We live in an increasingly digital world, and 2022 will not slow down the magnitude of this shift. However, there is always a risk of skidding when you take a turn at full speed. This is just as true when it comes to the digital shift. Last article in this series: lessons from COVID-19 in data management.
The Public Health Agency of Canada consulted, during 2021, the location data of 33 million Canadians to determine the effect of confinement and mobility on the transmission of COVID-19. The Agency is now asking to continue this study over the next five years. This does not fail to worry the experts.
To collect its data, the Agency notably agreed with the mobile service provider Telus within the framework of a program called Data at the service of the common good. “Telus holds a significant amount of extremely useful data […] “Explains the Vancouver company on the program’s website. “We are making this information available without compromising our long-standing commitment to protecting the privacy of our customers. »
In concrete terms, the Public Health Agency of Canada obtained anonymous and aggregated data from its supplier, that is to say data which does not contain any information on the identity of the owners of a mobile device involved in this program. They are said to be aggregated since they come from several sources grouped together in a single information bank.
Telus insists that its program received two special mentions recognizing the way its program respects the privacy of its customers. In principle, therefore, the supplier has provided the federal agency with data that does not allow anyone to be identified.
The Minister of Health, Jean-Yves Duclos, who supports the project, for his part contacted the Office of the Privacy Commissioner to ensure that the privacy of Canadians is preserved as best as possible. A spokeswoman for the agency told the Duty that “analysis and conclusions from mobility data have been regularly communicated to provinces and territories as a source of additional information to support policy decisions and the assessment of their response to the pandemic”.
Inform the public
The problem is not there, agree the experts. It is rather in the fact that a federal government agency spied, over a period of nearly six months in 2021 and without warning them beforehand, several million Canadians. It was following a request from English Canadian media last fall that the agency admitted to having done so.
“The government really needs to start acting more transparently” in how it uses digital data on the behavior of its population, laments McGill University professor Benjamin Fung. Mr. Fung is also Director of the Canada Research Chair in Data Mining for Cybersecurity.
In addition to this first misstep of non-disclosure, Benjamin Fung is concerned about the possibility that the data obtained by Public Health could subsequently be “reidentified”. In other words, we find out who are the people from whom this data comes. In many cases, it suffices to combine the information of two or three databases to be able to know the identity of the subjects.
“There are several ways to anonymize and aggregate public data. It is really necessary that at each stage of the study program, security be at its maximum, ”adds the Montreal expert, who recalls that it is not so much the federal agency itself that would do it, but that It only takes one leak of this data for the information on the movements of millions of Canadian citizens to fall into the hands of ill-intentioned people.
“COVID-19 or not, the government must warn the public of such acts. Especially since we are likely to see more and more such analysis projects being carried out by the public sector over the next few years. »
What representativeness?
The use of massive and anonymous data to better understand the behavior of the population is not a first. It won’t be the last either. On December 17, the Agency issued a new Request for Proposal to once again obtain location data from cell phone towers across Canada.
Without having analyzed the case closely, the assistant professor of sociology at Concordia and expert in technology ethics Martin French says all the same to see there parallels with the data collection programs of technological giants like Google.
These cases raise the same questions about public trust in privacy, he says, but they also touch on another issue that is less apparent at first glance: even if big data is used in a respectful way of private life, is the public faithfully represented?
Because even if more than three-quarters of Canadians have a smartphone that allows them to be tracked without their knowledge or not, the distribution of these devices among the different subgroups of the population may not be representative. from the whole.
“Can such a system, on its own or when paired with others, end up benefiting or disadvantaging certain sections of the population? asks Martin French. “Some regions less well served by mobility may not benefit from the results of this research. Or, other regions will be over-represented, and this will end up having negative, rather than beneficial, effects on their population. »
The Agency says it uses this source of information in addition to its other work. “For example, when [ces données] are analyzed with outbreak data, understanding population movement can help predict risk for other geographic areas,” she says. Combined with other public health data, these data help assess the effectiveness of measures such as mandatory confinement. It also helps to better understand how the population reacts to public health advice and directives.
All this will not prevent Canadians from worrying that they have been unknowingly tracked by this program. This is a good illustration of the puzzle that public administrations will have to solve if they too want to take the digital turn. After all, people won’t feel safe if they don’t trust the system first.
In IT, it’s just the opposite: the best security is called zero trust, and his confidence level is zero. This approach promises greater transparency in the management of digital data and should inspire governments if they want to avoid offending the public.