News release

Privacy Commissioner’s Special Report on pandemic-related investigations tabled in Parliament

Note: This news release has been updated to indicate that, on May 30, 2023, the Canada Border Services Agency (CBSA) advised that it has corrected the inaccurate personal information generated by its ArriveCAN application.

GATINEAU, QC, May 30, 2023 – The Privacy Commissioner of Canada’s Special Report to Parliament outlining the findings of several investigations and advisory initiatives that examined the federal government’s privacy practices in relation to pandemic measures was tabled in Parliament today.

The Special Report finds that the federal government’s collection and use of personal information to track and control the spread of COVID-19 was generally done in compliance with privacy law, but highlights some key observations and important lessons learned from the privacy-related impacts of pandemic measures.

“Our COVID-19 work found that the collection, use, disclosure and retention of personal information by federal institutions complied with the Privacy Act, with a few exceptions,” Commissioner Philippe Dufresne said.

“Nonetheless, it also underscored important deficiencies in our public sector privacy law which is long overdue for modernization.”

For example, a broadly accepted principle that requires potentially privacy-invasive initiatives to first be assessed as both necessary and proportional is currently a government policy but not a legal requirement. The current law also does not adequately address the use of de-identified data or automated decision-making. Several pandemic investigations raised concerns about weaknesses in these areas.

Overall, the Office of the Privacy Commissioner of Canada (OPC) received approximately 100 formal complaints related to the COVID-19 crisis. Pandemic-related privacy concerns were also the subject of numerous media reports and testimony before parliamentary committees. Furthermore, the OPC’s latest survey of Canadians found that 40 per cent of those polled said that they were more concerned about privacy now than they were at start of the pandemic.

“Privacy matters to Canadians, and they need to know that they are not alone in protecting their fundamental right to privacy. The OPC is there to assist Canadians if they have questions or concerns about how their personal information is being collected, used, retained or disclosed,” Commissioner Dufresne said.

“It is important that individuals ask questions and seek clarity from government about the purposes for which their personal information is being collected, used and disclosed. This Special Report to Parliament is a direct result of these questions being asked, and demonstrates the important role that the OPC plays in ensuring that privacy is protected – even and especially in times of emergency.”

Early in the pandemic, the OPC took the position that during an emergency, it would adopt a flexible and contextual approach to applying the law, but that the law must still be enforced. The OPC maintained that greater flexibility to use personal information for the public good must be accompanied by greater transparency and accountability.

These were key considerations in all of the investigations and advisory work summarized in the OPC’s Special Report to Parliament: Protecting Privacy in a Pandemic. Below are some of the highlights:

ArriveCAN

An investigation into the ArriveCAN application found that a software error led to the inaccurate identification of approximately 10,000 travellers as needing to quarantine. Those individuals were notified of the error about a month later. Given the important consequences for the rights and mobility of incoming travellers, the OPC found that the Canada Border Services Agency (CBSA) contravened the Privacy Act by not taking all reasonable steps to ensure that information about individuals recorded in the app was accurate. The OPC highlighted that when institutions use automated decision-making in situations with potentially substantial impacts on individuals, it is critical that they implement additional safeguards such as rigorous testing, effective human intervention, and timely correction and recourse for individuals where necessary. The OPC recommended that the CBSA correct the inaccurate information generated by the error. The CBSA initially advised on February 21, 2023, that it would not do so. The OPC’s Report of Findings was issued on that basis. However, on May 30, 2023, the date of tabling the Special Report, the CBSA informed the OPC that it has corrected the erroneous information in its database.

Collection and use of mobility data

An investigation into widely publicized concerns over the government’s collection and use of mobility data found that the de-identification measures and safeguards against re-identification used were adequate. The OPC found that the government did not collect personal information and therefore, that the Privacy Act did not apply. Nonetheless, the OPC repeated its calls for federal privacy laws to be amended to include a clear legal framework that defines the different types of de-identified data, and specifies the rules that should govern the production, retention, use, disclosure, and collection of each type.

Although third party data providers were not investigated, the OPC reminded government institutions of their obligation to ensure that the third parties from which they source data have themselves collected personal information in a manner that respects privacy law. Finally, the OPC recommended that in the future, more steps should be taken to improve transparency and ensure that Canadians are well informed about these types of programs.

Vaccine mandates for domestic and international travel

The OPC investigated vaccine mandates for domestic air and rail passengers and international travellers entering Canada. The OPC found that the federal institutions involved complied with the Privacy Act. It also found that overall, the mandatory collection of vaccination status under these mandates was necessary and proportional. However, in both cases the OPC identified gaps with respect to the assessment of potentially less privacy-invasive alternatives, such as pre-arrival COVID-19 testing, and the need for more clarity about what the mandates were trying to achieve. The OPC recommended that moving forward, institutions should more clearly define the scope and intended objectives of such measures, and consider and document their assessment of potentially less privacy-intrusive alternatives. The institutions agreed to implement these recommendations.

The report also details the OPC’s findings from three investigations into vaccine attestation requirements for federal public servants, and the results of its engagement with several institutions given new powers to collect and disclose personal information when the Emergencies Act was invoked in response to widespread protests over vaccine mandates.

Further reading

Special Report to Parliament: Protecting Privacy in a Pandemic

Contact information for media

Office of the Privacy Commissioner of Canada
Communications@priv.gc.ca