COVID-19 pandemic accelerating digital privacy risks, federal watchdog warns

OTTAWA — The COVID-19 pandemic is underscoring weaknesses in Canadian privacy law that place people’s personal information at risk, a federal watchdog warns.

In his annual report presented Thursday, privacy commissioner Daniel Therrien said the pandemic is fuelling rapid societal and economic changes at a time when outdated laws provide inadequate protection.

The spread of the virus and the resulting need to distance oneself from others has accelerated the digital revolution, bringing both benefits and risks for privacy, Therrien said.

He cited the heated debates about contact-tracing and exposure-alert applications and their effect on privacy, and the fact many have been asked to provide details about their health at airports or before entering workplaces and stores.

Telemedicine creates risks to doctor-patient confidentiality when virtual platforms involve commercial enterprises, he said. In addition, e-learning platforms can capture sensitive information about students’ learning disabilities and other behavioural issues.

“It should be obvious for everyone that privacy protection is weak,” Therrien told a news conference.

The commissioner’s office gave the thumbs-up to the government’s COVID Alert app, intended to tell people when they have come near someone who has the virus.

However, government officials declared during discussions about the digital tool that federal privacy law did not apply to the app, Therrien said.

“This assertion certainly gives one pause: An extremely privacy-sensitive initiative is defended by the government of Canada as not subject to its privacy laws.

“Privacy is considered by the government as a good practice but not a legal requirement. How long can this go on?”

Therrien has repeatedly called for modernization of Canada’s privacy laws, which lag behind many around the globe.

He has pressed for new authority to issue binding orders to companies and levy fines for non-compliance with privacy law. Therrien also wants powers to inspect the information-handling practices of organizations.

Rachel Rappaport, a spokeswoman for Justice Minister David Lametti, said the government is committed to reviewing the Privacy Act, which applies to government agencies and federally regulated industries, to ensure it keeps pace with the effects of technological change and evolving Canadian values.

The government has already solicited the views of experts and interested parties, and it plans to consult the broader public soon, she said.

Canadians are understandably anxious about how their data is being used in an increasingly digital world, said John Power, a spokesman for Innovation Minister Navdeep Bains.

The government is moving to strengthen the Personal Information Protection and Electronic Documents Act, which covers private-sector organizations, he said.

“Our government will ensure respect for the privacy of Canadians, support responsible innovation and enhance reasonable enforcement powers.

“We expect to have more to say on this soon.”

A recovery from the pandemic based on innovation will be sustainable only if rights are protected through stronger legislation, Therrien said.

“It is more than time for Canada to catch up to other countries,” he said. “All Canadians deserve strong privacy protections.”

This report by The Canadian Press was first published Oct. 8, 2020.

Jim Bronskill, The Canadian Press