Canada’s Privacy Commissioner Daniel Therrien is citing an urgent need for law reform to deal with privacy concerns amid the COVID-19 pandemic.
In the commissioner’s annual report, tabled in Parliament on October 8th, Therrien says that the pandemic is raising new privacy issues in a context where federal laws don’t provide effective protection.
“Federal laws are simply not up to protecting our rights in our rapidly evolving digital environment,” the commissioner said in the report.
“We need a legal framework that will allow technologies to produce benefits in the public interest while also preserving our fundamental right to privacy. This is an opportune moment to demonstrate to Canadians that they can have both.”
The report outlines that since the start of the pandemic, technology has been essential to preventing the spread of COVID-19, but is also creating new risks.
For instance, the commissioner states that telemedicine creates risks to doctor-patient confidentiality when virtual platforms involve commercial enterprises. Further, e-learning platforms can also capture sensitive information about students’ learning disabilities and behavioural issues.
The report outlines that despite Canada once being a world leader on privacy, it now lags behind its trade partners as federal privacy laws have fallen behind much of the rest of the world.
For instance, the last time Canada updated its privacy laws was in 2015, while other countries have spent the past decade building up robust laws for data protection.
“The fact remains that our existing legislative framework for privacy is outdated and does not sufficiently deal with the digital environment to ensure appropriate regulation of new technologies,” the commissioner stated.
COVID Alert
Therrien notes that while technology offers tremendous benefits, it also raises risks that are not properly mitigated under the current legislative framework.
He states that when the federal government first consulted his office about COVID Alert, the design of the app was good but it didn’t meet all the key privacy principles outlined in the commissioner’s framework on data collection amid the pandemic.
After discussions with the commissioner’s office, the app did end up complying with the framework. Therrien notes that this example shows that when government institutions or companies want to adopt Privacy by Design, they can.
“Despite the fact that such applications are extremely privacy sensitive and the subject of global concern for the future of democratic values, the government asserted that the federal Privacy Act does not apply to the initiative, based on its view that the COVID Alert does not collect personal information,” Therrien notes.
Although the app is voluntary as it relates to the government, Therrien notes that there is still a possibility that third parties may seek to compel app users to disclose information as to their use of the app, including any exposure notifications.
Therrien notes that the federal and provincial governments undertook to state publicly that Canadians should not be required to use the app.
“This step will mitigate, but not eliminate, the risk to the voluntary nature of the app. Other countries have legislated to ensure similar apps are completely voluntary. This again highlights an issue that should be examined as part of legislative modernization,” the report reads.
Moving forward
The commissioner notes that the recommendations laid out for legislative change in its annual report from last year are “extremely relevant” for addressing the new challenges raised by the pandemic.
The report outlines that data breaches have affected tens of millions of Canadians and public opinion research indicates that 90 percent of Canadians are concerned about their inability to protect their privacy.
Only 38 percent believe that businesses respect their privacy rights, while just 55 percent believe the government respects their privacy.
“We need laws that set explicit limits on permissible uses of data, rather than be left to rely on the good will of companies to act responsibly,” the report outlines.
Therrien notes that the growing role of public-private partnerships creates additional complexity and risk, and that we urgently need rights-based privacy laws that allow technologies to produce benefits while privacy rights are protected.
Image credit: Office of the Privacy Commissioner of Canada
MobileSyrup may earn a commission from purchases made via our links, which helps fund the journalism we provide free on our website. These links do not influence our editorial content. Support us here.
