Thank you.
Evidence of meeting #5 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was good.
A video is available from Parliament.
Evidence of meeting #5 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was good.
A video is available from Parliament.
11:50 a.m.
NDP
Matthew Green NDP Hamilton Centre, ON
Just as a point of order, related to information that he had talked about, can we request, through you, that he provide in writing the explicit framework that he talked about?
11:50 a.m.
Conservative
The Chair Conservative Pat Kelly
I think you just have.
Again, Mr. Green, I know that you're a big fan of only using—
11:50 a.m.
Conservative
The Chair Conservative Pat Kelly
—a point of order when there is actually a deviance from the regular practice or rule of the committee. Thank you, Mr. Green.
We will go to Mr. Brassard. I understand that he will begin and then perhaps split his five minutes.
Go ahead, Mr. Brassard.
11:50 a.m.
Conservative
John Brassard Conservative Barrie—Innisfil, ON
Thank you, Mr. Chair.
Mr. Green, that was a proper point of order, by the way.
Mr. Therrien, first of all, you have given us a lot to consider today. I want to thank you for your frankness.
I want to talk about data that's properly de-identified. You said it's always at risk through data matching. We know that through this process, or we've learned that through this process.... Telus collected the data. It was passed on to a secondary source called BlueDot, whose business is presumably to take that data, assess it and provide guidance to PHAC, which eventually became the customer.
What is the risk of data being de-identified by a company whose business it is to deal with this type of scenario? Just talk about the risk, if you will.
11:50 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I would not go to the motivation of a company. I would go to what safeguards we're applying.
11:50 a.m.
Conservative
11:50 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That is what we would investigate.
11:50 a.m.
Conservative
John Brassard Conservative Barrie—Innisfil, ON
Right. We have heard from security experts and privacy experts publicly—we haven't heard it at the committee, at this point—that those appropriate safeguards and protocols have to be put in place at the source. If they are not, then there is a significant risk of reidentifying that information.
11:50 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Mr. Turcotte, you may want to answer this one.
11:55 a.m.
Martyn Turcotte Director, Technology Analysis Directorate, Office of the Privacy Commissioner of Canada
Yes, Commissioner.
I will try to speak slowly, because I believe I'm having microphone issues.
When we talk about the risk of re-identification—
11:55 a.m.
Conservative
The Chair Conservative Pat Kelly
Excuse me. I have to stop you, Mr. Turcotte. The interpreters are unable to interpret. I understand that you don't necessarily have the ideal headset for this.
I will maybe throw the question back to Commissioner Therrien to answer.
11:55 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We can answer in writing, but I think that Mr. [Technical difficulty—Editor]. He would also be well placed. Otherwise, we would be happy to answer in writing.
11:55 a.m.
Conservative
The Chair Conservative Pat Kelly
With that, I think we're going to switch to Mr. Patzer.
You have two and a half minutes.
11:55 a.m.
Conservative
Jeremy Patzer Conservative Cypress Hills—Grasslands, SK
Thank you very much, Mr. Chair.
Mr. Therrien, I think Canadians at large were quite alarmed and surprised to learn that, as I think one article I read said, 33 million users had their data accessed by PHAC. It begs the question, how many other departments out there are accessing people's personal information within the federal government?
11:55 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
What we have seen in the pandemic in particular is that governments, not only the Government of Canada but governments writ large, call on the private sector to develop digital programs in order to deliver services. That's not necessarily a bad thing, but what we see is that there is an increasing interaction between the public and private sectors in terms of the management of data.
Again, that's not a bad thing. It needs to be properly regulated according to known criteria, and be the subject of investigation when the case arises, but there are certainly other departments that do this.
11:55 a.m.
Conservative
Jeremy Patzer Conservative Cypress Hills—Grasslands, SK
Yes. I think the general concern, though, is that the government is taking people's personal data, but then it could potentially use it against them. Is that a concern? Are there any safeguards to prevent that from happening?
11:55 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
If we're dealing with personal information collected by the federal government, the Privacy Act does offer some protections. It's a badly outdated law, about 40 years old, but it would be an exaggeration to say that there are no protections.
11:55 a.m.
Conservative
Jeremy Patzer Conservative Cypress Hills—Grasslands, SK
Yes. I think that's definitely problematic.
My last question goes back to when you appeared in 2020 before the industry committee, which I was a member of at the time. You indicated that when properly designed, tracing applications could achieve both public health objectives and the protection of rights simultaneously. I remember that at the time you had some concerns about that, because the government hadn't actually consulted you at that point in time. How were those concerns addressed, and what has been done to prevent that?
February 7th, 2022 / 11:55 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Is your question about COVID Alert?
11:55 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We were heavily consulted on COVID Alert, and I was able to say that the privacy protections for that particular application were actually quite high.