Announcement

April 17, 2020

Commissioner publishes framework to assess privacy-impactful initiatives in response to COVID‑19

The Office of the Privacy Commissioner of Canada (OPC) has published an assessment framework intended to assist government institutions faced with responding to the COVID-19 crisis.

The policy document is designed to guide the development of privacy impactful initiatives that seek to alleviate the effects of the pandemic.

The OPC recognizes that the current health crisis calls for a flexible and contextual application of privacy laws. As such, certain measures that would otherwise not be reasonable  may be justified under the circumstances to protect the health of Canadians. The framework is therefore a pared down yet more targeted version of the OPC’s expectations while providing an important analytical tool that reflects well-established principles found in privacy law.

“During a crisis, laws can be applied flexibly and contextually, but they must still apply. Our framework aims to focus on what we believe are the most relevant principles in context, without abandoning others,” says Commissioner Daniel Therrien. “Because privacy is a fundamental human right, it is very important in our democratic country based on the rule of law that key privacy principles continue to operate.”

The framework sets out some key privacy principles, including:

• legal authority: the proposed measures must have a clear legal basis
• the measures must be necessary and proportionate, and, therefore, be science-based and necessary to achieve a specific identified purpose
• purpose limitation: personal information must be used to protect public health and for no other purpose
• use de-identified or aggregate data whenever possible
• exceptional measures should be time-limited and data collected during this period should be destroyed when the crisis ends
• transparency and accountability: government should be clear about the basis and the terms applicable to exceptional measures, and be accountable for them

The framework complements previously issued guidance to help departments and organizations subject to federal privacy laws understand their privacy-related obligations during the COVID-19 outbreak.

The OPC is available to assist federal government organizations with questions regarding their responsibilities and authorities to collect or disclose personal information in the context of the COVID-19 pandemic.

Government departments may send an email providing details of their enquiry to the office’s Government Advisory Directorate at scg-ga@priv.gc.ca.

Private sector organizations subject to federal privacy law as well as individuals can contact the OPC by phone, email or online form to ask the OPC questions or request information.