Information & Ethics committee  Again, I can't comment on exactly what they did with that data, but the public maps and reports that are available are at the aggregate level, and they do not pertain to individuals.

Information & Ethics committee  For the reported numbers of that level of aggregation, it doesn't seem to pertain to individuals, but getting from identifiable data to that, I can't comment on the process, or who has handled it and what changes were applied along the way.

Information & Ethics committee  I've been working with different departments of the government for almost two decades. I have worked with different parts of the government and Health Canada and the Public Health Agency during that period.

Information & Ethics committee  As Commissioner Therrien mentioned, in cases like this it can be impractical to obtain consent a priori. Therefore, the de-identification methods and the additional controls and transparency and ethics reviews all provide assurance that the data is no longer identifiable and it's being used responsibly.

Information & Ethics committee  Yes. The idea is that you start with the real data and you build a machine-learning or AI model that learns all the patterns in the real data, and then you generate new data from this model. The generated data has no mapping to the original data. It has no mapping to real people.

Information & Ethics committee  I don't have the details of what BlueDot and Telus have been using their data for, but the current case of the Public Health Agency using mobility data to understand transmission patterns is a reasonable use of data for public health surveillance purposes.

Information & Ethics committee  Yes. As mentioned at the committee meeting last week, many countries around the world are using mobility data for public health surveillance purposes. It was also used before the pandemic by the UN, for example, to track movement of individuals, so it's not uncommon to do so.

Information & Ethics committee  Yes. The risks will be quite small.

Information & Ethics committee  I've written a white paper with 10 recommendations for regulating non-identifiable data, which I can share with the committee if the committee wishes to review it. To conclude, while I have not assessed the measures taken in this situation, I hope my comments can assist the committee's work.

Information & Ethics committee  If the data is de-identified using known practices, good practices, then the risks can be very small. There are many precedents from reputable organizations in Canada and internationally for what's deemed to be acceptable risk, and we can measure those risks and apply techniques to reduce the risk to be acceptably small.

Information & Ethics committee  Yes, absolutely. To de-identify information, there are transformations like reducing the granularity of the geography, to have larger and larger geographic areas, for example, or reducing the granularity of dates so you can have larger time intervals; instead of days, you can have weeks or longer.

Information & Ethics committee  If good methods have been applied, the risk of re-identification can be very small. I think that, in many of those examples, good methods were not applied. They demonstrate the importance of applying good methods and good practices. As I mentioned, the risk is not going to be zero.

Information & Ethics committee  Thank you, Mr. Chair and members of the committee. The purpose of my remarks is to offer an overview of de-identification. As someone who has worked in this area for close to 20 years in both academia and industry, perhaps this is where I can be helpful to the committee's study.