Information & Ethics Committee on Feb. 7th, 2022

[The Chair, Conservative, Pat Kelly]

I call this meeting to order.

Welcome to meeting number 5 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

Pursuant to Standing Order 108(3)(h) and the motion adopted by the committee on Thursday, January 13, 2022, the committee commenced its study on collection and use of mobility data by the Government of Canada.

Today's meeting is taking place in a hybrid format, pursuant to the House order of November 25, 2021. Members are attending in person in the room or remotely using the Zoom application. The proceedings will be made available via the House of Commons website. So that you are aware, the webcast will always show the person speaking rather than the entirety of the committee.

I would like to take this opportunity to remind all participants of this meeting that screenshots or taking photos of your screen is not permitted.

Given the ongoing pandemic situation and in light of recommendations from health authorities, as well as the directive from the Board of Internal Economy on October 19, 2021, to remain healthy and safe, all those attending in person are to maintain a two-metre physical distance and must wear a non-medical mask when circulating in the room. It's highly recommended that the mask be worn at all times, including when seated. When you are speaking, though, it's sometimes easier to remove it. I will remove my mask when I'm speaking. Persons also must maintain proper hand hygiene by using the provided hand sanitizer at the room entrance.

As the chair, I will be enforcing these measures for the duration of the meeting, and I thank members in advance for their co-operation.

To ensure an orderly meeting, I would like to outline a few rules to follow.

Members and witnesses may speak in the official language of their choice. Interpretation services are available for this meeting. You have the choice, at the bottom of your screen, of floor, English or French. If interpretation is lost, please inform me immediately and we will ensure interpretation is properly restored before resuming the proceedings. The “raise hand” feature at the bottom of the screen can be used at any time if you wish to speak or alert the chair.

For members participating in person, proceed as you usually would when in a committee room. Keep in mind the Board of Internal Economy's guidelines for mask use and health protocols.

Before speaking, please wait until I recognize you by name. If you are on the video conference, please click on the microphone icon to unmute yourself. For those in the room, your microphone will be controlled as normal by the proceedings and verification officer. When speaking, please speak slowly and clearly. When you are not speaking, your mike should be on mute.

As a reminder, all comments by members and witnesses should be addressed through the chair.

With regard to a speaking list, the committee clerk and I will do the best we can to maintain a consolidated order of speaking for all members, whether they are participating virtually or in person.

I would like to welcome our witnesses. From the Office of the Privacy Commissioner of Canada, we have Daniel Therrien and Martyn Turcotte, who is director of the technology analysis directorate.

Before I turn it over to the commissioner for his opening statement, I will say that I am going to devote part of the time in the second panel to committee business. This was requested by a member of the committee, and I think it's time we had a discussion of committee business. I will aim, if we can make everything run on time.... Hopefully we can have up to half an hour for committee business, but that will depend, in part, on keeping on schedule.

With that, I will turn it over to you, Commissioner. Thank you very much for appearing. You have five minutes for an opening statement.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you very much, Mr. Chair.

Thank you for the invitation to appear in connection with your important study.

Early in the pandemic, the Office of the Privacy Commissioner of Canada recognized that data can serve the public interest, such as protecting public health. To that end, we published a framework for how to achieve this while respecting privacy, a key point of which was to use de‑identified or aggregated data wherever possible.

Our framework cautioned that institutions should be aware there is always a risk of re‑identification. Given this risk, our framework was explicit that there needs to be technical and other means implemented to protect the information. In principle, then, the use of de‑identified or aggregated data for public health purposes is consistent with our framework, provided appropriate technical standards are used.

Since the beginning of the pandemic, we have had regular meetings with the Public Health Agency of Canada on COVID-related initiatives. We welcome these interactions.

In the case of the government's use of mobility data, we were informed of their intent to use data in a de‑identified and aggregated way. We offered to review the technical means used to de‑identify data and to provide advice, but the government relied on other experts to that end, which is its prerogative.

Now that we have received complaints, we will investigate and turn our attention to the means chosen for de‑identification and whether they were appropriate to safeguard against re‑identification. Since this is under investigation, we will not be able to provide you with advice on this aspect of your study.

I would now like to offer the following observations on how this case is only one example of much more widespread practices in the public and private sectors and why, in my view [Technical difficulty—Editor] the urgent need for law reform. I also wish to suggest issues that you may want to consider during your study.

Organizations in both the public and private sectors constantly reuse data to new ends. This practice raises legitimate concerns by consumers, particularly when their personal information is used without their knowledge for purposes other than those they expected. Is the solution to ensure meaningful consent is obtained for all such cases? I think this is neither realistic nor reasonable, as this case illustrates.

The solution, in my view, would be to authorize the use of personal data for socially beneficial purposes and legitimate commercial interests within a rights-based law that acknowledges the nature and value of privacy as a human right so as to give privacy its appropriate weight in any balancing exercise.

The government argues that its use of mobility data did not engage the Privacy Act: in other words, that the act does not apply. Oddly, if the data was properly anonymized and aggregated—a fact that your committee and our office will separately investigate—that conclusion is likely legally correct, so the first question you should consider is whether the data, indeed, was properly de-identified and aggregated.

Even if it was, I would suggest that the second issue is whether it is good legislative policy that de-identified information falls outside the reach of privacy laws. We think removing de-identified information from the reach of these laws would bring very significant risks and is not good policy.

There is then the question of transparency and consent. Did the government or its private-sector partners adequately inform users that their mobility data would be used for public health purposes? While there is a reference to the “data for good” program somewhere in Telus's privacy policies, and while the government does make an effort to inform citizens of its use of mobility data on its COVIDTrends web page, I do not think anyone would seriously argue that most users knew how their data would be used.

Does that matter? That, I suggest, is another question you should consider. There's no question that transparency is important to enhance trust, and the government could likely have been more proactive in informing Canadians about its program, but should programs like this require meaningful consent?

As I mentioned earlier, I believe that due to the limitations of the consent model in protecting privacy, a more appropriate policy would be to authorize the use of personal information for legitimate commercial interests and the public good within a rights-based law. That law should be enforced by the OPC, an independent regulator, to which would be conferred the requisite powers and resources to protect Canadians.

[The Chair, Conservative, Pat Kelly]

I apologize for not giving you a warning, but you are pretty much out of time.

[Daniel Therrien]

I'm happy to take questions.

[The Chair, Conservative, Pat Kelly]

With that, I will go to Mr. Brassard for six minutes.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Thank you, Mr. Chair.

My preference would have been for Mr. Therrien to continue, because he certainly is the expert in this field and has a lot to say.

Mr. Therrien, I want to thank you for being here today. I believe this is an important study. It's important because Canadians are seized with the issue of privacy. I think what it also does, Mr. Therrien, is allow this committee to look at the very issues that you've highlighted in your opening statement and that you've written to other privacy commissioners about. You've written to the government about protecting privacy in the pandemic.

What I really want to clarify has to do with the consultation of your office. I happen to believe, and I believe many Canadians do as well, that if it is not the Privacy Commissioner of Canada's office that needs to be consulted, then who else needs to be consulted? In other words, you are the standard by which privacy is met in this country, and yet we hear conflicting reports that you were consulted or you weren't consulted.

PHAC went out and advised that they were looking at other security experts and privacy experts. What would those other security and privacy experts offer the government that the Privacy Commissioner of Canada and his office could not?

[Daniel Therrien]

On the facts of whether we were consulted or informed, and what was the tenor of these discussions, we were informed by PHAC and a group within the innovation department that the government wanted to use de-identified information for the purposes outlined: i.e., use mobility data to determine trends in mobility for public health purposes.

We were informed of this as part of regular meetings with government agencies on any number of COVID alert issues. At that time, we were heavily involved in the COVID Alert app, among other things, so we were informed of this particular project.

We offered to provide advice on the adequacy of safeguards to ensure that the data was properly de-identified, and the government decided to rely on others. That's their prerogative.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Is that normal, Mr. Therrien? It's their prerogative, but is it normal for them to seek outside security and privacy expert advice when, in fact, it's your office that's charged with protecting and providing that advice to the government on privacy rights? I find it highly unusual that they would do that.

[Daniel Therrien]

We offered to provide advice. Is it normal that we not intervene in every case? I think the reality is that we, as an office, cannot be involved in pre-authorizing or reviewing every case of data collection or disclosure that occurs in Canada. We give general advice that we hope is followed. We investigate complaints.

I think that in the new law our office should have greater powers to proactively audit the practices of governments and the private sector, but unfortunately it is just not realistic to expect that we will pre-approve every use or disclosure of data in this country. At the end of the day, it is to the benefit of Canada that data is shared, obviously for good reasons—for legitimate commercial interests, for the public good, and not for illegitimate surveillance as we've seen in certain cases.

Because these practices occur all the time, we just cannot be there all the time.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Right, but it is reasonable to expect, on behalf of Canadians, that going outside to other privacy and security experts doesn't guarantee that the government or, in this case, the telecom communication companies are following the privacy laws.

Would that be an issue of concern for you, that going outside of what is the de facto expert in this country would...? It's almost like finding a lawyer who agrees with you. One doesn't, the other one doesn't, but then you go to another lawyer and they say, “Yes, okay, you are following the law”, but it actually doesn't make it so. Does that concern you?

[Daniel Therrien]

We're not the only experts. Expertise is not spread evenly among all institutions, but here, we're dealing with the Government of Canada, which has experts, and with large telecom companies that also have experts. We offered our expertise. It was declined. It is what it is.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Thank you, Mr. Therrien.

You mentioned consent, and the importance of consent. One could argue easily that Telus and its “data for good” offers an opt-out provision. However, in most cases, and we've heard in testimony that in some cases....

Mr. Chair, am I just about out of time?

[The Chair, Conservative, Pat Kelly]

You're just about out of time.

[John Brassard, Conservative, Barrie—Innisfil, ON]

It's just the importance of informed consent as it relates to data gathering.

[Daniel Therrien]

Again, consent is not a silver bullet or a solution for all cases. There's no question here that, as I said in my statement, most Canadians whose data was used did not know their data was used. The parties, both the government and the private sector, could have done more to inform users that their data was used for these purposes.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Thank you.

[The Chair, Conservative, Pat Kelly]

Thank you.

We'll go to Mr. Fergus, for six minutes.

[Greg Fergus, Liberal, Hull—Aylmer, QC]

Thank you very much, Mr. Chair.

I'd also like to thank Mr. Therrien for his testimony today and for being available to offer his comments and expertise.

We are very grateful for your work, Mr. Therrien.

The committee decided to conduct a study “of the Public Health Agency of Canada collecting, using or possessing Canadians' private cellphone data”. A spokesperson for the Public Health Agency of Canada has clarified that only de‑identified or aggregated data are used.

Mr. Therrien, based on your assessment of the communications your office has had with PHAC, can you tell us whether, prima facie, the government did receive de‑identified or aggregated data?

[Daniel Therrien]

I cannot, because that is the subject of the investigation we are going to have to conduct as a result of the formal complaints we have received under the law.

What I can say is that we have had discussions with PHAC. They informed us, again, that they intended to use de‑identified or aggregated data for public purposes, such as public health. This is consistent with our understanding of privacy principles.

As to whether the data was de‑identified properly, we don't know yet. We will investigate.

[Greg Fergus, Liberal, Hull—Aylmer, QC]

Mr. Therrien, there were no red flags in April 2020 when you started those discussions, were there? I would imagine it was because PHAC was doing its job and asking to receive de‑identified data in accordance with the important principles that your office and the government established, right?

[Daniel Therrien]

The information provided to us was, in principle, consistent with the framework we had established. We offered to go under the hood to determine if the data had indeed been de‑identified properly, but the government declined that offer. In terms of principles, we saw no problem. As what happened in practice, we will investigate. I have no reason to believe that things were done correctly or, conversely, inappropriately. That will be investigated.

[Greg Fergus, Liberal, Hull—Aylmer, QC]

Mr. Therrien, apparently the data was published transparently. Again, I ask: Do you have any reason to be concerned that the published data has not been adequately de‑identified?

[Daniel Therrien]

That's what we will be investigating. I cannot comment on that at this time.

[Greg Fergus, Liberal, Hull—Aylmer, QC]

Has this data been in the public domain for some time, Mr. Therrien?

[Daniel Therrien]

Yes, it was published several months ago.