Information & Ethics Committee on Feb. 17th, 2022

[Pamela Snively]

It might be more relevant for me to say, actually, what they weren't able to see. That would be any information about any identifiable individual. The way the platform works is more query-based. It's not as though they go on and see a bunch of data. What they're able to do is develop queries and get back information and insights drawn from that de-identified data. That might be a clearer way of describing what they would see when they would come onto the platform.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Hypothetically, the government could then ask.... Let's say there was a sporting event, or they could look at grocery stores or movement during a certain time of the day. Those are three hypotheticals, but those are the sorts of queries that the government would be able to make of the system and the data set.

[Pamela Snively]

Perhaps you could clarify your question. If you're looking for movement during a particular sporting event, yes, but not in real time. One of the controls that we have on the platform is not to provide any real-time data, because that increases the risk of reidentifiability to something. It would no longer be considered de-identified.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I'm out of time, so maybe I'll follow up again later, but thank you for answering the question.

[The Chair, Conservative, Pat Kelly]

Thank you. Now we have Ms. Saks for six minutes.

[Ya'ara Saks, Liberal, York Centre, ON]

Thank you, Mr. Chair, and thank you to our witness today. I look forward to hearing your answers to some of my questions.

I listened to your opening statement, and I've also heard from Dr. Ann Cavoukian, who was recently here. She raved about how well-developed the Telus Insights offering is, and being built by privacy by design at the forefront of this platform, your work sounds critical in offering insights that go beyond in protecting any identifying data.

From what I understand, PHAC never had access to any personal information. How did you make sure they did not have access to this personal information? This is my first question. Then I'd like to ask how privacy by design protects privacy, and since you do have the certification, how rigorous was that process?

[Pamela Snively]

Thank you very much for those questions.

To ensure that PHAC or others on the platform do not have access to personal information, we went through a very rigorous process. It actually took years to build the Insights platform to be what we wanted it to be. We realized years ago that there could be tremendous value in this de-identified network mobility data. We're talking about the pings that devices make off of the cell towers as they move about the network. If we could de-identify those pings and just look at the movement patterns, there were a number of “social good” uses that we could immediately see, with tremendous value, and we've seen that borne out during this pandemic.

We consulted with leading de-identification experts and spent a tremendous amount of time building the technical platform and the technical rules to de-identify the data and strip the identifiers, but we went far beyond that to rules around the way the queries are made and controls on the frequency with which queries are made, as well as considerations of geography and aggregation. There were a number of different technical and statistical controls, and then on top of that we put in administrative controls.

I talked earlier about the guided and supervised access. That's another administrative control that we have in place whereby we're actually supervising what is happening on the platform and reviewing what is taken from the platform, as well as strict contractual controls prohibiting reidentification. Those are some of the ways we control and make sure that we have reduced the reidentification risk to a very small risk.

In terms of the privacy by design certification, I'm glad you asked about that. We're really proud of that certification. It is a very rigorous process. Our most recent privacy by design certification for the platform was just before COVID, so it was excellent timing for the launch of Data for Good. It took over four months to conduct. It's conducted by a fully independent external audit group.

There are seven privacy by design principles. Those turn into 30 privacy and security criteria, and then into 94 different controls that are illustrative of our meeting those criteria and principles. It took, as I say, about four months. They complete that report, and then they have to take it to an independent accreditation board to have it independently reviewed before we can be certified.

[Ya'ara Saks, Liberal, York Centre, ON]

In other words, it was an extremely rigorous process and a priority before PHAC could even access any of the data on the platform in a supervised fashion.

[Pamela Snively]

That's correct.

[Ya'ara Saks, Liberal, York Centre, ON]

Mr. Chair, how much time do I have?

[The Chair, Conservative, Pat Kelly]

You have almost two minutes.

[Ya'ara Saks, Liberal, York Centre, ON]

The intent of Telus' Data for Good and the program was to help PHAC understand and fight this pandemic. From where I'm sitting, it sounds to me that tremendous care has been taken by Telus's Data for Good to make sure the data is de-identified, which certainly is reassuring to me and is reassuring to Canadians now that you've just described the very rigorous process for certification.

From what I understand, the data that was collected from Telus's Data for Good was supervised and reviewed before it was released. It was then posted each week on PHAC's website, so there was a level of transparency with Canadians of this data, which I think also seems very beneficial as we communicate with the public why this information is so important in managing the pandemic and using data as a tool.

Can you speak to how the Data for Good program supported the COVID 19 response from your perspective of being engaged in this search process with PHAC?

[Pamela Snively]

I'm not privy to all of the uses to which the data was put. We have a record of them, but I don't know them all personally.

We heard Dr. Tam speak earlier about how valuable it had been to have mobility data and be able to layer that in with epidemiological data, similar to what Dr. Khan was speaking about earlier as well, and to be able to map what had gone on with the contagion and to make predictions about where it might go and be proactive, Dr. Khan said, as well as reactive.

It was also possible to look at the impact of different restrictions and policies to see how effective they were. As we all know, at the outset of the pandemic, a number of different restrictions were placed on us that we hadn't experienced before. We were able to see, by looking at these large-scale movements and trends in patterns, whether or not they were effective in curbing movement.

[Ya'ara Saks, Liberal, York Centre, ON]

May I ask a yes-or-no question?

[The Chair, Conservative, Pat Kelly]

No, we're way over time.

We now give the floor to Mr. Villemure for six minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Good afternoon, Ms. Snively.

I have two questions for you. We will try to get them answered in six minutes.

How did you get users' consent to collect their data?

[Pamela Snively]

The data that this is based off of at the point of collection is collected in the course of providing mobility services, so that consent is applied to its use for mobility services and to provide mobility services; however, when we de-identified the data, it was no longer personal information about our customers.

Rather than relying on consent there, what we relied upon was ensuring that we had de-identified it. Our focus was to ensure that we had protected our customers' privacy and that we were transparent and clear about our use of that data.

[René Villemure, Bloc, Trois-Rivières, QC]

So you did not get users' consent.

[Pamela Snively]

We did not obtain user consent for this specific purpose. This was not personal information; this was de-identified information, so the information was de-identified and then shared for these purposes.

[René Villemure, Bloc, Trois-Rivières, QC]

Before being de–identified, that data was personal information.

[Pamela Snively]

Yes, it was. Before it goes through the transformation, it's personal information.

[René Villemure, Bloc, Trois-Rivières, QC]

Okay.

I assume it is normal for a Telus user to expect the company to use their information to improve its service. I understand that. However, I am not sure they expect this information to be used for other purposes.

What are your thoughts on that?

[Pamela Snively]

I think it's challenging to know what anyone expects.

I want to be clear that there's a very critical distinction between personal information and de-identified information. For personal information, we're very focused on consent and the privacy implications, but when it comes to de-identification, the de-identification process itself is what protects privacy. That's our focus there, and that's how we protect our customers' privacy on that front.

When it remains in personal format, our focus might be more on consent. That's generally the primary driver in our current legislation.

[René Villemure, Bloc, Trois-Rivières, QC]

Do users consent to having their information de–identified?

[Pamela Snively]

We have a lot of information in our privacy policy and on our website about de-identification. In terms of all of the various uses and the concept of implied consent under our legislation, although under our legislation it's not generally considered that consent is required. We're very transparent about that. We have, I would say, more information than most organizations might have. We have a lot of information about how de-identification works, why we use it, how it protects privacy, and then more information about how we use data that has been de-identified for analytics purposes.