The Privacy Commissioner’s office has launched a framework for the federal and provincial governments to assess initiatives that impact privacy amid the COVID-19 pandemic.
“During a public health crisis, privacy laws and other protections still apply, but they are not a barrier to the appropriate collection, use and sharing of information,” the commissioner’s office notes.
The framework outlines that existing privacy legislation, norms and best practices for data collection, use and disclosure ensure responsible data use and sharing that supports public health.
“Government institutions should still apply the principles of necessity and proportionality, whether in applying existing measures or in deciding on new actions to address the current crisis,” the office outlines.
The first key point in the framework is to identify the legal authority to collect, use and disclose personal information. This means that government institutions must uphold the Privacy Act. The measures that the government institution wants to take must also be necessary and proportionate, which means that the measures should be evidence-based and not overboard or extreme.
Next, the personal information collected, used or disclosed to alleviate public health effects of COVID-19 must not be used for other reasons. The data should also be de-identified whenever possible.
Further, the impacts of data collection on vulnerable people should be assessed. For instance, algorithmic decision-making or AI may contain biases that could create disproportionate impacts.
Another key point asks government institutions to provide clear and detailed information to Canadians about new and emerging measures, on an ongoing basis.
“Transparency is a cornerstone of democratic governance, as well as our privacy laws. It is all the more vital in the midst of a crisis, when extraordinary measures are being contemplated,” the framework states.
The framework notes that there should also be oversight and accountability in the form of new laws and measures.
Lastly, and possibly most importantly, the privacy invasive measures should be time-limited, with obligations to end when they are no longer required. The personal information that was collected should also be destroyed when the crisis ends.
Although Prime Minister Justin Trudeau confirmed that the government is not currently using cellphone data to curb the spread of COVID-19, he noted that all options are on the table.
MobileSyrup may earn a commission from purchases made via our links, which helps fund the journalism we provide free on our website. These links do not influence our editorial content. Support us here.
