Industry Committee on May 29th, 2020

[Prof. Teresa Scassa]

COVID-19 is a wake-up call in many respects. Essentially, it has caught us with our privacy pants down. We need to have the digital legal infrastructure in place so that we can respond to situations as they come up. We find ourselves in this situation with outdated privacy laws for the public and private sectors, and this is a disadvantage.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thank you very much.

Since today we're really here to talk about a contact-tracing app that is potentially being developed, what are your thoughts specifically with regard to this contact-tracing app? Where do we draw the line between protecting the privacy of Canadians and the greater good of Canada's public health?

[Prof. Teresa Scassa]

That's an interesting question, because no two contact-tracing apps are created equal.

There are contact-tracing apps that focus on collecting only data about proximity of devices. There are contact-tracing apps that also collect GPS data, which could be useful to public health authorities in determining where there are outbreaks. As well, there are contact-tracing apps that are going to ask users to input symptoms and so on, and may use AI to provide analytics to supplement the lack of testing that we have. This is a very broad range of data collection. They are very different apps with different goals, and I think talking about contact-tracing apps in the abstract is really problematic and very challenging for Canadians.

I've seen surveys asking Canadians if they are in favour of or opposed to contact-tracing apps, but nobody knows what we're talking about. This is part of the issue of transparency. We have to be very clear about what our goals are, what kind of information we're planning to collect to serve what purposes, before people can really meaningfully engage with whether this is a good thing and something that people want to participate in.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Do you think at any point it is okay for these apps to be mandatory and not opt-in, and what is that point?

[Prof. Teresa Scassa]

There are two things. One is, for a general national contact-tracing app, we've already heard about the challenges with making that mandatory. There are serious civil liberty issues with forcing people to carry their cellphones everywhere and have them running these apps in the background.

The new wave that I alluded to in my comments, and it's coming very fast, is going to be mandatory contact-tracing apps in workplaces. People will be going back to workplaces where the employer says, “You must use this contact-tracing app if you want to be part of this workplace.” That may be necessary to prevent major outbreaks of disease or control them within workplaces, and we've certainly seen this as an issue, but those apps are likely to be mandatory.

In addition to these debates about the national contact-tracing app, we need to start thinking about what the boundaries and parameters should be for these mandatory workplace apps that are coming.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

I know that Mr. Bryant actually pointed this out earlier, or gave his opinion on this earlier. Do you think this type of app, or any contact-tracing app, is an effective way of making sure that we don't spread this type of virus, specifically given the qualities of COVID-19 and its symptoms and the way people can carry and spread the virus?

[Prof. Teresa Scassa]

Effectiveness really depends on what the goals are. If the goals are to replace human contact tracing, I don't think it will be effective. If the goals are to support or supplement it, depending on the design, possibly there will be some usefulness there.

If the goals are to actually collect, indirectly, data that can be used in analytics for disease modelling, then maybe there will be some useful data collected, but that's a different message that needs to be sent to Canadians.

I think that understanding what it is we're talking about and what the goals are for using such an app is really important.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Okay.

I saw the yellow flag, so I imagine I have less than 20 seconds left.

Thank you very much for your time.

[The Chair, Liberal, Sherry Romanado]

Thank you very much.

The member for Abitibi-Témiscamingue will be the first speaker in the next round.

Mr. Lemire, you have the floor for six minutes.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Madam Chair.

My first question is for Ms. Scassa.

I think the most important question to answer is, who does the data belong to?

Should the data of a COVID-19 positive case belong to the individual, since it is his or her medical record and he or she has a right to privacy, or should it belong to the state, in order to limit the spread of the pandemic?

[Prof. Teresa Scassa]

The question of ownership of data, the language of ownership, can be a bit problematic or misleading in this context. In the Canadian approach, we've always talked about interests in data. We recognize that there can be multiple interests in data. A private sector company that collects data has an interest in the data they collect. The individual they collect it from has an interest in that data, and there may be other interests.

It's the same with personal health information. The health system has an interest in data collected through the medical system, for a variety of purposes, and the individual has an interest in that data.

The GDPR is a model that pushes us much more towards.... Well, it strengthens those interests. It doesn't assign ownership of data either, but it does provide for stronger interests on the part of the individual. Right now, I think we're in a data protection framework, particularly at the private sector level, that gives individuals considerably less interest in or control of their data than you would see in the European context.

I think that in all cases it's really a matter of interests, and you can have multiple interests in the same data.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Bryant, in your opinion, should the data relating to a positive COVID-19 case belong to the medical file, and therefore to the individual, or should it belong to the state in order to limit the spread of the virus?

[Michael Bryant]

It would belong to the person, and I would argue against it belonging to the state at this time. There's no evidence to suggest that once having that information.... I should say at the outset that I agree with everything Professor Scassa said and will say, and you can hold me to that.

First, the discussion about this turns in part on centralized systems versus decentralized systems. Germany started out arguing for a centralized system and ended up arguing for a decentralized system that gave people control over their information. I think that information about a person belongs to that person; it doesn't belong to the state. The state may have some interest in it, as the professor said, but we need to start with trusting people.

Second, the state may play a role in incentivizing people to share that information. However, only once every other mean has been exhausted should the state ever consider trying to take ownership over that information.

We talk a lot about what is mandatory and not mandatory in Canada. It's extraordinary to me that this country has come to that. Very little about the incentivizing that can take place can get even greater compliance. This is compliance with the use of the contact-tracing apps, compliance with respect to reporting and compliance with respect to self-quarantining. Sure, I guess you could use a stick to try to get people to do it, but I would argue it's going to be ineffective. People won't use it; it will be avoided. The alternative is to provide incentives for that.

In the United States, an economist at The University of Chicago talks about how much money would be saved if governments paid people to comply, to self-isolate and to get tested every week, for example, or created some incentive so that when people participate in it, they get some kind of a benefit. It might end up being a lottery, with, in essence, a pandemic lottery ticket. We're talking about the author of Freakonomics. I think it's safe to say that economists at The University of Chicago can be respected and taken seriously.

The idea is to try to internalize the externalities. We should be doing more of that in allowing people to take the information they own and use it in a way that aligns with what the state wants from them.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Bryant.

That was indeed a complete answer. It shows me how much responsibility we as parliamentarians and legislators really have in this situation. It's not for private enterprise to make the decision for us.

I'll give the floor to Ms. Gaudreau for a question.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

My question is for Mr. Bryant. We know our laws are outdated; we ask companies where our data is and what they do with it.

We make everything anonymous, as Ms. Scassa mentioned, and we legislate specifically for one application. What do you think of that in the context of a pandemic, in the context of an emergency?

[Michael Bryant]

I don't want any of my previous comments to suggest that the work to be done on privacy legislation should not take place.

[The Chair, Liberal, Sherry Romanado]

Could you wrap up really quickly?

[Michael Bryant]

Yes.

Draft the laws. Start debating the laws. Make them public. Have a conversation with the public about them. But I would not take them to the legislature in the middle of a pandemic.

[The Chair, Liberal, Sherry Romanado]

Thank you very much.

Our next round of questions goes to MP Masse.

You have six minutes.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Madam Chair, and again, thank you to the witnesses. My question will be for both witnesses.

I represent Windsor, Ontario, and it's right across from Detroit, Michigan, where there's a significant outbreak—amongst the highest in the world, really. In regular times, when we have international movement.... I'll use the river that separates us as an example, and the fish. You can tell the fish they're supposed to be on the American side or the Canadian side, but they don't listen; they'll go back and forth.

What I see happening with some of the discussions taking place with contact and data tracing is that we have a global pandemic, yet we have many pockets of contact tracing going on, with an attempt to protect personal privacy, as well as ensure confidence in the management of the system and so forth.

I'm just wondering if you have any comments about the value of it, given the fact that it is a global pandemic. We have people in our own country, now as it is, with multiple platforms on their cell and mobile information-sharing devices; and then potentially we have other factors of foreign visitation, even during the worst of times, that are still happening.

We also have essential workers travelling back and forth. Normally, in Windsor here there are 10,000 trucks a day and 30,000 vehicles. It's down significantly, but it's still in the thousands of vehicles.

I'm just curious as to the data that we'll get from this and given the fact that it seems to be compartmentalized amongst different countries.

Maybe, Mr. Bryant, you could go first.

[Michael Bryant]

Thank you.

I confess that I'm not sure I understood your question, but I'm going to take my best shot at addressing it.

I would agree, if I understand you correctly, that there are just so many different ways in which the virus is being fed, many of which we don't even know, and some of which, yes, continue to arise from people from other jurisdictions, and much of it, as you mentioned, being found in larger urban centres. For example, in Ontario it's more so that Windsor, Toronto, London and Ottawa continue to have a pandemic crisis, and in much of the rest of the province, there's really not so much.

In that sense, the context in which contact tracing, for example, would be useful and helpful may be quite limited in urban centres—extremely limited—and at this stage possibly useless. That's not to say that down the line it would not be useful in those regions where there's a very small population, and that's a way in which to keep the virus from spreading at all.

The way in which this virus is going to be reduced by way of contact-tracing apps in urban centres.... There may be a correlation, but I don't know if we'll be able to say, oh, this caused that. On the other hand, in smaller populations it may be otherwise.

I'm going to let the professor take it from here.

[Prof. Teresa Scassa]

Thank you.

I was just reading about how Northern Ireland, which is part of the U.K., has declined to implement the U.K. contact-tracing app in favour of adopting a solution that's compatible with the Republic of Ireland, with which they share an island, because that's their choice. They're thinking in terms of where their people are travelling and where their people are moving.

I think we started off small for a while. Ottawa Public Health was talking about adopting a contact-tracing app at a time when nobody was leaving Ottawa, we were all staying home, and that's where we needed an app. But now we're going to start opening things up and we need an Ontario app.

When Alberta adopted its app, the push-back, which I think you are feeling right now as parliamentarians, was that we needed a national solution, because as soon as we start opening things up people are going to be travelling across the country. If you don't have something that works across borders, then it's not going to be particularly useful, especially, of course, here in Ottawa where we share a border with Quebec and people travel back and forth all the time.

I think as our circumstances change so does the vision of what we have to deal with, which has an impact on what technology we adopt. This is all moving so quickly that I think it's been hard to adapt and respond to it. Again, I'm going to make a plug for thinking about the next thing, which is workplace employment contact tracing. I think this is the big wave that's coming and I think it's going to be a really important one.

[Brian Masse, NDP, Windsor West, ON]

That's actually really good.

I only have a few seconds, so really quickly, with that, would it make sense, then, if we are going down this road, to almost, again, have it like a specific bond or agreement between the employer and the person, and in the second event, between the country and the person, or is it just an overall country policy?

I'll leave it at that, because there's no time.

[Prof. Teresa Scassa]

Perhaps I can respond very quickly. With workplaces, I think we're going to have to be looking at PIPEDA, and we're going to be looking at provincial laws to the extent that they're applicable in Alberta, B.C. or Quebec. That's where we're going to have to look for solutions, and I don't think there are particularly good ones right now.

[The Chair, Liberal, Sherry Romanado]

Thank you very much.

Our next round of questions goes to MP Patzer.

You have the floor for five minutes.