Ontario emergency order lacks accountability on data collection, says law professor

An Ontario emergency order — which compels public health authorities to give requested COVID-19 data to first responders— lacks built-in transparency or accountability measures, said Teresa Scassa, professor at the University of Ottawa Faculty of Law. 

The order allows police, firefighters and paramedics to obtain information about individuals with whom they are coming into contact, including an individual's name, address, date of birth, and whether the individual has had a positive COVID-19 test result. According to the provincial government, “strict protocols will be enforced to limit access to this information,” and once the declaration of emergency is lifted, this data will be “made inaccessible” to first responders.

Scassa, research chair in Information Law and Policy at the University of Ottawa, spoke on the ethics of COVID and pandemic privacy in a May 6 webinar hosted by Centre for Ethics at the University of Toronto. 

As a human right, privacy is nonetheless weighed against other rights and interests — including the “undoubtedly very strong” interest in protecting public health, she said. In the case of Ontario’s emergency order, the two interests, privacy and public health, are clear, she said. 

“The issue is: Does the order itself properly balance those interests? I would argue that it doesn’t,” she said, noting that the order doesn’t specify that the data request (for positive COVID-19 status) must be for a specific purpose. “It’s not enough to say that sometimes privacy has to be sacrificed in a crisis situation. There are good ways to do it and there are bad ways to do it.” 

The COVID-19 pandemic escalated at a time when there was large-scale concern about privacy law in jurisdictions around the world — Canada included, said Scassa. There has been a growing collection of personal data by so many apps that has been hard to limit, she said, referencing large-scale privacy breaches and the Cambridge Analytica scandal.

“Prior to the pandemic in Canada there was considerable focus on tightening up private sector data protection laws,” she said. “Right from the start of the pandemic we see this problem with the porosity between the private sector collections of data and public sector.” 

She drew the analogy with contact tracing, which is being used in several jurisdictions (including Alberta) to track the spread of COVID-19 using factors such as location data from mobile phones.

“That was a very specific example of a government tapping into, dipping into, stores of location data related to citizens, that were in the hands of private sector cell phone companies, essentially,” she said, specifically describing a system used in Israel. 

 In Europe, said Scassa, the culture of privacy that bolsters laws such as General Data Protection Regulation also underlies its contact-tracing efforts.

If we have admitted that our private sector data protection laws are “not up to snuff,” then pandemic or not, the level of porosity with the public sector “should be a matter of concern,” she said. 

“This is something that the pandemic context highlights, but that we need to be aware of and thinking about going forward,” she said.

In Canada, privacy rules for the public sector tend to be stricter than those faced by the private sector, she said.

The Criminal Code has an entire system of warrants which governs circumstances in which police want to use a bug or tracking device, and they have to meet a high threshold, she said. At the same time, the Criminal Code also includes a system with a much lower threshold to get data in the hands of a third party — such as a private sector company that has already been tracking us all along, she said.

Scassa also pointed to Clearview AI, which describes itself as a “new research tool used by law enforcement agencies to identify perpetrators and victims of crimes.” Prior to the pandemic,  the company was criticized for lacking consent as it amassed facial recognition data. Clearview AI showed the extent to which personal data was being harvested by the private sector — and also the issues with the relationship between the public and private sectors, said Scassa. 

With companies like Google and Fitbit offering data visualizations about pandemic-related behaviour shifts, it may seem like there is a justification for data collection that is ongoing, says Scassa. 

“These data are used for less benevolent purposes as well,” she said. “It actually puts a cloak of benevolence on what is actually hugely problematic, constant and persistent mining of data from humans.” 

“This really should be a wakeup call to those who are concerned about privacy. It has been an issue for years and gets relatively little traction,” she said.