]

Once they made their statement in 2020, we saw the advice: Don't make it mandatory; make it voluntary. From that point forward, it appeared as though they were supporting the implementation, and I didn't see much resistance.