Industry Committee on May 29th, 2020

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

That's fine.

[Daniel Therrien]

The government hasn't consulted us regarding any tracing applications as such. People from the government put us in touch with members of the Mila research institute. We've given advice to people from this institute, upon their request, regarding their application's compliance with federal legislation. However, we haven't had any discussions with the government and we haven't had to give the government advice regarding an application or the applicable legal framework. This doesn't mean that we won't be approached.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Has the government given you any indication that they intend to accept the framework that you have recommended with regard to a privacy framework needed prior to a contact-tracing app being recommended by the federal government?

[Daniel Therrien]

We discussed the framework for tracing applications with government officials. They told us that they want to work within this framework. However, they reminded us that our assessment framework went beyond the current legislation in some respects, which is true, and that, ultimately, the government would need to comply with the legislation. They implied that some of the principles in our assessment framework may not be enforced because these principles went beyond the current legislation.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Mr. Therrien, given that you've spoken out about the lack of strength in Canada's privacy law as it stands, do you feel that it would be accurate to say that if a government strongly recommends the use of any contact-tracing application at present, Canadians would be asked to choose between their privacy and public health outcomes?

[Daniel Therrien]

I wouldn't go that far. I'd say that the legal framework should be improved, particularly in the context of COVID-19. As we said in our presentation, it's reasonable to believe that an application designed properly according to the principle of privacy, which we've argued for, can properly protect privacy while protecting public health. The legislation should be amended, but—

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Given that the Prime Minister has said that he's about to strongly recommend a contact-tracing application, how confident are you right now that any application that's developed would be delivered in that ideal world you just spoke about, with stronger legislation for privacy?

[Daniel Therrien]

I think it may be a little too early to draw conclusions. It would depend on how the application in question is designed. Again, the government hasn't directly consulted us regarding any application. However, we'll be able to answer your question once we've had the chance to look at the design of the proposed application.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Are you concerned that the government hasn't contacted you proactively with regard to this? One would think they should be proactively working with your office, if the design is contingent upon privacy laws being respected in Canada, as you just put it.

Is the design contingent upon privacy laws being respected?

[Daniel Therrien]

We offered our services. Of course, it would have been better if the government had already started consulting us regarding the design of an application. We're hearing officials and ministers talk about the number of stakeholders involved, including the provinces. The government may not yet be ready to consult us.

[The Chair, Liberal, Sherry Romanado]

Mr. Therrien, sorry, but we're out of time for this round of questions.

We will now move to MP Erskine-Smith.

You have the floor for six minutes.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thanks very much.

Commissioner, it's very good to see you again. I too believe that the government should proactively consult with you in the development of these applications, and certainly so, as the government is leading the way, in partnership with the provinces, in the development of them. I think it's really important.

I want to ask about the principles you espouse. When I go down the list, I agree with almost every single one. I look to the purpose limitation, and of course that makes sense. I look to the idea that the collection of data has to be necessary and proportionate to the matter at hand, and that of course should be a key restriction. I agree there has to be a clear legal basis, and I want to get back to that. I agree with a time limitation, as well as with transparency, accountability and oversight. I think your office should be involved in oversight.

You talk about the need for a clear legal basis. In your joint statement with other privacy commissioners, and then again here today, you have indicated that it should be consent-based and entirely voluntary.

I wonder what you think about opt-in versus opt-out. If we didn't have an opt-out system and were only looking at opt-in, would opt-out be sufficient in the circumstance where if we didn't have an opt-out system and were only looking at opt-in we couldn't get the adoption rate necessary for the system to work at all?

[Daniel Therrien]

To be clear, in your question you've correctly put the question of legal basis, consent and voluntariness.

Under the Personal Information Protection and Electronic Documents Act, consent is required.

However, if the application is used by provincial governments, such as provincial public health authorities, consent may not be legally required. That said, my provincial commissioner colleagues and I are recommending consent—so it will be voluntary—mainly to boost people's trust in the application. People may not trust an application that doesn't let them choose whether or not to give consent.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I agree that there needs to be trust, and it think it should preserve privacy in every possible way. I agree with the principles you have put forward. However, as it relates to protocols, whether it is the DP-3T or the TCN, I think there are other ways we can preserve privacy.

I do wonder, though. In your statement you said that de-identified or aggregate data should be used whenever possible, unless it will not achieve the defined purpose. If I take that same approach, then we're going to abide by these ideas unless we have to say, on balance, that in the public interest overall, the app won't achieve the defined purpose if we have an opt-in system only. If, instead, an opt-out system would get the adoption rates we need, would you be opposed to that?

[Daniel Therrien]

I'm not sure how that works in practice.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I asked Google, as an example, at our committee the other day if the app could be put on individuals' phones by way of an OS update and if people would have the choice of whether or not to do that, but it would be effectively automatic and then people could choose to opt out. That could be one way of doing it.

[Daniel Therrien]

Basically, people will have the choice to travel, to move around in society, with or without a telephone. This brings us back to the fact that, in practice, if not legally, it seems that the voluntary use of the application and consent are necessary. They are also necessary to create a certain level of trust.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Because I have only a few minutes left, can you give our committee an update on your efforts to take Facebook to court?

[Daniel Therrien]

Yes, I'll have to be careful, obviously, because we are before the Federal Court on this issue.

After completing the investigation report in spring 2019, we took the matter to the Federal Court of Canada in early 2020. We basically asked the Federal Court to order Facebook to comply with our recommendations.

As you know, under the current legislation, we don't have the power to require Facebook to accept our recommendations. That's why we took our request to the Federal Court in early 2020.

Facebook decided to file a motion to quash our request in Federal Court. Our request that the Federal Court order Facebook to comply with our recommendations and Facebook's motion to quash our efforts are therefore currently before the court.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I'm running out of time, Mr. Therrien.

I previously indicated that I thought Facebook was breaking the law. They denied it, and it turns out that they did, in your view, certainly. I think that will be the view of the Federal Court.

I take the same view of Clearview AI and I encourage you to bring the full efforts of your office to bear against Clearview AI, which has clearly broken the law of Canada in relation to our privacy laws.

Thanks very much.

[Daniel Therrien]

Thank you.

[The Chair, Liberal, Sherry Romanado]

Thank you. We will have our next round of questions.

Ms. Gaudreau, you have six minutes.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Good afternoon, Mr. Therrien. I'm very pleased to be hearing from you today.

[Daniel Therrien]

Good afternoon.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

I'm very concerned about the public health and privacy challenge that we're facing.

I'm also a member of the Standing Committee on Access to Information, Privacy and Ethics. I'm very concerned about the possibility that any company could propose applications at this time.

We know that there are ways to anonymize and aggregate all the data.

That said, what specific legal foundations should we, as legislators, be prioritizing right now in this health emergency?