- Public health crisis has pushed daily activities online, underscoring critical need for change. -

The COVID-19 pandemic is raising important new privacy issues in a context where federal laws do not provide Canadians with effective protection, according to the Privacy Commissioner's latest annual report.

The report discusses the Office of the Privacy Commissioner of Canada's work to assist public and private sector organizations during the public health care crisis as well as lessons drawn from that work.

New public health measures such as contact tracing applications are raising questions about privacy protection around the globe. At the same time, the need for social distancing has accelerated the digitization of daily activities that also raise privacy concerns.

"Federal laws are simply not up to protecting our rights in our rapidly evolving digital environment," says Commissioner Daniel Therrien. "Privacy and the pursuit of public health and economic recovery are not contradictory. They can, and must be, achieved concurrently."

"We need a legal framework that will allow technologies to produce benefits in the public interest while also preserving our fundamental right to privacy. This is an opportune moment to demonstrate to Canadians that they can have both."

Since the beginning of the pandemic, technologies have been very useful in halting the spread of COVID-19 by allowing essential activities to continue safely.

They are also creating new risks. For example, telemedicine creates risks to doctor-patient confidentiality when virtual platforms involve commercial enterprises. E-learning platforms can capture sensitive information about students' learning disabilities and behavioural issues.

The Commissioner cited his office's review of the COVID Alert exposure notification application as an example of how privacy respectful practices can be built into the design of an initiative to achieve public health goals. Indeed, the office's work during the pandemic has shown that privacy is not an impediment to public health and other public interests.

However, the pandemic is creating challenges that underscore how good privacy protection must not be merely something government and companies are free to do if they wish, but rather a legal requirement they must respect.

Despite the positive conclusion to discussions on COVID Alert, the federal government asserted that the app does not collect personal information and therefore the Privacy Act did not apply.

Canada was once a world leader on privacy, but federal privacy laws have fallen behind much of the rest of the world. While many of our trading partners have spent the past decade building up robust protections for data protection.

Other work by the OPC

The Commissioner's annual report also addresses other work under the Privacy Act, which applies to the federal public sector; and the Personal Information Protection and Electronic Documents Act, Canada's federal private sector privacy law. This includes statistical information, descriptions of business and government advisory work, as well as summaries of investigations.

Highlighted investigations include one that examined privacy issues related to RateMDs.com, a website where patients can rate and review health care professionals, and another related to a leak related to a Supreme Court nomination. Both of these investigations reinforced the need to modernize federal privacy laws.

SOURCE: Office of the Privacy Commissioner of Canada