Evidence of meeting #19 for Industry, Science and Technology in the 43rd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A recording is available from Parliament.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Thank you very much.
Liberal
The Chair Liberal Sherry Romanado
We will suspend quickly so we can switch out the panel.
Thank you.
Liberal
The Chair Liberal Sherry Romanado
We will now resume for the second panel.
With us for the second panel, we have Professor Teresa Scassa, the Canada research chair in information law and policy at the University of Ottawa; and Mr. Michael Bryant from the Canadian Civil Liberties Association.
We will start with presentations for five minutes each, followed by rounds of questions.
I will just remind the witnesses that if they see the yellow card, that means they have 30 seconds remaining. The red card means that the time is up.
With that, I will turn the floor over to Professor Scassa.
You have five minutes, please.
Prof. Teresa Scassa Canada Research Chair in Information Law and Policy, Faculty of Law, Common Law Section, University of Ottawa, As an Individual
Thank you, Madam Chair and committee members, for the opportunity to address this committee on privacy in Canada's COVID-19 response.
We're currently in a situation in which Canadians are very vulnerable economically, socially and in terms of their physical and mental health. Canadians know that sacrifices are necessary to address this crisis and have already made sacrifices of different magnitudes. Most Canadians accept that this is necessary to save lives and begin to return to normal. They accept that some degree of privacy may need to be sacrificed in some contexts, but there is no binary choice between privacy and no privacy. Instead, there must be a careful balancing of privacy with other public interests.
There are two overarching privacy concerns when it comes to Canada's response to the pandemic. The first is that there's a risk that poorly thought-out collection, use or disclosure of personal information will create privacy and security vulnerabilities with little real benefit, or with benefits disproportionate to risks and harms. The second is that the pandemic may lead to the introduction of data gathering or processing technologies that will create a new normal, leading to even greater inroads on privacy, dignity and autonomy. Importantly, surveillance often has the most significant adverse impacts on the most vulnerable in our society.
The pandemic context raises a broad range of privacy issues, from government or law enforcement access to location and personal health information to contact-tracing apps and beyond. As we begin the return to normal, we will also see issues of workplace surveillance as well as tracking tools and technologies used to help determine who gets into stores, who receives services or who gets on airplanes. Personal health information, generally considered to be among our most sensitive information, may become a currency we're required to use in order to carry out ordinary daily activities.
Since time is limited, I'd like to tease out three main themes. The first theme is trust. Trust is referenced in the digital charter and is essential when asking Canadians to share personal information with the government, but trust is complicated by a pandemic context in which issues evolve rapidly and are often unprecedented. One thing that trust requires is transparency, and governments have struggled with transparency, whether it's with respect to sharing data that models the spread of COVID-19 with the public or, as was the case with Alberta, launching a contact-tracing app without releasing a privacy impact assessment. Transparency is essential to trust.
The second theme is necessity and proportionality. The Privacy Commissioner of Canada, along with his provincial and territorial counterparts, supports an approach to privacy based on necessity and proportionality. This is derived from the human rights context. Necessity and proportionality provide a robust analytical framework for balancing privacy rights against other public interests and should already be part of an amended Privacy Act.
The importance of this approach cannot be overemphasized. We are in a data-driven society. It's easy to become enthused about technological solutions, and innovators promise that data analytics, including AI, can solve many of our problems. We need to remember that while technology can provide astonishing benefits, there is already a long history of poorly designed, poorly implemented and often rushed technological solutions that have created significant risks and harms. Novel technological solutions often fail. This is becoming a reality, for example, with many recently launched national contact-tracing apps. Rushed, flawed schemes to harvest personal data, even if for laudable goals, will erode trust at best and cause harm at worst. This is why clear guidelines, such as those developed by the commissioners, are crucial. There should be an emphasis on purpose and time-limited solutions that minimize privacy impacts.
The third theme is human rights. Privacy is closely tied to human rights, but this relationship is increasingly complex in a data-driven society. Privacy laws govern data collection, use and disclosure, and it's increasingly common for data uses to have significant impacts on human rights and civil liberties, including freedom of association, freedom of speech and the right to be free from discrimination.
Until recently, public conversations about contact tracing have been predominantly about government-adopted apps to deal with public health and disease tracking. As businesses reopen and people go back to work, the conversation will shift to contact tracing and disease monitoring in the private sector, including the possible use of so-called immunity passports. We will see workplace surveillance technologies, as well as technologies that might be used to limit who can enter retail stores, who can access services, who can get on airplanes and so on.
While there are obviously serious public health and safety issues here, as well as issues important to economic recovery and the ability of people to return to work, there is also significant potential for harm, abuse and injustice. Much of this private sector surveillance will be in areas under provincial jurisdiction, but by no means all of it. The federal government must play a leadership role in setting standards and imposing limitations.
I'll end my remarks here. I look forward to your questions.
Liberal
The Chair Liberal Sherry Romanado
Thank you very much, Professor Scassa.
Our next presentation is by Mr. Bryant. You have the floor for five minutes.
Michael Bryant Executive Director and General Counsel, Canadian Civil Liberties Association
Good morning, Madam Chair; thank you very much.
Thank you all for being here this afternoon.
You will be glad to hear that that's the end of my French. My kids will be glad to hear it anyway. They're bilingual and obviously I'm not.
I've provided some speaking notes, which I hope all the committee members have. If they don't, I'll send another copy to the clerk.
It's a letter that I and Brenda McPhail of the Canadian Civil Liberties Association wrote to the Prime Minister and first ministers on April 20. We've set out a set of principles that would apply not to private sector apps per se or private sector technology and contact tracing per se, but to any requirement under provincial or federal law that would mandate the use of some technology. Hopefully that may be a very narrow category, but that's where, as lawmakers, we feel there's a process and some principles that apply. We may discuss them, but it's listed there in that letter. It's a set of nine principles.
I want to start with jurisdiction and make a pitch for there being a national perspective on this. The point of Confederation in 1867 was that we would be able to do more together than we could apart. That is being tested during this emergency management for federalist reasons. I think, rightly, the provinces and territories are playing the role they ought to play; however, there is a role for parliamentarians. Exactly what that role is, other than the economic relief that is being promised, is something this committee ought to address. I believe that having some basic human rights standards and some very basic goals for technology-assisted efforts to tackle COVID would be an appropriate role for parliamentarians to play.
A practical consideration, and one that I think is going to end up being the sad truth—I wish it weren't so—is that I don't think these systems are going to work, in 2020 anyway. I think there's a very real chance that the technological systems we're talking about today will simply not prove practical in real-world conditions. Their accuracy rate may be just too low and the complexity of human interactions just too high, because it renders too many false alarms.
Second, I think it's very vital that we be able to take a step back and recognize that a contract-tracing application on its own does nothing to stem the spread of COVID. It's useful only if those who learn of a possible exposure to COVID are able to do something about it: get tested, get counselling, get treatment or take measures like self-isolation. But if those services aren't available, if that testing isn't available, if it's not possible for somebody to self-quarantine without going into bankruptcy, then these technological ideas are useless. The advice that encourages self-isolation isn't plausible if at a certain point people can't do it, and they won't do it, as was suggested previously.
Furthermore, the thinking through of what proportionality looks like after necessity is established is important. Proportionality means looking at other, less intrusive means of getting at what you're trying to get at. To start out with mandatory adoption of a contact-tracing app, with a serious fine attached to failure to download the app, would never be proportionate in 2020, because the efforts of undertaking this exercise with less intrusive means have to be established first.
Finally, the United Kingdom released their app just this week. They weren't prepared properly and it was a disaster. It was a complete disaster and an embarrassment to the country. I would encourage us to get everything lined up first, and the protections lined up first, before the app starts.
Thank you.
Liberal
The Chair Liberal Sherry Romanado
Thank you very much, Mr. Bryant.
We'll now go to our round of questions.
MP Gray, you have the floor for six minutes.
Conservative
Tracy Gray Conservative Kelowna—Lake Country, BC
Great.
Thank you very much, Mr. Bryant, for your testimony today.
Last week, we had Google Canada here at this committee. As you may know, they're releasing those community mobility reports, which track people's movements from their homes to places like parks and transit. They track users' locations from their phones. Google Canada stated that their data is aggregated and anonymized to protect users' privacy, but some data reidentification experts state that location data can never truly be anonymized.
Mr. Bryant, would you agree with that assessment?
Executive Director and General Counsel, Canadian Civil Liberties Association
Yes, on the latter assessment, I would. We have expert reports that we filed in the court before Google decided to exit their sibling corporation, and at CCLA we're in litigation over the Quayside project. We filed a number of expert reports. It's on our website, CCLA.org. We make the case that, in essence, anonymizing or de-identification is an overstatement. That's not what happens.
In fact, reidentifying, depending on the particular program, is anywhere from self-evident to easy. Certainly, I think using the term “anonymizing” or “de-identifying” in itself is misleading.
Conservative
Tracy Gray Conservative Kelowna—Lake Country, BC
Thank you for that. That is certainly concerning.
Mr. Bryant, Google Canada also stated that they did not notify their users that they would be using their data in these mobility reports. Do you think Google Canada should have done so?
Executive Director and General Counsel, Canadian Civil Liberties Association
Yes. I think people deserve to be able to consent, to opt in, and at the very least to be able to opt out. The main reason this is happening in Canada is that Canada does not have the equivalent of the EU GDPR. Canada does not have the equivalent of the California privacy law, for example.
The failure of this government to get a modern data privacy regime in place, in however many years they've been in office, is an enormous failure. It took about 10 years for the EU GDPR to get developed and worked out before it was released and done. As far as I can tell, although this committee would know better than anyone, federally we're not where we ought to be. That type of law wouldn't work in the EU. Google couldn't do what they're doing in Canada.
Conservative
Tracy Gray Conservative Kelowna—Lake Country, BC
I know that the Canadian Civil Liberties Association discusses the idea of “meaningful consent” when it comes to such things as contact-tracing apps. Do you think Canada's current privacy laws are adequate enough for these companies, using location data from their users, to meet the threshold of meaningful consent?
Executive Director and General Counsel, Canadian Civil Liberties Association
No.
Conservative
Tracy Gray Conservative Kelowna—Lake Country, BC
Well, that says it right there.
I guess that leads to my next question, which has to do with the government considering putting in place contact-tracing apps during this pandemic. Some cybersecurity experts are stating that to put these tracing apps in place, Canada would need new legislation to set boundaries and protect Canada's privacy. Would you agree with this?
Executive Director and General Counsel, Canadian Civil Liberties Association
I generally advise against legislating on the subject of emergency management during an emergency. The uncertainty and fear that are present at the time of a pandemic interfere with and disproportionately adversely affect individual rights. In essence, everything ends up being like the U.S. Patriot Act.
Under those circumstances, I'm nervous, I should say, about legislating at this time, because I don't think adequate protection for human rights would be found. Be that as it may, there nevertheless can be a lot put into place, apparently, by way of emergency management cabinet orders in council, provincially and federally. The powers exist to put those protections in place.
I'm ducking that question a bit, because I'd rather our privacy laws not be legislated right now in Canada. At the end of it, I think it would be a mistake, and it would be bad news for civil liberties.
Conservative
Tracy Gray Conservative Kelowna—Lake Country, BC
Madam Chair, do we have time for one more question? I think we're going up against the clock here.
Conservative
Tracy Gray Conservative Kelowna—Lake Country, BC
As one last quick question, then, do you think Canada's current privacy laws are sufficient to protect Canadians' data on potentially widely used apps that will track their location and personal data for contact-tracing purposes?
Executive Director and General Counsel, Canadian Civil Liberties Association
No, I don't, but that doesn't mean that something couldn't be put together that provides some temporary protections. I think that's a job for parliamentarians to tackle so that we don't have one set of rights in Alberta, another set of rights in Newfoundland and another in Ontario. This would be an area where we ought to have a national standard and aspire towards that, one that's superior to those jurisdictions that have little respect for human rights.
Liberal
The Chair Liberal Sherry Romanado
Thank you very much.
Our next round of questions goes to MP Lambropoulos.
You have the floor for six minutes.
Liberal
Emmanuella Lambropoulos Liberal Saint-Laurent, QC
Thank you, Madam Chair.
Thank you to all our witnesses for being with us today.
My first questions are going to go to Professor Scassa.
Federal privacy laws really have not been substantially amended since their enactment. The Privacy Commissioner of Canada noted, in a joint statement with his provincial and territorial counterparts, that our current laws do not provide an appropriate level of protection to Canadians with regard to their privacy, given the digital environment. He actually mentioned it again today during the first panel in this meeting.
Do you agree with the joint statement and the principles it contains?
Canada Research Chair in Information Law and Policy, Faculty of Law, Common Law Section, University of Ottawa, As an Individual
Yes, I do. These are laws that were drafted at a time when we collected far less data and did far fewer things with data. They were written for a very different type of environment.
We are in a data-driven society. We need laws that are adapted to it.
Liberal
Emmanuella Lambropoulos Liberal Saint-Laurent, QC
Absolutely.
What changes to federal privacy laws do you think would be beneficial during this crisis or going forward in a future that is increasingly a digital environment?
Canada Research Chair in Information Law and Policy, Faculty of Law, Common Law Section, University of Ottawa, As an Individual
One thing that has been raised by so many critics of PIPEDA is enforcement: that there simply aren't enough teeth in PIPEDA, that there is inadequate enforcement of privacy rights. Therefore, that is one very important area that would have to be looked at.
Liberal
Emmanuella Lambropoulos Liberal Saint-Laurent, QC
Thank you.
Do you think COVID-19 has shed light on other gaps that we currently have with regard to our privacy laws?