CCLA and Partners Question Government on Decision to Share COVID-19 Test Results with Police

Last week police services across Ontario quietly got access to a new database – a COVID-19 testing database, with the names, addresses, and dates of birth of those who have tested positive for the virus.

Today CCLA joined with three other organizations to write to the Solicitor General and question the utility and the legality of these measures.

Providing personal health information directly to law enforcement is an extraordinary invasion of privacy. Such a measure should only be taken when clearly authorized by law and absolutely necessary given the particular circumstances. In early April the government passed an emergency regulation to facilitate the sharing of COVID-19 status with first responders. At the time the Information and Privacy Commissioner of Ontario objected to the emergency order authorizing this disclosure because the government was not able to demonstrate that the order was necessary to enhance public safety. The regulation was passed despite their objections.

And now Ontarians’ personal health information has started to flow to law enforcement. But significant questions remain about how, exactly, COVID-19 test results will assist first responders in protecting themselves and the public.

First, any database listing individuals who have tested positive for COVID-19 in Ontario will be underinclusive. The government currently has restrictive testing criteria, and many individuals who have COVID-19 may not have received a COVID-19 test. Police officers, like all first responders, must operate under the assumption that everyone they come into contact with is a potential active carrier. Infection control measures targeting only individuals who have tested positive for COVID-19 will be ineffective at protecting frontline workers. Universal precautions are necessary, and it is not clear what – if any – additional protective measures police officers and other first responders could or would take based on Ontario’s incomplete COVID-19 testing information.

Second, according to the regulation and government statements the information that will be provided does not include the date that an individual tested positive.^[1] This means that old, outdated test results could incorrectly identify people as having COVID-19 when they have already recovered and are no longer contagious.

It is difficult to understand how first responders will effectively use testing information that is both incomplete and out of date. Indeed, there is a real risk that using this database will create a false sense of security when first responders are interacting with individuals who have not been flagged, thus serving to create rather than mitigate danger.

Sending Ontarians’ private health information to law enforcement is an extraordinary privacy violation. And if having this information is not strictly necessary to respond to the pandemic, then sharing it is not legal. In our letter we put a number of critical questions to the government – and we will be sure to post any response we receive.

[1] https://news.ontario.ca/mcscs/en/2020/04/ontario-takes-additional-measures-to-protect-first-responders-during-the-covid-19-outbreak.html.