Now and post-pandemic, better data privacy and protections are needed for Canadians

During the early days of the COVID-19 pandemic, when there was an urgent rush to collect critical health information in an attempt to limit spread, human rights organizations and political analysts reminded us of the need to preserve individual privacy. Almost a year later, it is not clear that these calls were heeded.

Around the world, human rights and privacy protections are being eroded. Personal data collected in the fight against COVID, often without the knowledge or consent of individuals, is being provided to and accessed by law enforcement agencies. Third-party data brokers are selling and reselling other data that provides information regarding individuals’ location, behaviour and health, often without their knowledge.

Regulatory barriers are few and inadequate. When contact-tracing apps first appeared, many people were reluctant to use them. Among other concerns, they feared what their own governments would do with such personal information.

Singapore — among other countries — promised that contact-tracing data would not be used for any other purpose. And so, while other countries have struggled to achieve the 60 per cent uptake needed for effectiveness, 80 per cent of Singaporeans signed up for Tracetogether, a contact-tracing program that includes a phone application (app) or a Bluetooth token. (In contrast, by late November 2020, only about 15 per cent of Canadians had downloaded Canada’s “COVID Alert” app.)

But now officials in Singapore have indicated that contract-tracing data could be used “for the purposes of criminal investigation.” Residents reacted by taking to social media to declare that they would be deleting the Tracetogether app.

While Singaporean officials have since sought to reassure residents that their information will be protected and only accessed for criminal investigations when necessary, public trust has been eroded. Digital rights activists suggest that this case could affect the willingness of individuals to participate in data collection in future crises.

As well, civil-liberties organizations discovered that police services across Ontario were using a COVID database to search wide geographic areas for information on individuals that was not related to any specific calls or investigations. After legal challenges were launched, Ontario ended police access to the database.

There are other privacy concerns. Because of the pandemic, many doctors are meeting with patients on virtual platforms. How can patients be certain that this personal data is not later collected by the companies that host the platform?

And what about third-party data brokers, which resell data, including observations about the health of individuals, to various companies, as well as to security and law enforcement agencies? Thousands of data brokerage firms around the world scrape information on individuals from websites, buy information from other data brokers, and find information by accessing user-downloaded applications.

Some of these activities, like scraping and reselling data, are illegal in some places. But more regulations are needed to eliminate legal gaps between jurisdictions.

New regulatory efforts offer hope that individuals’ information will be protected and users will know how their personal information is being used and collected. The European Union’s General Data Protection Regulation is perhaps the best known and does offer significantly more protection to consumers. Still, some critics suggest individuals will simply consent to information sharing without fully understanding terms and conditions.

Canada’s proposed Bill C-11 offers an important update to existing privacy regulations. The bill creates a new Consumer Privacy Protection Act and a new Personal Information and Data Protection Tribunal Act, replacing the Personal Information Protection and Electronic Documents Act. However, University of Ottawa law professor Teresa Scassa notes the bill contains provisions that might be used by companies to share data without securing the consent of individuals.

All concerns regarding data privacy require urgent attention. As the modern information systems being developed by governments and private companies make greater use of artificial intelligence, they are becoming more dependent on the data of individuals. Thus, individuals might find that, without their permission or knowledge, their personal data is being used in ways that directly impact their lives.

In speeding up the demand for personal data, the pandemic has highlighted flaws in protections for that data. Like no other single event, it has revealed the global need for multilevel regulations to ensure data privacy is protected as a fundamental human right.