(Ottawa) A House of Commons committee recommends that the federal government notify Canadians if it collects data on their movements — and allow citizens to opt out of such collection.
Updated yesterday at 6:37 p.m.
These are some of the recommendations made by the Standing Committee on Access to Information, Privacy and Ethics, which began in January to examine the issue of the collection and the use of data on the mobility of Canadians.
We had just learned that the Public Health Agency of Canada (PHAC) had used data on the mobility of Canadians during the pandemic to assess trends in the movement of populations.
Public Health used cell tower data to track 33 million mobile devices to assess travel patterns during lockdowns. The agency then launched a tender, in December, to continue tracking cell location data until May 31, 2023.
The Commons committee says the government should inform Canadians “on an ongoing basis” about these programs — “and do so in a way that clearly outlines the nature and purpose of the data collection.”
The committee also recommends changes to privacy and privacy laws, so that anonymized information and aggregated data are considered “personal information,” and therefore subject to privacy protections.
PHAC did not immediately respond to questions Wednesday. The agency had previously pointed out that cell tower location data would be devoid of personal identifiers. PHAC also said it had sought advice from privacy and ethics experts, including the Office of the Privacy Commissioner of Canada.
For his part, Privacy Commissioner Daniel Therrien said in a statement Wednesday that he “very favorably welcomes the committee’s report.” He also adds that the government “has failed to act in a way to assure Canadians that its use of mobility data will respect their privacy”.
“It goes to show that the disconnect between current privacy laws and modern technological advancements is so great that even socially beneficial uses of data are viewed as suspect because Canadians are unconvinced that the laws will protect them. “, believes Mr. Therrien.
The private sector too
But the committee’s proposed changes go beyond government operations. The committee says Canada must regulate the activities of the private sector in the collection, use, sharing, storage and destruction of Canadians’ mobility data. The committee also recommends that the government ensure that private companies have obtained “meaningful consent” from their customers for the collection of this data.
However, Mr. Therrien believes that it is “neither practical nor realistic” to expect people to give their consent for all uses of their data. According to the commissioner, Canadian laws should give organizations more leeway to use personal data without consent “for the purposes of responsible innovation and for the common good”.
On the other hand, “this should be done within a legal framework that recognizes privacy as a human right and as an essential element for the exercise of other fundamental rights”, insists Mr. Therrien. This use of personal data without consent should be subject to independent oversight by the OPC to ensure transparency and accountability, he says.
“In this case, although the government informed our Office of its intention to use mobility data, it ultimately refused our offer to examine the means used to de-identify this data and how the principles of protection of personal information were applied.
“The regulator should be able to insist on proactive auditing, if necessary, to ensure public confidence. »
The ethics committee’s recommendations include a number of public education and transparency measures, and call on the government to define what constitutes a “legitimate business interest” and a “public good” in the collection, storage, the use, transfer and sale of private data. The committee also wants the commissioner to be empowered to investigate violations and enforce the law.
The federal government did not immediately respond to questions about whether it accepted the recommendations and whether it planned to strengthen the powers of the Office of the Privacy Commissioner.