Evidence of meeting #19 for Industry, Science and Technology in the 43rd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A recording is available from Parliament.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'm afraid not.
Liberal
Majid Jowhari Liberal Richmond Hill, ON
Okay.
How do you feel we would be able to achieve an adoption rate of anywhere from 60% to 80% without an opt-out model?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That's an excellent question. Adoption rates in many territories are around 20%. Even if an application were mandatory, there would be ways for the population to get around that, such as not using a phone. This brings us back to reality. In my opinion, there has to be a voluntary side to the use of the application.
In this context, how do we increase the adoption rate? It would be by having conditions that foster trust. We need a system where privacy principles are accepted. I think transparency is also very important.
Liberal
Majid Jowhari Liberal Richmond Hill, ON
Thank you. I have about two minutes left.
I want to go into the ownership of the data. As you know, there are discussions around centralized and decentralized models. What are your thoughts around the ownership and scope of the data that's being gathered, during and after the COVID-19 pandemic?
Could you make it brief, because I have a follow-up question?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
In general, decentralized systems provide better privacy protection. Having said that, we are not opposed to some centralized aspects, as long as the data is deemed necessary by a public health authority, such as knowing where the outbreaks are.
Liberal
Majid Jowhari Liberal Richmond Hill, ON
That's perfect. Thank you.
In terms of deeming what data is necessary, as we are trying to move to the next stage, which is the predictive model that could help with wave two and wave three, don't you believe that maintaining a larger scope of data, as well as maintaining the data much longer, would give us a much stronger ability to do the analytics we need in order to get to that predictive model?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The higher the adoption rate, the better for efficiency and data analysis. I agree with that.
In terms of the time during which the application will be used, one must realize that we are talking about particularly sensitive data that would not normally be collected. I'm not sure I agree with the use of this data over a long period of time.
Liberal
The Chair Liberal Sherry Romanado
Thank you very much.
Mr. Savard-Tremblay, it's your turn, and you have two and a half minutes.
Bloc
Simon-Pierre Savard-Tremblay Bloc Saint-Hyacinthe—Bagot, QC
Thank you, Madam Chair.
Thank you too, Commissioner.
You spoke of the weaknesses in the law. You said there were gaps in the law and that things could be changed. There are provincial laws. Shouldn't we just rely on them?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Data is moved around between administrations and between countries. Therefore, there is a need for strong laws in all jurisdictions, including the federal government. This is a factor that cannot be ignored.
Bloc
Simon-Pierre Savard-Tremblay Bloc Saint-Hyacinthe—Bagot, QC
Could you tell us a little bit more about the legislative changes that could be made? You say it could be in all jurisdictions. So you're not against the idea of provincial legislation as well. I would imagine it would be a federal law that would be more focused on coordination than subordination.
I'd still like to hear what you have to say about any changes that might be made.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
For the past few years, we have been proposing rights-based federal legislative reform. The principles of our assessment framework have been taken up in large part in our joint statement with our provincial colleagues. We are therefore talking about such principles, which are generally not in current federal law. They are a little more present in some provincial legislation, including the Quebec legislation, which contains the principle of necessity. However, according to my colleagues, provincial legislation also needs to be amended.
So we're basically talking about the principles set out in the joint statement, which should have the force of law, not only in my view, as a federal actor, but also in the view of my provincial colleagues.
Bloc
Simon-Pierre Savard-Tremblay Bloc Saint-Hyacinthe—Bagot, QC
That's perfect, thank you.
Madam Chair, how much time do I have left?
Bloc
Simon-Pierre Savard-Tremblay Bloc Saint-Hyacinthe—Bagot, QC
I don't think I'll have time, in 25 seconds, to—
Bloc
Sébastien Lemire Bloc Abitibi—Témiscamingue, QC
Let me jump in and ask a question.
In concrete terms, to whom does medical data, such as a positive result to a COVID-19 test, belong? To the individual, or to the state?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I don't think property law concepts are so applicable here. It's clear that privacy rights seek to give individuals significant control over their information, including their health information, although it may not be a proprietary right.
That being said, if an authority—
Liberal
The Chair Liberal Sherry Romanado
I'm sorry, Mr. Therrien, but that concludes this round of questions. We'll move on to the next one.
Mr. Masse, you have the floor for two and a half minutes.
NDP
Brian Masse NDP Windsor West, ON
Thank you, Madam Chair.
I want to go back a little bit on process. Early on, I was approached by a company that does contact tracing through malls and shopping. The way it works is that the government set up a process to stream any of those companies interested in doing work with the government through three portals of Industry Canada. It is actually a good model and it has done some great work.
Now, I don't know what happened with regard to that file, but from what I understand, there really hasn't been any follow-up with you or your office. It's been more than a month now, or closer to two months, and there hasn't been any robust discussion, which I want to confirm, about creating an app or maybe potentially screening any potential partnership with a company for a public-private partnership. I think part of what we would need satisfaction with, in order to ensure Canadians' privacy, would be that the company we're doing a partnership with would also go through a screening.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Are you talking about a contact-tracing app?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The only tracking application for which we were consulted in detail was Mila's in Montreal.
The federal government has no legal obligation to consult us. We offered our services. The government may have decided not to do business with the company in question, in which case it does not have to consult us, of course. We have offered our services and it is up to the government to accept them or not. The only application for which we were consulted was the Mila.
NDP
Brian Masse NDP Windsor West, ON
Do you have any personal or professional feelings—more the professional feelings, I guess—about either a non-government agency like China or a private equity fund, where we have no idea who owns the company, working with Canadians' private data, versus a Canadian company with a Canadian app?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
There are gaps in the law. If data are to be properly protected in the current deficient framework, the trust that must be placed in the company becomes a particularly important factor. We should therefore stay away from less trustworthy companies, obviously.
Liberal
The Chair Liberal Sherry Romanado
Thank you very much.
Unfortunately, that is all the time we have for this first panel.
With that, I will thank the Privacy Commissioner.
I thank you very much for your presence and for your testimony.