Public and private sector privacy laws need an update: Therrien to Ethics committee

Privacy Commissioner Daniel Therrien has followed up his testimony to the House of Commons Ethics Committee with a detailed letter outlining issues of consent and transparency. The commissioner testified before the committee last month. The Parliamentarians are investigating the use of de-identified, aggregated mobility data by the Public Health Agency of Canada (PHAC). While stressing his comments were general and should not be interpreted as answering questions currently being investigated by his office, Therrien noted that there are legislative solutions beyond gaining full consent from people to have their data used by governments or by the private sector. Transparency remains important. He cited provisions in the General Data Protection Regulation (GDPR) of the European Union that cover not only the collection of information but protection when it is changed during processing, such as de-identification and aggregation. “Within Canada, transparency requirements in both our federal privacy laws remain, at present, inadequate,” the seven-page letter stated. Although the Personal Information Protection and Electronic Documents Act (PIPEDA), which covers the private sector, requires companies to make specific disclosures about its policies of personal data management, in practice this leads to complex policies that do not properly inform consumers. Legislation is needed to ensure people know what data is being collected, the use of that information and with whom it is shared. “Neither of our federal privacy laws specifically address de-identified information, which demonstrates the urgency of legislative modernization to keep pace with the digital era,” Therrien wrote in Mar. 1 letter. He said he was supportive of measures in Bill C-11 in the last Parliament and the Justice Department’s consultation paper on modernizing the Privacy Act, which covers the public sector. Both the bill, which died on the Order Paper due to last year’s election, and the paper called for increased flexibility to use de-identified data while keeping it within privacy law. Quebec updated its privacy laws last year and Ontario did the same two years ago to focus on de-identified information. Reliance on data will only become more necessary as time goes on, the letter stated. The COVID-19 pandemic has shown that digital technology can serve the public benefit. But legislation must balance the public good with the need for privacy. Increased flexibility should come with enhanced accountability. “We do not need more ‘self-regulation’ but instead true regulation, supported by objective, knowable standards, adopted in law, and enforced by independent institutions that can ensure organizations are truly accountable,” Therrien said. The commissioner said he could not answer questions about the risk of re-identifying the information PHAC collected, as his office is investigating the matter. However he said that any de-identification process must assess the danger of re-identification. Safeguards should be in place, he added, and access must be restricted. There is always a risk of re-identification, although it is less for aggregated data, the letter said. Location data presents unique challenges. Safeguards should be enhanced. PHAC’s contracts for collecting mobility data were with Telus Corp. and Blue Dot Corp. Telus contacted Therrien’s office on April 8, 2020 to inform it about the contract. PHAC informed the office on April 21, 2020. “Telus shared a public statement it intended to issue, on which it sought our comments,” Therrien wrote. “We offered a number of comments, suggested Telus consult pandemic related guidance we had recently published at the time, and recommended that if and when Telus had concrete proposals or initiatives with governments, researchers or third parties, they may wish to consult our Business Advisory Directorate to obtain advice.” The privacy commissioner testified before the committee that PHAC had rejected an offer to consult on the contract. In his Mar. 1 letter he stated that the agency concluded that since the data was de-identified and aggregated, it did not fall under the provisions of the Privacy Act. –Reporting by Paul Park at ppark@thewirereport.ca and editing by Michael Lee-Murphy at mleemurphy@thewirereport.ca

Public and private sector privacy laws need an update: Therrien to Ethics committee

News | March 3, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Public and private sector privacy laws need an update: Therrien to Ethics committee

News | March 3, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Supreme Court agrees to review Facebook’s arguments in privacy case

Key Liberal ministers and parliamentary secretaries re-elected, NDP counterparts shut out in election

Privacy commissioner seeks court order against Pornhub parent company

Privacy Commissioner investigating Elon Musk’s X platform

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us