Industry Committee on May 29th, 2020

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

On March 20, your office issued guidance on privacy and the COVID-19 outbreak, and stated that you will “protect the privacy of Canadians, while adopting a flexible and contextual approach in its application of the law”. What does the commissioner mean by “a flexible and contextual approach”?

[Daniel Therrien]

On the one hand, in our compliance activities, we have less frequent contact. We are giving departments more time to administer the law. That's the procedural side. On the substantive side, some concepts can be interpreted in a more flexible way in the current context.

[The Chair, Liberal, Sherry Romanado]

Thank you so much.

Our next round of questions goes to MP Longfield.

You have five minutes.

[Lloyd Longfield, Liberal, Guelph, ON]

Thank you.

Thank you, Mr. Therrien, for being with us today. You're giving us very important testimony.

I'm looking at the accountability principle. It mentions, “If effectiveness of the application cannot be demonstrated, it should be decommissioned and any personal information collected should be destroyed.” On the question of effectiveness, I spoke with an epidemiologist today who was saying, because of the long gestation period of this virus, it's very hard to determine whether tracing would be effective.

How would we look at effectiveness of tracing as an example?

[Daniel Therrien]

That's an excellent question.

No one is claiming that tracking applications are a panacea or a silver bullet, neither the privacy community nor public health authorities. However, it is quite conceivable that tracking applications could contribute to the solution and help identify people who have COVID-19. More traditional methods could then be used to contact them and provide them with advice on how to stay home.

Applications will therefore not necessarily be the solution as such, but they can contribute to it. This is a context where we are facing a completely new phenomenon.

Privacy principles say that you have to be able to demonstrate the effectiveness of the measure, but that does not mean that you have to demonstrate absolutely that the measure is going to be absolutely effective. This is perhaps, once again, where we could have a flexible and contextual approach.

What we're looking for is a scientific basis. We're not trying to prove the effectiveness of the measure beyond doubt. It's about demonstrating that it can be effective with other measures.

[Lloyd Longfield, Liberal, Guelph, ON]

That's very good. Thank you.

You mentioned public health. Of course, that's a concern with federal-provincial jurisdictions, and also transnational jurisdictions as people travel around the world.

I spoke with the Homewood Research Institute this week and we talked about the mental health apps that are out there. It has now developed a framework for measuring the effectiveness of mental health apps but is concerned about data and the protection of data, particularly on apps that might have been developed in other countries.

Do we have agreements internationally, or do we work with foreign-developed applications that would then have to meet Canadian regulations in order to be used in Canada? How do we share information across jurisdictions, either provincially or internationally?

[Daniel Therrien]

The protection of data on telemedicine applications or during the virtual provision of mental health advice, for example, is one of the reasons why we are of the opinion that the legal or statutory framework needs to be changed as soon as possible.

This does not mean that there is no law in force at the moment. Both public and private sector laws apply, but they are very deficient. I am not aware of any significant protections for confidential information that would be exchanged between patients and physicians.

[Lloyd Longfield, Liberal, Guelph, ON]

Thank you.

I think our judiciary would be interpreting laws as context changes, and those interpretations would then be applied to future rulings as well.

[Daniel Therrien]

Yes. It is a well-known and well-accepted method of statutory interpretation to consider the context and purpose of the measure.

[Lloyd Longfield, Liberal, Guelph, ON]

We're developing the digital strategy, the digital charter. I'm assuming you've been working extensively with the industry, science and technology groups around digital transitions.

Is it fair to say we're into that process, or has that process yet to begin? Would that process help us in terms of what you're now working on in the COVID-19 cases?

[Daniel Therrien]

We have had discussions on digital strategy with the government and with the Department of Industry, among others, but these meetings are very irregular. We share the objective of these measures, to make better use of data and to have digital government, but we are not particularly consulted on this issue.

I'll take you back to the fact that laws need to be modernized to reap the benefits of digital government.

[The Chair, Liberal, Sherry Romanado]

Thank you very much.

[Lloyd Longfield, Liberal, Guelph, ON]

Thank you.

[The Chair, Liberal, Sherry Romanado]

Our next round of questions goes to MP Dreeshen.

You have five minutes.

[Earl Dreeshen, Conservative, Red Deer—Mountain View, AB]

Thank you very much, Madam Chair.

We're certainly living in unprecedented times. That's true not only because of the impact of COVID-19 on the economy, but this pandemic has opened the door to unprecedented intrusion by governments into both the personal affairs and personal information of all Canadians.

Mr. Therrien, you mentioned in your remarks that what we need, more urgently than ever, are laws that allow technologies to produce benefits in the public interest without creating risks that fundamental rights, such as privacy, will be violated.

As you know, Parliament is essentially shut down at the moment, so who knows when it's going to return to the role of dealing with essential legislation—and, for that matter, why would it, when it's getting away with government-by-press-conferences? Yet, as has been noted, the current crisis heightens the need for law reform.

What are the dangers of moving forward with technologies such as contact tracing if stronger laws are not in place?

[Daniel Therrien]

I'll first talk about tracking applications, and then I'll come back to technology in a more general way.

As we explained, many of the principles we propose for tracking applications are currently not legally binding. This is the case, for example, with the principle that applications should only be used for tracking purposes in the name of public health. Nothing in the current legislation prevents a company from offering a tracking application and then using the information it obtains for commercial purposes. The only control that exists is the requirement to obtain consent under a privacy policy that we all know will be ambiguous.

I'll stop here regarding tracking applications to give you the opportunity to ask more questions.

[Earl Dreeshen, Conservative, Red Deer—Mountain View, AB]

I think part of it is that you have spoken in the past about the need for new laws and for us to get together to talk about it. I was on the privacy committee many years ago, when we were trying to make some changes. It's important for parliaments to be able to sit to deal with these types of things.

In terms of what you mentioned a few days ago, I'll just quote what you said: “I believe we have finally reached the point where the question of whether privacy legislation should be amended is behind us. The question before us now is how.” You mentioned how important it is for government to get on to this so that it has the legal framework to be able to work.

I want to give you an opportunity to emphasize how important getting the laws right, and getting them done right away, will be for Canada's privacy.

[Daniel Therrien]

I'll give some examples. Getting back to the tracking apps, I would say that a large part of the Canadian population will probably not be convinced that this information will be used properly, because people already don't trust the current legal framework. That in itself is a major problem. If the legal framework were more rigorous, it is quite possible, if not certain, that people would have more trust and would be willing to use this kind of application; they would see the public health benefit and would be less concerned about their privacy being violated.

Now let's move on to the issue of tracking applications.

The COVID-19 pandemic has caused the delivery of medical services, education and many other services to be delivered digitally and virtually. I think this will continue, although it may not be at the same pace as it is now.

These services are essential. Medical services, in particular, rely on confidential information protected by professional secrecy. Yet this data is currently exchanged on platforms with poor legal frameworks, giving people reason to fear that their confidential information will not be protected.

New technologies offer immense advantages. Just think of telemedicine or digital education. On the other hand, people's privacy needs to be protected by adequate laws.

[Earl Dreeshen, Conservative, Red Deer—Mountain View, AB]

Certainly. Thank you.

My time is just about up, but I certainly want to mention that if you look at Internet reliability in rural Canada, it's about one-eleventh as reliable as it is in urban Canada. That makes it very difficult.

Thank you very much, Madam Chair.

[The Chair, Liberal, Sherry Romanado]

Thank you very much, MP Dreeshen.

Our next round of questions goes to MP Jowhari.

You have the floor for five minutes.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Thank you, Madam Chair.

Thank you, Mr. Therrien.

Mr. Therrien, on May 7 of this year, the Privacy Commissioner of Canada and your provincial and territorial counterparts issued a joint statement in which you urged all levels of government to respect the privacy principles.

First of all, let me thank you for the great work that you and your department and your counterparts are doing on this front. I understand the federal government hasn't decided on any contact tracing. Have any of your provincial counterparts decided, or are they close to any decision, on a contact-tracing application?

[Daniel Therrien]

I may be out of date. Certainly in Alberta an application has been in place for some time now.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Okay, great. Thank you. I was hoping you would say that.

Given the fact that Alberta has chosen to proceed with it, can you give us an insight into the alignment of the privacy criteria you have developed with the application features? Does this application meet those privacy requirements?

[Daniel Therrien]

The compliance with privacy laws of the application used in Alberta is currently under review by my provincial colleague, Jill Clayton. This issue is therefore on hold.

I would say, very summarily, that there is certainly an alignment of the conditions of use of this application with some of our principles, including the voluntary side. Consent is also required for the use of this application in Alberta. So one of our principles is being applied. Are they all? I will leave it to my colleague from Alberta to judge that.

[Majid Jowhari, Liberal, Richmond Hill, ON]

That's great.

Vis-à-vis Alberta, do you know the adoption rate in the province for that application?