Madam Speaker, before I begin, I would like to thank my colleague from Trois‑Rivières for moving this motion in the House today.
Before the Standing Committee on Access to Information, Privacy and Ethics did its study, I texted my colleague to say I was looking forward to hearing what he had to say about this because he had a lot of experience and knew the subject matter well. I would like to thank him.
We are really seized with this issue, as Canadians have been, since it was first identified in the month of December that the RFP had been issued. The RFP was to continue a practice that many Canadians, in the distraction of a pandemic, had no idea was going on. It was that their mobility data was being collected, in this case by Telus, without their consent or implied consent, and was being utilized to determine a public health response to the COVID-19 crisis.
We have, for the last several days, been studying the impacts of this at the ethics committee. I will say that there have been some very serious concerns that have been brought up by the experts we have been hearing from, including the Privacy Commissioner. That is why this is such an issue as it relates to the motion that we are dealing with today. We have not gotten to the bottom of the fact of whether this data has been protected in the manner that would be the gold standard for protecting the privacy and security of the data of Canadians. This is why we are focused on this study. During a pandemic, with all of the distractions that are going on, it would be very easy for this information to be utilized in a way that does not protect the privacy of Canadians. The RFP was originally to be finalized by January 21. It got pushed back to February 4, and now it has been pushed back even further.
At committee, when we dealt with the motion that was presented by my Bloc colleague, there were very solid arguments made as to why this RFP should be pushed back. In fact, the entire committee voted 10 to nothing to push this RFP off until we completed this study, so that not only parliamentarians but Canadians can be assured that the information that was gathered was, in fact, protecting the privacy of Canadians.
We heard at committee from members of the Liberal Party that the Prime Minister came out in 2020 or 2021 and talked about this information being gathered. It is not an issue of whether the information was gathered. There are governments around the world using data and information to inform their response to the COVID-19 pandemic, but this one speaks to the fundamental tenet of democracy to make sure that we protect the privacy rights of Canadians. Parliamentarians wanted to get to the bottom of this to make sure that we were protecting those privacy rights.
The story came out in December that this RFP was being proposed to be extended, and not just in the way it was designed in the first place, which was really for a couple of months, where it was a sole-source contract that was given to, as we found out, Telus. It was going to be extended for up to another five years and collect even more mobility data to determine, as they said in the RFP, the public health response and to determine trends to deal with public health issues going forward.
It was disturbing not only that this was happening without really the knowledge of Canadians who were distracted during this pandemic, without the consent of Canadians to have their mobility data tracked, but that this was going to go on for another five years. That is why it is important that we get to the bottom of this issue to really be sure and determine whether that mobility data was being protected on behalf of Canadians.
My colleague from the Bloc was talking about his initial concern when he saw the RFP. I saw the RFP just a couple of days before Christmas because it was reported in Blacklock's, which, by the way, does great work digging into government contracts. I know that maybe the government does not like the work that it does, but it does great work digging into these contracts. I would hope that if Conservatives were in government, we would be held to the same account on these types of contracts.
I saw the story and we had discussions among ourselves. As we were heading to the Christmas break, it was awfully difficult, because Canadians were distracted by Christmas, to really push this issue. I determined, as the newly appointed critic for ethics and accountable government, that we were going to wait until after Christmas before we called an emergency meeting of the ethics committee.
We did, the meeting was granted and, subsequent to that, the study was supported by all members of the committee to make sure that it looked at not just the RFP but another part of this too, which was an update to privacy laws. We heard from the Privacy Commissioner this morning that there does need to be an enhancement of privacy laws. We heard from an expert from the University of Ottawa as well that, as this data is collected, an enhancement of those privacy laws is needed to protect the privacy of Canadians for this data, which can be very useful but comes with some significant pitfalls and risks as well.
The issue that we are really dealing with is how this information was de-identified and aggregated. The minister was at committee last week and if we were playing the de-identified and aggregated drinking game, we would have been drunk very quickly because that was all we heard from the minister. We did not get any evidence of how this information was de-identified and aggregated. All we got were assurances. Assurances are not enough for the committee. This is why we are asking today that this RFP be cancelled until we find out exactly what is going on.
We have requested that the telecom companies come in, particularly Telus, to discuss how this information is de-identified and what security measures and protocols are put in place to assure us, as MPs, and Canadians that their information and privacy is being protected. I am looking forward to hearing from the telecom companies, including Telus through its data for good program, how that is done. I am learning a lot about this, as members can imagine, but the information that they collect, as I understand it now, is definitely identifiable. The question that we have is what happens to that information when it is identified and what is the process to de-identify it.
I have heard from security experts and read reports from around the world. A New York Times report, whose reporters we have asked to come and speak to the ethics committee, talked about being one to two to four points of data away from having that information reidentified. It really is a fascinating subject, but, more importantly, it is important to find out and determine whether that information is being properly protected from the point that it is collected to the hands that it is being passed through.
We also found out in the course of our study, and it was the parliamentary secretary who wrote us a letter to tell us, no pun intended, just so I am clear, that there was a company that was consolidating all of this data and presenting that information to the government. The company is called BlueDot. My understanding is that it is coming to committee on Thursday and we are going to have a lot of interesting questions to ask.
As we can see, the information is being collected, de-identified, aggregated and passed on to other hands. If those security measures and protocols are not put in place, and again I am not an expert on this but I have been listening to experts, there is a real risk that information can be commercialized, monetized, reidentified and that personal identifiers and information from that data can be known. It is fairly simple to do.
Proposing, as the motion did, to suspend the RFP in my opinion is the right move to make until we find out more. I did not get any comfort from the presentation of the Privacy Commissioner when he appeared at committee today. If anything came out of that meeting today, it is that it really informs the need for us to do a deeper dive on this and suspend the RFP.
I pulled off some of the questions that were asked of the Privacy Commissioner, and if what the Privacy Commissioner said this morning does not concern the tin-foil hats on this side of the House, as the members of the government like to call us, or the conspiracy theorists, it should be worrisome to members of the government. I will read it into the record, because I think it is important for us to inform our decision in this debate as we vote on this motion when it does come to a vote. Daniel Therrien, who is the Privacy Commissioner of Canada, and the de facto standard by which privacy protection is utilized in this country, said today that:
In the case of PHAC's use of mobility data, we were informed of their intent to use data in a de-identified and aggregated way.
Okay, he was informed. He went on to say that:
We offered to review the technical means used to de-identify data and to provide advice, which PHAC declined.
PHAC declined the offer by the Privacy Commissioner of Canada to look at the methodology and to provide advice on how this data was being utilized or protected. He went on to say that:
The government relied on other experts to that end, which is their prerogative.
It is their prerogative, there is no question about it. My view, and I know the view of the members of our committee, because we spoke afterwards, is that regarding the de facto standard by which privacy legislation is defended and protected, the Privacy Commissioner of Canada should have at least been included in the process so that PHAC, which was accepting this data, and perhaps Telus and BlueDot would have known what proper privacy measures, protocols and security should have been put in place. It may cause a level of concern that his office was merely notified, “Oh, by the way, we're going to be doing this.” “Do you want any help?” “No, we don't want any help.” That is effectively what PHAC was telling the Privacy Commissioner.
I am not surprised that he also went on to say the following, given the reaction among Canadians and just how troubling this information is as it has become publicly known and people's attention has been given to it:
Now that we have received complaints alleging violations of privacy, we will turn our attention to the means chosen for de-identification and whether they were appropriate to safeguard against reidentification.
Since this is under investigation, he obviously was not able to provide us with intimate details of where that investigation lies at this point, but the Privacy Commissioner of Canada was not even notified. The government relied on other security experts and privacy experts. Who were they? I think that is a fair question. What qualifications do they have that are greater than the Privacy Commissioner of Canada's? It was really concerning.
The Privacy Commissioner went on to say, in this line of questioning from our committee, that, “This practice raises legitimate concerns by consumers, particularly when their personal information is used without their knowledge for purposes other than they expect.”
We have heard from members on the other side about the ways of all the different apps, but the difference between that and what we are talking about is that the users provide consent to those applications to use the tracking of their mobility. In the case that we are talking about today, which involves anywhere from 14 million to 33 million users, it would be a hard argument to suggest that every one of those users provided consent. In fact, the Privacy Commissioner said today that it would be impossible for 33 million users to provide consent so that collection of their data could be used for the purposes that PHAC was dealing with. The issue of meaningful consent becomes a critical component of this.
I received a letter from OpenMedia.org talking about the ethics committee looking into this issue. The company suggested three fundamental questions, which we are trying to get to the bottom of, that are extremely important in this case.
Number one: How did Telus obtain meaningful consent for the collection, use and disclosure of this mobility data? I spoke about the importance of that earlier. OpenMedia suggested that when Telus comes to the committee, it needs to answer questions such as whether an individual who agreed to the sharing of their mobility data understood this use by the Public Health Agency of Canada. I suggest it would be impossible for 33 million people or fewer to really understand that this was being used by the Public Health Agency of Canada.
The second most important question that needs to be asked is this. Does the consent that Telus relied upon extend to the context in which the Public Health Agency of Canada used this data? Privacy and consent, it says, are highly contextual. If we, as users, give limited permission to Telus to collect, use in a limited way, and disclose some of our mobility data, that cannot and should not be an open-ended carte blanche for Telus to be able to provide this data to other people, including the Public Health Agency of Canada.
The next is the most important question of all. I heard universally from security and privacy experts, not just here in Canada but around the world. They asked how exactly this data had been securely de-identified. There are really two issues here: first, de-identification and the risk associated with reidentifying this data; and second, user consent.
My office has received correspondence. We have heard from experts, and as I said earlier we heard from a University of Ottawa expert this morning, about the risks of de-identifying data. I want to read out what some of the security experts are saying in the context of this RFP, and why it is so important that the government hold off on it until we get the answers to the questions.
Dr. Ann Cavoukian, the former Ontario privacy commissioner, said that without a strong de-identification framework and without de-identification protocols one can reidentify this data. There is a whole collected literature on de-identification of data and the way to easily reidentify it. One has to go to great lengths to de-identify, and I am sure the government has not done this.
I go back to what we heard from the Privacy Commissioner today, who said that he was merely informed and not consulted, despite the fact that the Minister of Health last week said that the government were having biweekly meetings with the Privacy Commissioner on this issue. We found out this morning these were not related to the gathering of mobility data, but related to other things happening in the context of the pandemic response.
Dr. Cavoukian went on to say that the government should be the greatest concern. Its ability to usurp our information, to tell us what to do and expect us to accept that, in my view, is due to the fact that it is seeking greater control.
If we want to connect the dots, and look at some of the patterns created as a result of this pandemic, Canadians are becoming increasingly concerned, and I would say they are concerned at this point, about the expansive overreach by the government. It is using the pandemic to curtail the rights and freedoms of Canadians. We saw the government, at the beginning of the pandemic and through the initial build, try to seize control and get spending and taxing power without parliamentary approval. We have seen this and other sole-sourced contracts that have gone out throughout the course of the pandemic to who I would call well-connected Liberal insiders and friends.
I am not suggesting that in this case, but when one starts connecting the dots with this expansive overreach, we can see a pattern with the government. It is causing me great concern, as it is many Canadians.
