Thank you, Mr. Chair.
My name is Matt Malone. I am an assistant professor at Thompson Rivers University in the faculty of law. I am attending the hearing today in a personal capacity, representing only my own views.
I'd like to thank the committee for this unexpected invitation and opportunity to discuss my privacy concerns regarding the ArriveCAN application.
After my opening remarks, I would be glad to answer the committee members' questions.
First, I would like to talk about how the government failed to take reasonable steps to ensure that personal information collected and retained by the app was kept safe. Unquestionably, the worst example of this was the glitch that sent 10,200 people who had correctly used the app faulty quarantine orders. The government’s response to and transparency about the glitch were appalling. Some affected users were not notified that they were victims of the glitch for 12 days. During those 12 days, the ArriveCAN privacy notice stated that disobeying a quarantine order issued by the app was punishable by a fine of up to $750,000, or six months in jail.
When I wrote about this issue in the Globe and Mail in August, I received numerous harrowing stories from Canadians. This correspondence made it very clear that many elderly and rural Canadians in particular were seriously affected. In my own experience, when I requested the personal information about me, collected by CBSA through the app, it was not forthcoming from CBSA for four months. When I finally received it, there were many errors in my personal information.
The foregoing suggests that the government failed to take reasonable steps to ensure that the personal information it collected was both adequately safeguarded as well as accurate, up to date, and complete, as required by section 6 of the Privacy Act.
Second, I want to talk about secrecy. CBSA has not been forthcoming with Canadians or Parliament, including this committee. On November 14, 2022, the CBSA president told the government operations and estimates committee that the CBSA spent 4% of its budget on ArriveCAN for security. But it has produced almost no records speaking to those efforts.
The work of the primary contractors involved in building ArriveCAN also raises serious concerns. Based on my review of previous access to information requests, extensive correspondence between GC Strategies’ managing partner, Kristian Firth, and Canada's chief technology officer, Marc Brouillard, shows that GC Strategies appears to operate more as an unregistered lobbyist than a primary contractor. As a primary contractor, it appears that the only real service they offer is secrecy, by subcontracting work through contracts that are shielded from disclosure as proprietary information. This is a deeply unsettling way to deliver government services that involve the mandatory collection and retention of Canadians’ personal information.
Third, I want to talk about the justification for the app. I have noted in my public and academic writings that the mandatory use of ArriveCAN did not meet the threshold under the Quarantine Act for emergency measures. Moreover, the government’s rationale for the app kept changing. This became most obvious following the introduction of the “advance CBSA declaration”, an optional feature that was inserted into the mandatory architecture of the ArriveCAN app. When the advance CBSA declaration was unveiled, it was done so hastily that the government did not include a privacy notice as required under subsection 5(2) of the Privacy Act. I believe this also likely implicated sections 4 and 7 of the Privacy Act.
Fourth, I want to talk about the government’s disregard for existing oversight measures when it introduced ArriveCAN. With ArriveCAN, many of these measures were simply ignored entirely.
It is crucial to point out that the government disregarded key measures in a number of acts and directives—the Directive on Automated Decision-Making, for one.
Fifth, I believe this episode underscores the need for urgent reform in the access to information system. We need robust access to information that sheds light on the work of quasi-lobbyists like GC Strategies. Using such entities to deliver services that are making decisions about Canadians and are subject to neither disclosure nor review is concerning in the context of mandatory collection and retention of Canadians’ personal information.
Ironically, GC Strategies itself once even pitched to the Treasury Board Secretariat using subcontractors to reform the access to information system's search function itself. The existing system needs more funding and more disclosure. Many of my own requests have been egregiously delayed. Some have been simply ignored. I'm happy to discuss those.
Finally, to echo the comments of my colleague Bianca Wylie, for whom I have great respect, I want to emphasize that the government should never have deviated from its own promises early in the pandemic that it would introduce health apps only on a voluntary basis. This was echoed and supported by a joint statement of all privacy commissioners, who came together to say the same.
I believe public trust is essential in driving successful technology adoption, and I believe this kind of trust cannot be mandated.
Again, I'd like to thank the committee for inviting me.
