Information & Ethics Committee on Feb. 7th, 2022

[The Chair, Conservative, Pat Kelly]

Thank you.

[Matthew Green, NDP, Hamilton Centre, ON]

Mr. Chair, could I ask—

[The Chair, Conservative, Pat Kelly]

I'm afraid you're out of time, Mr. Green.

[Matthew Green, NDP, Hamilton Centre, ON]

Just as a point of order, related to information that he had talked about, can we request, through you, that he provide in writing the explicit framework that he talked about?

[The Chair, Conservative, Pat Kelly]

I think you just have.

Again, Mr. Green, I know that you're a big fan of only using—

[Matthew Green, NDP, Hamilton Centre, ON]

Get it in writing.

[The Chair, Conservative, Pat Kelly]

—a point of order when there is actually a deviance from the regular practice or rule of the committee. Thank you, Mr. Green.

We will go to Mr. Brassard. I understand that he will begin and then perhaps split his five minutes.

Go ahead, Mr. Brassard.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Thank you, Mr. Chair.

Mr. Green, that was a proper point of order, by the way.

Mr. Therrien, first of all, you have given us a lot to consider today. I want to thank you for your frankness.

I want to talk about data that's properly de-identified. You said it's always at risk through data matching. We know that through this process, or we've learned that through this process.... Telus collected the data. It was passed on to a secondary source called BlueDot, whose business is presumably to take that data, assess it and provide guidance to PHAC, which eventually became the customer.

What is the risk of data being de-identified by a company whose business it is to deal with this type of scenario? Just talk about the risk, if you will.

[Daniel Therrien]

I would not go to the motivation of a company. I would go to what safeguards we're applying.

[John Brassard, Conservative, Barrie—Innisfil, ON]

That's where I was going with this.

[Daniel Therrien]

That is what we would investigate.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Right. We have heard from security experts and privacy experts publicly—we haven't heard it at the committee, at this point—that those appropriate safeguards and protocols have to be put in place at the source. If they are not, then there is a significant risk of reidentifying that information.

[Daniel Therrien]

Mr. Turcotte, you may want to answer this one.

[Martyn Turcotte, Director, Technology Analysis Directorate, Office of the Privacy Commissioner of Canada]

Yes, Commissioner.

I will try to speak slowly, because I believe I'm having microphone issues.

When we talk about the risk of re-identification—

[The Chair, Conservative, Pat Kelly]

Excuse me. I have to stop you, Mr. Turcotte. The interpreters are unable to interpret. I understand that you don't necessarily have the ideal headset for this.

I will maybe throw the question back to Commissioner Therrien to answer.

[Daniel Therrien]

We can answer in writing, but I think that Mr. [Technical difficulty—Editor]. He would also be well placed. Otherwise, we would be happy to answer in writing.

[The Chair, Conservative, Pat Kelly]

With that, I think we're going to switch to Mr. Patzer.

You have two and a half minutes.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Thank you very much, Mr. Chair.

Mr. Therrien, I think Canadians at large were quite alarmed and surprised to learn that, as I think one article I read said, 33 million users had their data accessed by PHAC. It begs the question, how many other departments out there are accessing people's personal information within the federal government?

[Daniel Therrien]

What we have seen in the pandemic in particular is that governments, not only the Government of Canada but governments writ large, call on the private sector to develop digital programs in order to deliver services. That's not necessarily a bad thing, but what we see is that there is an increasing interaction between the public and private sectors in terms of the management of data.

Again, that's not a bad thing. It needs to be properly regulated according to known criteria, and be the subject of investigation when the case arises, but there are certainly other departments that do this.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Yes. I think the general concern, though, is that the government is taking people's personal data, but then it could potentially use it against them. Is that a concern? Are there any safeguards to prevent that from happening?

[Daniel Therrien]

If we're dealing with personal information collected by the federal government, the Privacy Act does offer some protections. It's a badly outdated law, about 40 years old, but it would be an exaggeration to say that there are no protections.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Yes. I think that's definitely problematic.

My last question goes back to when you appeared in 2020 before the industry committee, which I was a member of at the time. You indicated that when properly designed, tracing applications could achieve both public health objectives and the protection of rights simultaneously. I remember that at the time you had some concerns about that, because the government hadn't actually consulted you at that point in time. How were those concerns addressed, and what has been done to prevent that?

[Daniel Therrien]

Is your question about COVID Alert?

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Yes.

[Daniel Therrien]

We were heavily consulted on COVID Alert, and I was able to say that the privacy protections for that particular application were actually quite high.