The office of Alberta’s privacy commissioner has received approximately 250 assessments on the privacy implications of new virtual health-care practices since the beginning of the COVID-19 pandemic.
These reviews represent “an exponential increase in the number of virtual care solutions” being used in Alberta, spokesperson Scott Sibbald told The Logic. Before the pandemic, the office had received only “a handful” for a review.
The Logic surveyed all 10 provincial privacy commissioners, as well as their federal counterpart, to understand how their work may have changed during the pandemic. The enormous increase in Alberta is a sign of “the challenges the health sector was facing,” Sibbald said, but also an indication of the challenges privacy regulators across the country face in overseeing the accelerated deployment of digital technology in the last four and a half months.
Talking Point
The country’s privacy commissioners shared the many challenges of their job during the pandemic, with some worried that without proper oversight public and private bodies will use COVID-19 to increase surveillance. All reported that the requests they were dealing with were mostly pandemic-related, and changing day by day, from health care to the collection of information at the border to contact-tracing apps.
While only Alberta reported a significant increase, the country’s privacy watchdogs all expressed the difficulties of navigating this new reality, each reporting that the requests they were dealing with were mostly pandemic-related, and were changing day by day.
Alberta’s privacy commissioner has received such a high number of requests in part because the province’s Health Information Act mandates the submission of a privacy impact assessment request (PIA) before any new or changed administrative practice is implemented in the collection, use or disclosure of personal health information. It’s the only province with such a policy. Privacy commissioner Jill Clayton’s office has also asked health custodians to “at the very least, notify the Commissioner” about any changes via email, including details about “what the new program is meant to achieve and any safeguards for health information.”
This was in recognition of the fact that “security and privacy risks significantly increase when processes are interrupted, new processes are established or new tools are implemented during an emergency without proper planning or security and privacy controls,” Clayton’s office wrote in a March 19 post. “Public health is the number one priority, but ensuring security and privacy risks are considered and mitigated to the greatest extent possible will help reduce other incidents from emerging during these challenging months ahead.”
Meanwhile, the federal privacy commissioner’s office has received 28 PIAs since March 1 that “vary in scope from the provision of COVID-19 benefits to the Government of Canada Exposure Notification App,” according to spokesperson Vito Pilieci. The office is barred from sharing details of the PIAs, but Pilieci noted the requirements of the process were amended on March 13 to a “less rigorous” approach to speed up urgent pandemic initiatives.
Newfoundland and Labrador’s privacy commissioner Michael Harvey told The Logic that his workload had “changed substantially” during the pandemic. While his office does not mandate the formal submission of PIAs, and only reviewed one pertaining to the federal contact-tracing app, his office saw “a rise in policy work” as he consulted with various government departments about privacy-related issues that could arise with everyone working from home.
It’s invested a “fair amount of effort” in ensuring access-to-information requests were maintained by offering extensions on their deadlines. Harvey also said the provincial government consulted him on a contact-tracing app, before the federal government announced a national one and upended those plans.
“The pandemic can be a justification for a detailed level of surveillance of our society to try to keep us healthy,” Harvey said. “The amount of data that corporations and our public bodies are collecting on us is increasing pretty dramatically…. My concern is that … we end up in 2023 with governments that have used the pandemic as a foot in the door to a society that is surveilled in a much heavier way than we imagined.”
B.C.’s privacy commissioner is prohibited from revealing any information about the activities of its office, but has been very involved in discussions throughout the province on COVID-19-related matters, and has reviewed “many PIAs” related to the virus.
Ontario has reviewed six PIAs related to the pandemic, including some related to smart-city initiatives and the policing sector. The province’s privacy commissioner has been consulted mainly on “the potential privacy implications of the exposure notification application, COVID Alert,” commissioner Patricia Kosseim’s office said in a statement to The Logic. Prince Edward Island also received six PIAs during the pandemic, two of which pertained to virtual health care.
Not all provinces are seeing a pandemic-related increase in privacy concerns. Nova Scotia’s privacy commissioner has received three PIAs, none of which were related to the pandemic. New Brunswick, Manitoba and Quebec do not mandate PIAs, sharing only that they were having more pandemic-related conversations.Quebec, for instance, has released guidance on privacy considerations for public health authorities during the pandemic. Saskatchewan did not respond to The Logic’s request for information by the time of publication.
New Brunswick ombudsman Charles Murray told The Logic the privacy issues in every province are still the same, but “now they just happen in the context of the pandemic … which has interrupted some of our normal accountability measures.” That has meant that his office has had to consider new scenarios, like how best to collect information from travellers to the Atlantic bubble in a way that’s both secure and efficient to avoid long lineups.
Many of these issues, according to Murray, are best exhibited in the consultations that have been taking place among the country’s privacy commissioners about the national exposure-notification app, COVID Alert. While the country’s privacy commissioners are in agreement on the framework of any app, Murray worries about the “additional complication” of oversight, as it is released in every province but run by Ottawa.
Harvey agreed. “We all expect that the world after the pandemic will not be the same as it was before,” he said. “We should use this opportunity to show how we can achieve what we need to achieve without increasing surveillance. That’s the clever thing about this contact-tracing app … it’s managing to support contact tracing without the collection of personal info, and achieve that policy goal without a heightened level of surveillance.”
