Debates of Feb. 7th, 2022

Access to Information, Privacy and Ethics

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I am fairly new to this discussion, but when we think of the de-identification of data, Telus has a vested interest. If it were to lose the confidence of its consumers, that would have a fairly profound, negative impact on it. The Government of Canada, through the Department of Health, is trying to get that de-identifiable data in order to provide good, sound policy decisions in a timely fashion. It seems that both Public Health and Telus have strongly vested interests.

Does the member feel that the Government of Canada, the Department of Health or Telus have violated any current laws?

[John Brassard, Conservative, Barrie—Innisfil, ON]

Madam Speaker, I cannot speak to that because we are simply not at the point of understanding how this data was collected, whether it was properly de-identified, what the risks of reidentification are, and why the Privacy Commissioner was not involved in the process and providing guidance to PHAC. The Privacy Commissioner would have provided guidance to Telus as well.

I have trouble understanding the actual risk, in the collection of this data, to the privacy rights of Canadians. The reason I am troubled by that is because there are other programs in place that the Public Health Agency of Canada could have utilized if it wanted to determine public health response, or even the future of public health response. It has access to data within its public health networks, provincially, territorially and municipally. It has hospitalization data. It could have used other government resources without risk to the privacy protections of Canadians by using this as a means, especially without enhanced privacy laws.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague for his enlightening remarks. Two problems have been identified. The first is related to consent, the second to data anonymization. I will focus on the first.

We have been told over and over that anyone could consult the data on COVIDTrends. Telus users could opt out anytime because there was an opt-out function. Did users know they were supposed to check COVIDTrends, and did they know they could opt out?

Is it reasonable to believe that COVIDTrends was known to the public given that the Prime Minister mentioned its existence just one single time, back in March 2020?

[John Brassard, Conservative, Barrie—Innisfil, ON]

Madam Speaker, my colleague posed a very important question.

We heard members at committee say that the Prime Minister made people aware this was going on and that the government was transparent about it, but it really boils down to the issue of consent. It can be as transparent as it wants, but the bottom line is that if users and Telus customers did not provide their consent for this information to be utilized in the manner in which PHAC did, that calls into question not an issue of transparency, but an issue of whether I am confident in my privacy rights being protected at a time when I should be consenting to that information. We heard from the Privacy Commissioner that there may be other circumstances that allow for privacy to be determined, but we have to increase those privacy laws. We have to enhance privacy laws in order to protect for the purposes that PHAC determined.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, I want to begin by congratulating my hon. colleague across the way in the Conservative Party for his recent ascension. I will be speaking with him a lot more in the future.

With respect to the debate we are having now, I wonder if he believes this. Can we expand the mandate the hon. member for Trois-Rivières suggested, which is to look at other ways in which privacy may be compromised during the pandemic?

[John Brassard, Conservative, Barrie—Innisfil, ON]

Madam Speaker, I want to thank my hon. colleague for her kind words. Everybody was saying that this new position as opposition House leader is like drinking water from a fire hose, and as a former firefighter, I never drank water out of a firehose in the way I am today. It has been quite a day.

It is an important question, because what we want to be focusing on is not just how the data was collected and what security protocols and privacy protections were put in place; we also, as a committee, determined that we need to move forward, and the Privacy Commissioner was a very important part of this process this morning about enhancing privacy laws. In fact, at the beginning of this pandemic, the Privacy Commissioner wrote to the government and said that in the context of a pandemic, we not only have to make sure that our privacy laws are upgraded, for lack of a better term, but also that there has to be that enhancement in protecting privacy.

I am looking forward to the report of the committee, because I think we can present some forward-looking things to the government so that it can enhance those privacy laws in what is becoming an increasingly important part of data collection to determine health responses, but we have to be assured that privacy rights are upheld in the context of that information being gathered.

[Colin Carrie, Conservative, Oshawa, ON]

Madam Speaker, I want to thank my colleague for the work that he is doing on privacy. One of the things I want to ask him about is the limited use of this data.

When we had the Privacy Commissioner at committee before these vaccine passports were rolled out, he said it was very important that they had scientific proof that they worked. As the member knows, the vaccine passports were rolled out to stop the spread of COVID-19; in other words, the assumption was that vaccinated people would not spread COVID-19 and unvaccinated people would. Right now we are seeing that both vaccinated and unvaccinated people can spread the virus. The Privacy Commissioner said that once the information is no longer needed, it needs to be destroyed.

In the context of this cellphone tracking that may be linked to cellphones themselves, how much longer does the member think the government should be retaining this information, and should it be permanently destroyed afterward?

[John Brassard, Conservative, Barrie—Innisfil, ON]

Madam Speaker, I believe the information and the data that are collected do have to be destroyed, but I need assurance and members of the committee need assurance—and this is why we are here today—that the data is being collected in an appropriate manner, a secure manner, with proper security protocols in place, but more importantly, that the information is protected.

I would not go so far as to say that it needs to be destroyed. Without looking at that, we have to step back and ask if this was done in a proper manner with proper securities and protocols in place to protect the privacy of Canadians.

In the context of the vaccine passports, I have seen the same studies and reports as the hon. member has, and the Privacy Commissioner was quite clear in his statements that this information must be destroyed. We have to make sure that it is not commercialized, not monetized, and, more importantly, that it is not de-identified in a manner that offends the privacy rights of Canadians, which are a fundamental tenet of democracy.

[Yves Perron, Bloc, Berthier—Maskinongé, QC]

Madam Speaker, the situation is unbelievable. We are debating a serious matter, people's privacy. We have a parliamentary secretary who stated that he did not vote in committee and that all kinds of information is being collected from our phones anyway. That is worrisome.

I would like to congratulate my colleague for his speech because he raised several very pertinent points. What I wanted to ask him about was the Office of the Privacy Commissioner of Canada, a tool at the government's disposal to ensure it does not go wrong.

Many governments around the world collect data about their citizens, and they all have good reasons for doing so. That is why we must be vigilant with respect to this issue. I would like my colleague to tell me why the Liberal government did not approach the Privacy Commissioner of Canada in this process. That is unbelievable.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Madam Speaker, it certainly is unbelievable.

They informed him, but they did not utilize his expertise in guiding them on how to properly do this.

On the issue of the parliamentary secretary, he is full of bluster. He stands up and he criticizes us, and we accept that. We know where it is coming from.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

It is my duty, pursuant to Standing Order 38, to inform the House that the questions to be raised tonight at the time of adjournment are as follows: the hon. member for Langley—Aldergrove, Infrastructure; the hon. member forNorth Island—Powell River, Seniors; and the hon. member for Northumberland—Peterborough South, Government Priorities.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I join the debate this afternoon in support of the concurrence motion moved by my hon. Bloc colleague from Trois-Rivières.

Our Standing Committee on Access to Information, Privacy and Ethics unanimously adopted this motion:

That the committee call upon the government to suspend the Public Health Agency of Canada's cellular data tender upon adoption of this motion, and that the tender shall not be re-offered until the committee reports to the House that it is satisfied that the privacy of Canadians will not be affected, and that the committee report the adoption of this motion to the House at the earliest opportunity.

When we are dealing with issues of privacy, I believe it is critical that parliamentarians have the opportunity to be clear on what is being collected, how it is being utilized and what safeguards are in place. Not doing this would be an abdication of our responsibilities as legislators.

I believe the government members of our committee were acting in good faith with our committee's request to suspend the procurement under this contract. With the news that the government had tendered a contract for the collection of mobility data as a part of its COVID-19 response, many Canadians were rightly concerned about the protections in place to protect their privacy. The fact that many people learned about this program from news articles sets off alarm bells, and even if the process was unintentional, it demonstrates a lack of government transparency.

To make matters worse, a PHAC spokesperson stated that the agency had consulted with the Office of the Privacy Commissioner before starting to collect mobility data, but the Office of the Privacy Commissioner stated that it was not consulted and had only been informed of the program in 2020. This discrepancy between “consulted” and “informed” is stark, and I believe it is prudent of the ethics committee to ask the government to press “pause” on any future requests for proposals for mobility data projects until parliamentarians have an opportunity to provide oversight.

Our committee has had an opportunity to hear from PHAC, departmental officials and the Privacy Commissioner, but it is very important that we have telecom industry representatives, and Telus in particular, appear before our committee to discuss how they are going to use our personal information and what steps they have taken to protect our privacy.

I look forward to these representatives appearing before our committee in the near future to explain how they obtain meaningful consent for the collection, use and disclosure of this mobility data; how the data is de-identified; and what the risk is of reidentification.

I think the study is also an opportunity to educate the public about the pervasiveness of the mobility data economy and, by updating our Canadian privacy laws, make meaningful progress towards reforming the actors that operate in this sector. I can only hope that this opportunity to bring Canada's law into the digital era and restore trust to Canadian citizens and consumers alike is not lost.

There has also been little discussion of PHAC's collection and use of data from these kinds of third parties, which tend to be advertising and data surveillance companies that consumers have no idea are collecting, repackaging and monetizing their personal information. The repurposing of Canadian cellular networks for things like pandemic mobility tracking without the knowledge of subscribers, though ostensibly with their consent vis-à-vis the largely unread terms of service, is a big deal.

The data that was provided to PHAC lacks demographic information and, as we have heard, provides crude assessments of population mobility. While the data might be of some value, there is still a question about whether or not Canadians are comfortable with their cellphone data being used in this way. I know many of my residents in Hamilton Centre have shared their deep concerns about the overall commodification of the tracking and sale of their personal information. This is not the only example of cellphone data being used for purposes that are wholly unrelated to the provision or management of cellular services. Cellphone companies themselves have developed surveillance tools, selling them on the basis that cellphones are trackable devices and warning customers who use their service that they should not expect cellphone privacy. In fact, I believe we heard that clearly from the government members of this debate this evening.

Given the massive amounts of cellphone data that are available through our cell towers, our cellphones and our cell service providers, the ability to track cellphones across time and space is completely unchecked.

Cellphone companies' refusal to encrypt important information about subscribers' locations has made it easier for cell sites and their owners to provide law enforcement authorities with cellphone data. Cellphone companies have made it possible for cellphones to be tracked even when they are turned off by means of cell-tower logs that track the cell numbers and locations of subscribers without their knowledge. By triangulating a cellphone user's geographical location, cell towers can enable the construction of a kind of cellphone user profile.

I think of the use by police of technologies such as stingrays and I cannot help but recall the revelations this past summer about major government overreach utilizing the private Israeli Pegasus spyware used to hack cellphones of journalists, activists and worldwide agencies through the NSO Group's spyware, which has been licensed by governments.

However, cellphone tracking capabilities are not the domain of only law enforcement or intelligence agencies; they can also be tracked by the cell tower owners, as we have discussed. This access could be used to determine where these phones go in the evening and leave cellphone providers with an ongoing level of pervasive tracking. This is problematic, because users are charged by cellphone providers based on their location data and where these phones spend their time. This is how they generate large amounts of their ad revenue.

Within the Canadian context, as is the case in the study for our Standing Committee on Ethics for which this concurrence debate has been called, cellphones are used to track cellphone users' and potentially citizens' mobilities for reasons having nothing whatsoever to do with their cellphone service provision.

The Privacy Commissioner was at the ethics committee earlier today. His brief stated that “this data sharing initiative is an example of the movement of data between the private and public sectors and demonstrates the need for both to be governed by common principles and rules. With these two sectors interacting ever more frequently it is imperative that they be held to similar standards. Ideally, our two federal privacy laws should also be updated concurrently.”

I agree, and I believe that Canadians all expect a certain level of privacy, especially when it comes to their cellphones. We need to take a closer look to see if our current laws and regulations are sufficient in our current age of big data. I plan to continue this work at the ethics committee to ensure that Canada has the gold standard for protecting people's data and their privacy.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague for demonstrating that our work at the Standing Committee on Access to Information, Privacy and Ethics is about much more than just this matter in connection with the Public Health Agency of Canada.

We need to establish exemplary standards, as other countries have done, so that Canadians are well protected. Does my colleague believe that we could draw on the General Data Protection Regulation currently in effect in the European Union to quickly implement certain provisions on consent?

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I would share with the hon. member that the Privacy Commissioner stated an urgent need for law reform. It is incumbent on us to take a look at the ways in which big data is bought and sold and commodified and the need for our legislation to be updated, including having an arm's-length agency that is provided with the resources and staffing to ensure that there are proactive audits, which the Privacy Commissioner called for, of both private and public organizational interests.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, it certainly was fascinating to see the wide disparity of views between what the minister shared last week and what the Privacy Commissioner told the committee here this morning.

The parliamentary secretary implied earlier, in an answer to a question from the official opposition, that he did not feel it was important for the government to respect the will of the committee in terms of delaying the RFP. I would certainly value the thoughts of the member for Hamilton Centre on the comments that the parliamentary secretary made in that regard.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I think the heart of all of our committee work is being able to operate within good faith with the people who join us on our committees. I take it that the five Liberal members who voted to support this were acting in good faith when they supported this measure. I do not take it lightly that the parliamentary secretary just basically brushed off the committee's motion, which was duly passed unanimously.

It also speaks to a growing concern that not only members of the governing side, but also senior bureaucrats and those with corporate interests, may choose to try to brush off the ethics committee when we do our investigations and put forward recommendations in the House. It is not lost on me that we have to be before this House with a concurrence motion to simply get the government to do what its Liberal members already voted for us to do.

[Yves Perron, Bloc, Berthier—Maskinongé, QC]

Madam Speaker, I thank my colleague for his balanced speech. He covered the issue in detail, and I would like to ask him the same question that I asked my Conservative colleague earlier.

We have a government that claims that there is no problem, that there is no need to worry because data is always being collected. This government does not want to acknowledge its members' vote in committee. That is quite troubling. What does my colleague think was the government's motivation for not involving the Privacy Commissioner of Canada when it was setting this policy?

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I was troubled by that. In fact, I was a little agitated by the government's use of this idea that it was working with and being informed by the commissioner. I think there was a clear distinction made by the Privacy Commissioner on what it actually looks like to be in consultation with the privacy commissioner's office, at which, it is not also lost on me, there are now complaints.

I would put to the hon. members in the House debating that, had the government taken the opportunity to actually take up the Privacy Commissioner's offer, it might have avoided the privacy complaints that are now being launched against it.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I have a question for my hon. colleague, and I do not know if he really has the answer. What does he think the rationale was for the government to ignore the will of the ethics commission with respect to protecting Canadians' privacy?

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, given that I have to state that I do not know what the government's motivations were, I will say I think that it is a dangerous precedent. The Privacy Commissioner provided the opportunity to look at the frameworks in place to ensure they met the standards set by the Privacy Commissioner. The fact that this was denied is very troubling for me.

We also understand that the Privacy Commissioner's office does not have the resources to check procurement on every single project that goes out there. However, on this particular one, if I understood the testimony today correctly, I think there was an ongoing effort by the Privacy Commissioner and there were multiple opportunities for the government to engage in the office's expertise, which is precisely what has put us before the House this evening.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Madam Speaker, as we have been talking this afternoon, we have heard a lot of discussion about trust in the manner in which the information is being obtained. I wonder if the member can comment as to whether he believes there might be risks of government listening in on conversations, as we heard earlier from the Conservatives.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, while I can appreciate where the hon. parliamentary secretary is trying to go on this, it is not lost on me that this is a government that allowed our military to spy on Black Lives Matter movement protests while simultaneously being out and actually participating in them.

There is a long and storied history of the way in which government actively surveils citizens in the country, including the ways in which Bill C-51 allowed for the targeting and criminalization of indigenous land defenders, environmentalists, social justice folks and basic people out there trying to advocate for their own civil rights.

[Colin Carrie, Conservative, Oshawa, ON]

Madam Speaker, I think the work my colleague is doing is some of the most important that is being done in Canada right now, so I thank him very much. What I am hearing from constituents is concern. When this came out I got emails about the Government of Canada spying on Canadian citizens without consent. I have heard allegations that even now, when Canadians are putting health information on their cell phones in regard to a vaccine passport, when they cross the border coming back from the United States, they do not even have to show their passport anymore. Without their consent, the CBSA officers already know it.

Could the member comment on how important it is for him to do this work? What are the potential dangers of sharing our personal health information and our information internationally, if we do not get this right in Canada?

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, as somebody who has spent quite some time tackling the pervasive and, I would suggest, racist practice of racial profiling in street checks, we know that organizations like the CBSA, through CPIC, have a whole host of information on people that is shared not just domestically but internationally.

This begs the question about time limitations for information that is collected by government and shared with agencies. I know this is one of the questions that came up today. Will we actually delete this information, or will it be held in perpetuity and shared with agencies around the world?

I do hope that the use of CPIC and the sharing of this information more broadly is brought into this discussion because, again, it blurs the lines between public and private interests, and basic civil liberties.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I want to respond, first and foremost, to one of the issues that was raised, which is why the government is looking at mobility data. It is important for me to recognize that I really do value the contributions our standing committees make to the House of Commons. We often see that things coming out of our standing committees will ultimately end up on the floor for debate. Whether directly or indirectly, they contribute immensely to our institution, and I do want to thank those members who participated in this valuable study, no matter what political party they belong to.

I approach this debate feeling a bit mixed, in the sense that I was hoping we would be dealing with Bill C-8. What is interesting in talking about this particular report and asking for it to be concurred in is that the reason that collection was happening in the first place was coronavirus.

The government, including the Prime Minister, even when he was in opposition, has always talked about the importance of science, and how important data and, in the case of the pandemic, health care experts are, as well as the role they played in making sure we minimized the negatives of the pandemic. That means that we need to gather information and data.

Maybe about a year ago, some data was released. It went onto the internet through Google. It might have peaked for about two or three days. I thought it was really interesting. It was about cellphone data, and it showed how people were travelling in communities, and not only in communities, but across the country and around the globe. I learned a lot from just seeing the snapshots of these little dots showing how mobile people are nowadays.

When I heard about the Public Health Agency of Canada looking at getting this mobile data, I was not overly concerned about it, given the fact that Canada's Public Health Agency has done an outstanding job. I would suggest they are second to no other government agency in the world when it comes to dealing with the pandemic. It has done it in a first-class way.

That does not mean it cannot or should not be held to account for the decisions they have made or the actions they have taken. I suspect that, over the coming days, weeks, months and years ahead, there is always going to be a reflection in terms of what it is that particular health agency did at a time when Canada needed that agency.

I would remind members of the House to reflect on not only the credibility of the Public Health Agency of Canada, a credibility that is recognized around the world. It is an agency that has the integrity and the expertise to make good, sound decisions. We have some vested interests there.

Telus is not a small company, as we all know. Telus is a huge corporation with a very large clientele. Telus could disappear fairly quickly in Canada, in terms of its footprint, if Canadians felt they were being betrayed or that it was giving out information it should not be giving out.

Health Canada as an agency is not new. As an agency it has been there for many years. If we had the health committee or another standing committee bring Health Canada before it, and I do not know this for a fact but I would speculate that Health Canada would say it is in constant need of information. It continues to look at ways in which it can bring in that information. I say that because I believe that within Health Canada there is a high level of expertise to deal with the issue of the privacy of Canadians.

I suspect that some in the opposition benches would say that is all fine and dandy, but there still is a need for us to be able to provide that sense of accountability to ensure that the rights of Canadians are in fact being protected. We do not have to be in the opposition benches in order to appreciate that.

When I was first elected, the Internet was around but not for the average consumer, that is for sure. In 1988, I had the little Apple with the 3.5-inch floppy when I was first elected, and I would punch in the phone number and hear the dial tone and it would click in. The point is that time goes on and we opened up a whole new window through this technology.

I remember talking to a business person who had his own data collection. Many of my colleagues might remember Paul Calandra and he would always talk about his pizza store examples. I actually have a pizza example where an individual business person was compiling his own data of customers with phone numbers and so forth. He said that if he ever changed companies or to be able to put out a special, he had a base that he could go to.

The same principles of the importance of data are there today. Take a look at what is happening with Google, Amazon and Netflix. There is a whole spectrum of exceptionally large Internet companies in particular that are gathering billions of pieces of data that could be associated with some form of identity.

My constituents, justifiably so, are very much concerned about it. Their primary concern is the issue of identity theft. Another concern is the issue of privacy and what the government is doing to ensure that privacy is protected. That is why I said at the beginning of my comments that I appreciate the fact that we have a standing committee that is dealing with the issue of privacy.

Where I have a bit of a problem today in terms of talking about this report is that all members will sit on committees and all committees will provide reports and all reports will ultimately be tabled here in the House. Unfortunately, if every report were to be debated, we would not have time to deal with not only government business but even opposition business.

I am wondering whether this would be better. If members of the ethics committee have some outstanding concerns, nothing prevents them from reconvening to go over the report and call before it ministers and others. I can appreciate the sensitivity of the issue, but as much as this report supplies a lot about mobility data, which is so important in order to be able to deal with the pandemic, I was hoping we were going to be debating Bill C-8 today, because—