Data Surveillance by Canadian Governments as COVID Response: CCLA’s Privacy Protection Prescription

April 20, 2020

Rt. Hon. Prime Minister of Canada

Hon. Premiers of Nunavut, North West Territories, Yukon, BC, Alberta, Saskatchewan, Manitoba, Ontario, Quebec, Nova Scotia, PEI, New Brunswick, Newfoundland & Labrador

BY EMAIL

Re: Data Surveillance Technology and COVID-19 Response in Canada

Dear First Ministers,

We are writing you about the use of technologically-mediated surveillance as a public health response to the COVID pandemic.  We are not addressing the use of technology generally by Canadians, voluntarily, nor the urgent need to modernize our privacy laws in and out of a pandemic.

The present focus of the Canadian Civil Liberties Association (CCLA), set forth in this letter, is narrowed to future government orders (by order-in-council or like executive instrument) requiring or authorizing the use of surveillance by public officials as part of its COVID19 response, or government orders mandating that residents of a Canadian jurisdiction employ a technology in order to enjoy a pre-COVID19 freedom.

Canadian governments have the opportunity and responsibility to learn from the approaches of other countries. To be sure, there are no magic bullets — not in big data, not in automated decision-making about individual risk, and not in automated contact tracing.[1]  This is not to suggest that technology can never support public-health led efforts.  However, involuntary collection of information by governments remains unwarranted today and any requests for voluntary participation should be considered carefully.  Nor should existing privacy laws be suspended for proposed public surveillance.

Of particular concern to CCLA is Canada’s lack of legislative and executive proficiency with data privacy.  For some time, Canada has fallen behind other jurisdictions like the European Union or US states like California, when it comes to data privacy laws, regulation and security.  To legalize data surveillance in a pandemic is therefore a high risk gamble with Canadian privacy rights.  We urge strict scrutiny of the efficacy of any new technological solutions to COVID19.  If pursued, they must accord with constitutional principles of due process, liberty, equality and privacy.

Accordingly, CCLA proposes that the following recommendations apply to any executive order or law enacted as a response to COVID19:

1. Data surveillance only be undertaken as a last resort and only where
   1. there is meaningful consent by the individuals concerned, even where a legal exception to consent applies (such as lawful authority and public notice);
   2. the objective of the measure being undertaken is legitimate (such as “flattening the curve” or otherwise minimizing the spread of the virus);
   3. the measure is demonstrably necessary, based on authorized public health evidence, not conjecture;
   4. the measure is likely to be effective (that is, the extent to which the measure will achieve, or will likely achieve, its objective);
   5. other solutions less privacy-invasive than the measure do not exist, and the measure’s intrusion on personal privacy is proportionate to the evidence-based public health benefit of the measure.

We will elaborate and add to (b)-(e), below.

2. Privacy Commissioners for the jurisdiction must be engaged prior to enactment and during implementation of any public health surveillance measures.
3. Data collection must be grounded in evidence of public health necessity, pursuant to a Chief Medical Officer Data ‘Warrant,’ or information request: e., a pre-condition for the creation or adoption of technological solutions for information gaps should be a formal written request by the Chief Medical Officer of the jurisdiction,  setting forth precisely why it is necessary to obtain this data, that such data is otherwise unavailable, and that the official believes the data is in fact obtainable, as well as that data’s intended usage by public health officials.
4. Proportionality must be certified through a legal balancing of means and ends, by the Chief Legal Officer of a jurisdiction, who would need to set out in writing just how the proportionality test is met for any particular use of data surveillance of individuals, including: the compelling objective set forth by the Chief Medical Officer’s Data Warrant, the rational connection between compelling objective and proportionate response; and further affirmation that the means infringes upon privacy rights as little as possible, with reference to why alternative measures are inadequate (i.e., if the information can be obtained by the presence of by-law or police officers, then there is no need for data surveillance).
5. An Impact Detriment Analysis for the Vulnerable must accompany any executive order, but particularly one involving surveillance, as an aspect of achieving proportionality, with input provided by human rights commissions. To ensure that the most vulnerable are not an afterthought, as a precondition to any government order, the government ought to disclose its detrimental impact upon vulnerable and marginalized populations, including identifying and publicizing measures which will be taken to mitigate such impact.
6. Firewall public health data for public health purposes, and away from police and public order officials. No data arising from COVID19 responses should be accessible to police, peace officers, by-law officials, Canadian Border Security or corrections officials, nor may any of it be used as evidence in any legal proceeding unrelated to a public health violation. Storage for data collected via emergency-specific surveillance must accord with privacy laws applicable to health records, with strict access controls, and mandated destruction of that data once the emergency has abated.
7. Time limit any data collection to the duration of the COVID19 emergency orders of a given jurisdiction.
8. Enhance transparency and accountability by a requirement that the chief public health officers and chief legal officers appear before a legislative committee (online or otherwise) as witnesses for questioning by legislative members prior to the implementation of surveillance measures.
9. Install independent oversight of the process and its implementation. For example, a jurisdiction could empower their Privacy Commissioners, or appoint an independent surveillance ombudsman, accountable to the jurisdiction’s legislative assembly, to oversee the foregoing process, to receive public complaints and provide recourse for rights infringements, to regularly report to the public as to their observations and the nature and number of complaints received, and eventually report to the elected assembly within a yearly quarter after the executive authorization or order is enacted.

In this crisis, our use of technology to improve public health must be grounded in evidence of effectiveness, and an understanding of what technology can do, and what it cannot. We insist that no data-driven initiatives in Canada serve to discriminate, stigmatize, or deny fundamental rights to people in Canada.

CCLA is a non-partisan, independent non-profit founded in 1964.  We have stood up to power in hundreds of Canadian courts and legislatures.  Our goal during this pandemic is to prevent civil liberties infringements where feasible, hold public authorities to account, and focus upon those most vulnerable to abuse of power.

[1] As a Director at the Singapore Ministry of Communications and Information puts it: “You cannot “big data” your way out of a “no data” situation. Period.” Jason Bay was the product lead for Singapore’s TraceTogether contact tracing application. No Bluetooth contact tracing system is ready to replace manual contact tracing, he has made clear, adding that automated notifications are unadvisable, even when developing an application in close coordination with local public health authorities, as was the case in Singapore. https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98

Michael Bryant
Executive Director & General Counsel

Brenda McPhail, PhD.
Director of Privacy, Technology & Surveillance Project