Consumers and COVID-19

Remarks at the Option consommateurs virtual conferences day

March 25, 2021

Speech delivered by Daniel Therrien
Privacy Commissioner of Canada

(Check against delivery)

---

Introduction

I would like to begin by thanking Option consommateurs for the invitation to speak to you about privacy issues during a pandemic.

The Office of the Privacy Commissioner of Canada has enjoyed a close relationship with Option consommateurs for more than a decade. You have always been at the forefront of emerging privacy issues, and your organization has made major contributions to research and awareness in Quebec and throughout Canada.

By paying particular attention to vulnerable groups, Option consommateurs has undoubtedly helped better protect the privacy of many people.

Risks and benefits of technology during a pandemic

The pandemic has raised numerous issues for the protection of personal information.

Technologies have been very useful in halting the spread of COVID-19. They have allowed us to continue carrying out our essential activities safely. The pandemic has greatly accelerated the digital revolution, which was already progressing rapidly.

That being said, digital technologies also pose new privacy risks. For example, telemedicine creates risks to doctor-patient confidentiality when virtual platforms involve commercial enterprises.

Similarly, online education platforms can collect sensitive information related to students’ learning difficulties and behaviour.

Digitization is also seen as key to our economic recovery. This is not a bad thing, as long as we institute and adapt laws to make sure our rights are protected in this environment.

Exceptional measures during a pandemic

The pandemic has not only accelerated the use of technology, but it has also led society to consider measures that would normally be seen as unacceptable, due to their infringement on our rights.

I am referring, for example, to the introduction of tracking apps and the more recent discussions surrounding vaccine passports.

During times of crisis, we should take a flexible and contextual approach to applying the law, but the law must be applied. Privacy should not be a barrier to public health, but neither should the pandemic be used as an excuse to waive our rights.

We have translated this approach into a framework for assessing privacy-sensitive pandemic initiatives, which informed a joint statement issued with my provincial and territorial colleagues.

Consistent with this framework, we supported the deployment of the COVID Alert app for public health protection purposes. However, we recognized the risk that companies might seek to use the data contained in the app as a prerequisite for certain services. There was therefore a risk that the app could be misused. Quebec was the only province to eliminate this risk, thanks to an order in council adopted by the government.

The notion of vaccine passports deserves similar scrutiny. Quebec has established an immunization registry in the interest of public health. Should proof of vaccination be used in other circumstances, such as when accessing services? Under our framework, and in accordance with recognized privacy principles, this should only be allowed if the measure meets the tests of necessity and proportionality and is based on sound science.

At present, it appears that science cannot yet provide a clear answer as to whether COVID vaccines are effective in reducing disease transmission to people other than vaccine recipients. At the federal level, Canada’s chief scientist is expected to release a report on the scientific merit of vaccine passports and for what purposes soon. I look forward to reading this report before making any further comments.

Context

Technology and data have been useful in managing the pandemic and they will play a major role as we move toward recovery.

I am convinced we can protect privacy while also encouraging technological innovation. These are not contradictory values. They can indeed coexist. It is really a question of design: of the products themselves and of the laws that govern their use.

A recovery based on innovation will only be sustainable if it successfully protects the interests and rights of all citizens. Our laws can provide this protection, and we must ensure that they do.

To that end, we currently have two bills, in Quebec and in Canada, that seek to modernize legislation in dire need of an update.

Legislative reform

At the federal level, Bill C-11 would introduce the Consumer Privacy Protection Act to replace existing private sector privacy legislation.

The government has set out important objectives for the bill, including increasing consumers’ control over their data, enabling responsible innovation, and establishing quick and effective remedies, including the ability to impose significant financial penalties. I support these objectives. Unfortunately, my analysis of the bill’s provisions leads me to conclude that they would not be achieved.

Control

Take, for example, the issue of consumer control. Bill C-11 seeks to increase it, in part by adopting certain aspects of our guidelines for obtaining consent. But it leaves out an important facet of our current legislation, the idea that meaningful consent requires that the person giving it understands the consequences of what they are consenting to.

Moreover, the privacy notices that serve as the basis for consent would still be allowed to use vague, if not obscure, language to describe the purposes for which companies intend to use a person’s data.

While legislation in other jurisdictions include the requirement to identify “specified, explicit and legitimate” purposes, this does not appear in Bill C-11.

In my opinion, this would result in less consumer control than under the current law.

Access to quick and effective remedies

The bill seeks to enforce its provisions through quick and effective remedies.

In many countries, this is done by granting regulatory authorities the power to issue compliance orders and impose significant monetary penalties.

The provisions to that effect in Bill 64 are excellent. The same cannot be said for those set out in the federal bill.

First, Bill C-11 lists only a few violations as being subject to administrative penalties. This list does not include obligations related to the form or validity of consent, nor the numerous exceptions to consent, which are at the core of protecting personal information.

It also does not include violations to the principle of accountability, which is supposed to be an important counterbalance to the increased flexibility given to organizations in the processing of data.

Bill C-11 also creates an additional layer of decision-making in the form of the Personal Information and Data Protection Tribunal, which would be responsible for imposing monetary penalties and hearing appeals against decisions of the Office of the Privacy Commissioner of Canada (the OPC).

We believe that this tribunal, which does not exist in this form anywhere else, would create unnecessary delays for consumers. The courts are perfectly capable of reviewing the legality of OPC decisions.

Worse, it would encourage companies to choose the route of appeal rather than finding common ground with the OPC when we are about to issue an unfavourable decision.

We believe that the addition of this tribunal would only delay access to justice for consumers.

Under Bill 64 in Quebec, there would be no delay due to a new layer of decision-making and no limit on offences subject to administrative penalties.

Responsible innovation

We agree with the government that the legislation should enhance consumer confidence and maximize the digital revolution’s potential to boost socio-economic development. Indeed, we have witnessed the benefits of technology throughout the pandemic.

A modern law should encourage responsible innovation by allowing companies to use data for the common good. For example, the bill provides for new exceptions to consent, thereby giving businesses greater flexibility.

We believe that adopting new exceptions to consent is a reasonable course of action. In today’s complex digital economy, it is often neither realistic nor reasonable to ask individuals to consent to all possible uses of their data. The power dynamic is too uneven.

However, there are a number of problems with Bill C-11. First, some of the new consent exceptions are too broad or ill defined to foster responsible innovation. Second, the new flexibility given to companies is not matched by increased accountability. Lastly, we believe that this flexibility should be exercised within the framework of a law that recognizes privacy as a human right. This is not the case under Bill C-11.

A rights-based foundation

Let us begin with this last issue. Any reform initiative should start by enshrining the right to privacy as a human right—a basic requirement for the exercise of other fundamental rights. This is because we have seen time and again how digital technologies have been used to violate these rights.

A rights-based law would recognize the inherent nature of the right to privacy and establish it in a modern and sustainable way.

At a minimum, the law should provide objective standards, democratically adopted in the public interest, to assure consumers that their participation in the digital world will no longer depend on their “consent” to practices imposed unilaterally by the private sector.

This is the approach I have put forward in my last two annual reports to Parliament.

A number of provisions in Quebec’s Bill 64 are consistent with our approach. For example, the Bill includes provisions that address profiling and protect the right to reputation. It also subjects political parties to the private sector law.

Exceptions to consent that are too broad or ill defined

The bill seeks to provide greater flexibility to organizations through new exceptions to consent. However, certain exceptions are too broad or ill defined to promote responsible innovation.

For example, one new exception is based solely on the impracticality of obtaining consent. Such an approach would render the principle of consent meaningless.

In our view, responsible innovation would be far better served by adopting an exception to consent based on legitimate business interests, as part of a human rights-based law, as we recommended in our recent report on artificial intelligence. Strangely, the Bill does not propose this measure, which would be favourable to organizations.

New flexibility without increased accountability

Greater flexibility in the way organizations use data should come with greater accountability. Even industry has long recognized this principle.

We believe the current principle of accountability is weakened in the federal bill. It does not define the concept of accountability in a prescriptive way, as Bill 64 does in Quebec, by establishing the obligation to adopt policies and procedures that ensure compliance with the law. Instead, the federal bill defines accountability descriptively, as the set of procedures that companies choose to put in place. This is in fact a form of self-regulation.

In a world where companies have greater flexibility in their use of personal information, we believe it is only fair that these companies be subject to proactive audits, to ensure that they use this flexibility responsibly and in accordance with the law.

This is the case in Quebec, as in many other jurisdictions, where the Commission d’accès à l’information has the power to request any information or document to verify compliance with the law. The federal bill would not allow the OPC to conduct such audits.

Conclusion

The past few years have opened our eyes to the important benefits and worrying risks that new technologies pose to our values and to our rights. This has become even more evident since the start of the pandemic.

The issues we face are complex but the path forward is clear. As a society, we must project our values into the laws that regulate the digital space. Our citizens expect nothing less from their public institutions. It is on this condition that confidence in the digital economy, damaged by numerous scandals, will be restored.

All is not lost. We believe that with important amendments, the bill could become a solid legislative text that effectively protects the privacy of Canadians.

I look forward to a meeting with Minister Champagne on this matter, which demonstrates an openness on his part. I also hope to work with Parliament to this end.

The coming months will be critical for privacy protection in Canada.