Evidence of meeting #8 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was consent.
A recording is available from Parliament.
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
I would ask our witnesses to go into a little more detail about the extent that they go to to protect the privacy and security of this data.
Chief Executive Officer and Founder, Professor of Medicine and Public Health, University of Toronto, BlueDot
I know time is limited.
Number one, any data we receive is de-identified before we receive it. Internally, we have a whole bunch of procedures, both administrative and security procedures, to manage and keep the data in a secure environment. Any outputs that we then actually analyze, produce and deliver to the Public Health Agency are aggregated in a very thoughtful way so there's no conceivable way we can envision that any of this data could be reassociated with any individual. From the very beginning of how we receive the data, how we store it, how we process it, how we aggregate it and how we deliver it, we're doing that in a very thoughtful manner in the entire process.
Conservative
Bloc
René Villemure Bloc Trois-Rivières, QC
Thank you very much, Mr. Chair.
Dr. Khan, Mr. Demarsh, thank you for joining us today.
I am sure of the benefits you are talking about for public health. I also understand that you are not compromising people's privacy. You are applying best practices with the data you receive.
My concern is about the consent of the user, who probably clicked on “I accept” somewhere, usually without having read the conditions or having failed to understand them.
Do you think users understand that their data is used by a third party?
Chief Executive Officer and Founder, Professor of Medicine and Public Health, University of Toronto, BlueDot
Mr. Chair, perhaps I can take that question.
Chief Executive Officer and Founder, Professor of Medicine and Public Health, University of Toronto, BlueDot
Thank you for the really important question.
Here's what I can say. I can't speculate as to what is in each person's mind when they are providing express consent to enable location data. What I can say is that they do have the opportunity to withdraw that express consent at any point in time. I think it is an important question around the consent process. In our work with third parties, we have ensured that the organizations we're working with are adhering to all of the Canadian and other internationally stringent privacy laws and regulations, and that they have strong data privacy practices in place. They have assured us in writing around some of their practices. We've done our due diligence as well in making sure we're working with partners that are respecting privacy.
With respect to the consent process, it's an important question and conversation about whether the consent is sufficiently informed. I'm not an expert in that domain, but I am sure this committee will, through all of the experts who have presented, be able to arrive at a better assessment of that.
Bloc
René Villemure Bloc Trois-Rivières, QC
Thank you very much for your answer.
I know that this is not your area of expertise, but my concern is about the distinction between people who may know that their data is being used and those who understand this. There is a distinction between knowing this and understanding it.
Do you think the members of our committee have reason to worry about the entire process?
Chief Executive Officer and Founder, Professor of Medicine and Public Health, University of Toronto, BlueDot
To the honourable member, my response would be that this process is one that requires some careful thought. Within the diligence that is happening through this committee, it is certainly appropriate to be asking the question as to whether we are striking an appropriate balance.
I think we've all heard that these types of data can be protecting lives, can be protecting a lot of lives and protecting society, not just from COVID-19 but, as I mentioned in my opening remarks, we know there are more of these that are coming. I think the diligence that is happening here with this committee is appropriate, looking at and just asking whether the processes can be better.
If there's anything we can do in response to a pandemic, or anything else, it's really just to learn from our experiences and look at ways that we can do things more optimally.
That's my input as a physician.
Bloc
René Villemure Bloc Trois-Rivières, QC
I have no doubt that you are saving lives.
Did you choose Telus as a supplier or was that the Public Health Agency of Canada's decision?
Director, Data Science, BlueDot
Mr. Chair, I can respond. To clarify, Telus is not a data supplier for us. We have no relationship with Telus.
Chief Executive Officer and Founder, Professor of Medicine and Public Health, University of Toronto, BlueDot
We have two data suppliers that provide us with data. In our agreements with those suppliers, we have contractual obligations that, if we do make any public statements, we would just need to seek their permission first before making any announcement.
If there was a request for us to do so, we'd be happy to approach our suppliers to seek that permission.
Bloc
René Villemure Bloc Trois-Rivières, QC
I completely understand the context.
I would like you to send to the committee the names of your suppliers, using the appropriate precautions, of course.
So there is no direct contractual relationship with Telus. Can you tell us what kind of businesses provide you with data, without naming them?
Chief Executive Officer and Founder, Professor of Medicine and Public Health, University of Toronto, BlueDot
First of all, we are not working with Telus. That is not the source of the data.
The data we've been working with comes from providers that use GPS location data from mobile apps. Again, through that process I described of consenting to use location or being able to withdraw consent—and again, these are providers who are following all of the data privacy laws and regulations in Canada and in other international jurisdictions—largely these are providers that are actually interfacing with mobile apps.
NDP
Matthew Green NDP Hamilton Centre, ON
Mr. Chair, in preparation for this committee study and anticipation of the witnesses, we spent some time looking up the bios and we came across Mr. Demarsh and noticed that he had been employed by PHAC until March 2021.
Can Mr. Demarsh share a little about his role with PHAC and elaborate on how this informs his work now with BlueDot?
Director, Data Science, BlueDot
Certainly.
I was an epidemiologist, data scientist and manager of data engineering teams at the agency for years. In the context of the pandemic, I worked in the emergency operations centre, building and refining data systems used for more traditional public health data. I was aware of BlueDot and had worked with BlueDot's software in a previous role, but at that time had no interaction or involvement with BlueDot's work. I was working in a completely different part of the agency.
I will say, if the question is why I joined BlueDot, I was persuaded by the mission and excited about the technology and the possibility of really making a difference in public health. That informs my work and our interaction with the Public Health Agency of Canada, but I had no direct involvement in contracting or the agency's decision to work with BlueDot.
NDP
Matthew Green NDP Hamilton Centre, ON
In the final points I think he raises an important question, which is why I wanted to put it on the table, given the committee that we're in.
Just to assure the committee, at any point when you were working with PHAC, would your information or contribution as an employee of the federal government have contributed to the procurement process of this contract?
Director, Data Science, BlueDot
No. It would not, in any way whatsoever.
NDP
Matthew Green NDP Hamilton Centre, ON
Okay. Thank you for that.
In his introductory remarks, Dr. Khan listed “entrepreneur” on top of his medical expertise. Does the doctor have any comment on the commodification of personal data as it relates to BlueDot's business model?
Chief Executive Officer and Founder, Professor of Medicine and Public Health, University of Toronto, BlueDot
Thank you for the question.
BlueDot's business model is about using and driving innovation to protect lives. I want to highlight that BlueDot's entire reason for existence is around developing innovation to prepare for and respond to not only the threat that we've been enduring for the past two years, but also the many before and the more that will come.
As a physician with 20 years in practice, as I highlighted in my opening statement, I've had experience on the front lines of crises, which has really informed how I see where the world is headed. As an academic and as a scientist, I've been studying outbreaks my whole professional life.
Creating BlueDot was less about creating a business and more about creating a vehicle—
