{"id":10782,"date":"2022-02-07T23:50:07","date_gmt":"2022-02-07T23:50:07","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/07\/privacy-commissioner-speaks-to-ethics-committee-on-government-using-mobile-data-to-track-covid\/"},"modified":"2022-02-07T23:50:07","modified_gmt":"2022-02-07T23:50:07","slug":"privacy-commissioner-speaks-to-ethics-committee-on-government-using-mobile-data-to-track-covid","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/07\/privacy-commissioner-speaks-to-ethics-committee-on-government-using-mobile-data-to-track-covid\/","title":{"rendered":"Privacy Commissioner speaks to Ethics Committee on government using mobile data to track COVID"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

It\u2019s no secret carriers track and sell information on users\u2019 movements to various buyers.<\/p>\n

However, what isn\u2019t as standard is a government body being one of the buyers. Over the holiday season, it emerged the Public Health Agency of Canada was buying such de-identified data to track COVID-19 patterns.<\/p>\n

De-identified data means it contains no information on a person\u2019s identity, and users can\u2019t trace information back to specific individuals.<\/p>\n

The revelation led to outrage from some members of parliament and a recently passed motion to suspend the further collection of mobile location data until the Committee of Access to Information, Privacy and Ethics completes a study examining privacy concerns.<\/p>\n

Minister of Health Jean-Yves Duclos, and Canada\u2019s Chief Public Health Officer, Theresa Tam, have already appeared in front of the committee to answer questions.<\/p>\n

The Privacy Commissioner\u2019s comments<\/h2>\n

On February 7th, it was Daniel Therrien\u2019s turn. The Privacy Commissioner of Canada told the committee there\u2019s always a risk that de-identified data can be re-identified.<\/p>\n

Therrien said his office had regular meetings with Canada\u2019s Public Health Agency and was informed data would be used in this manner.<\/p>\n

The Office of the Privacy Commissioner (OPC) offered to \u201creview the technical means used to de-identify data and provide advice.\u201d They were declined. Institutions are free to accept or reject such offerings, he said.<\/p>\n

The government has argued the Privacy Act does not apply to this case. Therrien agrees that if \u201cthe data was properly anonymized and aggregated,\u201d the government would be legally correct.<\/p>\n

But Therrien suggests the committee should further examine the matter. Just because de-identified information might fall outside of the law, it doesn\u2019t make it \u201cgood legislative policy.\u201d<\/p>\n

\u201cWe think removing de-identified information from the reach of privacy laws would bring very significant risks and is not good policy.\u201d<\/p>\n

The OPC is also conducting a separate investigation on the matter.<\/p>\n

Therrien went on to say his office has received complaints on alleged violations of privacy, which are currently under review.<\/p>\n

The PHAC obtained some of the data through Telus\u2019 Data for Good program. According to its website, <\/a>it uses data to solve social issues \u201cin ways that preserve privacy and build trust.\u201d<\/p>\n

Therrien said questions exist if the government or their private partners informed users their data would be used to form responses on public health.<\/p>\n

\u201cWhile there is a reference to the Data for Good program somewhere in Telus\u2019 privacy policies and while the government does make an effort to inform citizens of its use of mobility data on its COVID Trends webpage, I do not think anyone would seriously argue that most users knew how their data was being used.\u201d<\/p>\n

The committee should address the matter in its study, Therrien suggests, given it raises questions on government transparency. He said Canada\u2019s consent model is limited when protecting privacy.<\/p>\n

\u201cA more appropriate policy would be to authorize the use of personal information for legitimate commercial interests and the public good, within a rights-based law,\u201d and enforced by the OPC.<\/p>\n

You can read Therrien\u2019s full speech here<\/a>.<\/p>\n

Image credit: Office of the Privacy Commissioner of Canada<\/em><\/p>\n<\/p><\/div>\n