Ontario emergency order lacks accountability on data collection, says law professor

An Ontario emergency order — which compels public health authorities to give requested COVID-19 data to first responders— lacks built-in transparency or accountability measures, said Teresa Scassa, professor at the University of Ottawa Faculty of Law.

The order allows police, firefighters and paramedics to obtain information about individuals with whom they are coming into contact, including an individual’s name, address, date of birth, and whether the individual has had a positive COVID-19 test result. According to the provincial government, “strict protocols will be enforced to limit access to this information,” and once the declaration of emergency is lifted, this data will be “made inaccessible” to first responders.

Scassa, research chair in Information Law and Policy at the University of Ottawa, spoke on the ethics of COVID and pandemic privacy in a May 6 webinar hosted by Centre for Ethics at the University of Toronto.

As a human right, privacy is nonetheless weighed against other rights and interests — including the “undoubtedly very strong” interest in protecting public health, she said. In the case of Ontario’s emergency order, the two interests, privacy and public health, are clear, she said.

“The issue is: Does the order itself properly balance those interests? I would argue that it doesn’t,” she said, noting that the order doesn’t specify that the data request (for positive COVID-19 status) must be for a specific purpose. “It’s not enough to say that sometimes privacy has to be sacrificed in a crisis situation. There are good ways to do it and there are bad ways to do it.”

The COVID-19 pandemic escalated at a time when there was large-scale concern about privacy law in jurisdictions around the world — Canada included, said Scassa. There has been a growing collection of personal data by so many apps that has been hard to limit, she said, referencing large-scale privacy breaches and the Cambridge Analytica scandal.

“Prior to the pandemic in Canada there was considerable focus on tightening up private sector data protection laws,” she said. “Right from the start of the pandemic we see this problem with the porosity between the private sector collections of data and public sector.”

She drew the analogy with contact tracing, which is being used in several jurisdictions (including Alberta) to track the spread of COVID-19 using factors such as location data from mobile phones.

“That was a very specific example of a government tapping into, dipping into, stores of location data related to citizens, that were in the hands of private sector cell phone companies, essentially,” she said, specifically describing a system used in Israel.

In Europe, said Scassa, the culture of privacy that bolsters laws such as General Data Protection Regulation also underlies its contact-tracing efforts.

If we have admitted that our private sector data protection laws are “not up to snuff,” then pandemic or not, the level of porosity with the public sector “should be a matter of concern,” she said.

“This is something that the pandemic context highlights, but that we need to be aware of and thinking about going forward,” she said.

In Canada, privacy rules…

Read The Full Article