The federal privacy commissioner has little faith current laws are strong enough to protect the rights of Canadians if governments approve a COVID-19 contact tracing app.
Asked Friday by a parliamentary committee if he is confident current privacy laws would protect Canadians if there was a privacy breach in a contact tracing app, Commissioner Daniel Therrien was firm.
“No I am not,” he told the House of Commons standing committee on Industry, Science and Technology. “My office has been talking for several years about the fact than our legal framework needs to be modernized and strengthened, and the current crisis shows need to accelerate the technological revolution that was at play before COVID. This acceleration requires an even stronger legal framework.”
The Personal Information Protection and Electronic Documents Act (PIPEDA), which covers data collected by businesses in all provinces except British Columbia, Alberta and Quebec (which have their own privacy laws) is more an industry code of practice, Therrien said a year ago. An updated law should give Canadians the right to privacy.
Therrien and provincial privacy commissioners said last month that governments should at least commit that any approved apps must meet six privacy principles that ensure the installation of an app is voluntary and ensures governments promise any personal data collected will be for defined public health purposes only. These principles also should also promise personal data collected will be destroyed after the crisis ends.
Therrien said that if an app is designed that follows those principles it could protect Canadians’ privacy. “When properly designed, tracing applications could achieve both objectives simultaneously, in terms of public health and the protection of rights. If implemented inappropriately, they could lead to surveillance by governments or businesses that exceeds public health needs and is therefore a violation of our fundamental rights.”
But, he noted, nothing currently in PIPEDA requires personal data collected only be used for public health tracing purposes. Nor, he added does the law prevent a company that offers a contact tracing app from using data collected for commercial purposes. The current law now only requires a company to obtain consent “based on an ambiguous privacy policy.”
Another reason to update PIPEDA is the increase in videoconferencing in medicine and education means more privacy protection for these technologies is needed, he added.
Prime Minister Justin Trudeau has acknowledged bureaucrats are looking at about 12 possible apps without detailing what criteria is being asked for or considered. Therrien shed some light by noting a research institute has been asked by Trudeau’s science advisor to look at whether current federal and provincial laws would allow provincial privacy commissioners to have a watchdog role over apps.
Asked if a privacy law covering COVID apps would be better rather than waiting for a full overhaul of PIPEDA, Therrien said he the law could be modified including covering public-private transfers of personal data.
He also made it clear…
EU confirms PIPEDA’s adequacy status under the GDPR
In a Report issued two weeks ago,[1] the European Commission advised that i…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
