44th Parl. 1st Sess.
February 7, 2022 11:00AM
- Feb/7/22 3:33:33 p.m.
- Watch
Mr. Speaker, I move that the first report of the Standing Committee on Access to Information, Privacy and Ethics, presented on Wednesday, February 2, 2022, be concurred in.
Last week, the committee tabled its report, which included a motion that was unanimously adopted by all committee members, including four Liberals, four Conservatives, one New Democrat and one Bloc Québécois member, me. I will read the motion for everyone to hear:
That the committee call upon the government to suspend the Public Health Agency of Canada's cellular data tender upon adoption of this motion, and that the tender shall not be re-offered until it the committee reports to the House that it is satisfied that the privacy of Canadians will not be affected, and that the committee report the adoption of this motion to the House at the earliest opportunity.
Let me repeat that this motion passed unanimously. This is important, because protecting Canadians' personal information and data is an issue that crosses partisan divides.
Last Tuesday, February 1, I walked across the floor of this House and handed the Minister of Health a letter asking him to comply with the motion adopted unanimously, I repeat, by the committee.
On Thursday, during question period here in the House, I twice asked the Minister of Health if he was prepared to suspend the RFP or at least comply with the motion put forward by the committee. Twice, the Minister of Health avoided responding.
A little later that day, I put the same question to him during his appearance before the Standing Committee on Access to Information, Privacy and Ethics, which met an hour later, and he once again avoided answering. As we all know, no answer is an answer.
On that occasion, the Minister of Health told us that the data he was using had been de-identified and was acceptable from a privacy protection point of view. When we asked him questions about where the data were from, things were less clear. The Minister of Health just repeated that the data were properly de-identified.
This morning, the Privacy Commissioner of Canada, Daniel Therrien, appeared before the committee. Members asked him if the Public Health Agency of Canada had consulted him. He said the agency informed him of its plans. The agency did not seek his advice; it informed him. The commissioner offered to provide advisory services to the Public Health Agency, but his services were not retained. As is the agency's prerogative, it chose to use external legal advice. It was the agency's choice not to get involved, but the commissioner did seem a little rankled this morning. Given that the Privacy Commissioner represents an institution created by the government, one might think his advice would be welcomed by government entities. Not in this case.
For the purposes of the discussion, let us look at the facts. In March 2020, a private contract was concluded between the Public Health Agency of Canada and Telus, more specifically with its Data for Good program, a part of the organization that manages Telus data and offers that data to such entities as the Government of Canada. A private contract was signed—without a tendering process to be clear—to obtain tracked data.
In 2020, 33 million cell phones were monitored. That represents 87% of Canadians' cell phones in this case. No one knew about it. This was done with a total lack of transparency. On December 17, 2021, the Public Health Agency of Canada issued a request for proposals to select a data tracking provider. That RFP was brought to our attention by the National Post and Radio-Canada between December 18 and 22, with both news outlets questioning the ethics of this endeavour.
We took the time to do our homework, do some reading and take a look at what was happening. On December 23, the Bloc Québécois issued a press release to express its concerns about the RFP to renew an existing three-year contract allowing the data to be used beyond the pandemic.
It is funny, because last week I asked Canada's Chief Public Health Officer, Dr. Theresa Tam, when the pandemic would end. She obviously did not have an answer. I also asked her who would decide when the pandemic was over. She also did not have an answer to that and was surprised by the question.
Given this lack of answers, we realized that the tender could allow the data to be used indefinitely, since no one knew when the pandemic would end. Obviously I am still concerned. I want to note that I have no preconceived notions on the matter, but I really wanted to continue with this work.
During the Christmas break, the Bloc Québécois members of the Standing Committee on Access to Information, Privacy and Ethics requested that a meeting be held, and our request was agreed to. In the new year, the committee met to evaluate the use of data and unanimously agreed to undertake a study. This study began last week with a view to determining whether there was a privacy breach. The Minister of Health and Dr. Tam appeared before the committee, and the study continued this morning with the appearance of the Privacy Commissioner of Canada, Daniel Therrien, and a renowned researcher in this field. The work will continue until April.
The committee also adopted a motion, which I read out earlier, calling for the suspension of the RFP until the committee can examine the situation. I should note that the RFP deadline was January 22. As soon as the committee began its study, this deadline was extended to February 2. After another meeting to determine the committee's future business, it was extended to February 4. Last week, the minister announced that the RFP deadline would be extended to February 18.
The health crisis was often invoked as as a reason the the RFP cannot be suspended, but Dr. Tam nevertheless told the committee that the delay had little effect on the information obtained from the data in question, since the data would be retrospectively looked at. She did not seem concerned about the possibility of suspending the RFP, and she was not against it. We therefore moved a motion to suspend the RFP and this motion was passed unanimously so that the committee could get to the bottom of this matter.
That brings us to the meetings with the minister. I remind members that the only response to the committee members' many questions was that the data had been de-identified. When members asked questions about where the data had been obtained and who had had access to it, the only answers we got were vague and evasive, which I find demonstrates the minister's lack of accountability.
There is an old saying in philosophy that what cannot be done directly cannot be done indirectly. If the data used by the Public Health Agency of Canada was de-identified, we had to wonder who had access to the data and what kinds of protocols were used, if any. The committee did not get an answer.
Dr. Tam said that the data being used would not be very useful and that it would not be the end of the world if the RFP were suspended while the study is carried out.
Privacy is basically a question of ethics. Ethics is essentially about trying to figure out what to do in difficult circumstances, what the right thing to do is, what to do when you do not have all the information and you are not quite sure where you stand. The precautionary principle applies, obviously.
In its hearings so far, the committee has noted that the government is avoiding the issue, as it would prefer not to deal with it.
Facts are facts. The motion, which was adopted unanimously, called for the RFP to be suspended while the committee conducts its study. Here I am in the House a week later, seeking the House's consent to implement the motion.
I might be a little naive on this subject, but it seems to me that governments should set an example. I know the interpreters hate it when I do this, but when we look at the Latin roots of the word “example”, it translates as “being able to do as I do”. In other words, the government should be able to do what all of us would do, namely make a reasonable decision.
Opaqueness, non-transparency, and layers of secrecy hiding behind every detail are the antithesis of transparency. The Privacy Commissioner told us this morning that there were best practices in this area. There is no reason to believe that they were violated. Beyond best practices, however, there was also transparency and the desire to do the right thing. These two aspects should have been demonstrated but are still missing here.
I have asked various experts, including the Privacy Commissioner, about this, and what really bothers me is that we all know it is impossible to obtain consent from 33 million people in this kind of situation. The government says this condition is fulfilled when people click on the “I agree” button, yet everyone knows as well as I do that it pretty much takes a master of laws degree to understand what we are actually agreeing to. It is also reasonable to believe that cellphone users did not consent to their data being used for purposes other than those required by the cellphone company to provide a service. It is impossible to conclude that presumed consent is the same as consent. Presumed consent is not consent.
This morning, the commissioner told us about the concept of “meaningful consent”. Meaningful consent is impossible to obtain. It may be impossible to obtain, but there is a spectrum between doing nothing and doing something impossible. All kinds of elements can be put into play so that at least things are out in the open. The government did not implement or put forward any of those elements.
What is the crux of this matter? When we talk about privacy, we expect that people will be able to provide information in good faith, believing in good faith that it will be used for the stated purposes. We are talking about trust. We are talking about a person's ability to trust their cellular service provider, let alone their government.
Properly defined, trust is the action of delegating one's future to someone else. When we delegate our future to the government, we expect it to act responsibly. We do not expect the government to potentially hide behind some obscure legal provision stating that, once the data is disaggregated, anonymized or any other such term that is incomprehensible to lay people, it can wash its hands of it. That is not right.
In such cases, opaqueness leads not to trust, but to distrust. Members know as well as I do that, in the end, distrust leads to defiance, the kind of defiance we can see outside Parliament.
I believe that the government is not being transparent, and that is the reason for our request. I believe that opacity reigns and that if we want to make sense of the government's actions, we have to be able to go further. Making sense of it means clearing the air, throwing light on the matter, but right now, we are lost in the fog.
Failing to suspend the RFP is to maintain all this opaqueness. Failing to suspend the RFP would be to perpetuate the mistake, or at the very least, the appearance of a mistake. Failing to suspend the RFP is, above all, to show contempt for the committee's work. Failing to suspend the RFP is to disregard the unanimity of the committee. The government cannot simply wash its hands of such a situation by ignoring questions or trying to do indirectly what it cannot do directly.
It was disturbing to hear the Privacy Commissioner say this morning that he was informed but not consulted. He did not provide his opinion. In fact, he is investigating the matter now.
It is troubling that one of the most powerful officers of Parliament is not being asked to contribute. On the contrary, he has been sidelined. I therefore ask hon. members to support the committee's motion.
Let me reveal another small detail. A member of the committee asked me the other day, when I moved the motion, whether it was meant to undermine this. The answer is obviously no. It is not to undermine anything. Are we asking to suspend the RFP forever? The answer is no, it is not forever either.
The RFP needs to be suspended until the committee can shed light on the situation and bring the matter out of obscurity. What we are asking for is not malicious. On the contrary, it is to allow the government to demonstrate its good faith, if necessary, or to correct the situation, if necessary.
Ultimately, I will ask my colleagues to please support the motion at the end of the debate.
2224 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:49:46 p.m.
- Watch
Madam Speaker, I appreciate the comments made by my hon. colleague from the Bloc Québécois. I share his wish, as one of the members of that committee who participated in the unanimous vote, to press pause on this procurement, where I would suggest there is a lack of clarity in exactly what the government has requested and how this data has been handled.
My question to my colleague is this. When it comes to the specifics of that data, what are some of the concerns he has regarding the privacy of Canadians being put at risk because of the lack of clarity the government has given on this particular RFP and the greater revelations of mobility data being used over the course of the pandemic?
129 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:50:51 p.m.
- Watch
Madam Speaker, I thank my hon. colleague for the question. Those are very valid points, and my concerns are twofold. I am referring to the source and the end of the process.
First, at the source, there is not a modicum of user consent. Then, the point my colleague raises is very important. A number of experts have told us that once data has been de-identified, which is a new word I learned recently that means anonymized, the de-identified data can easily be re-identified, emphasis on the word easily. I am not making this up, it comes from a witness who will be testifying at committee shortly. If de-identified data can be re-identified, then honestly, we are in trouble when it comes to privacy, because there is no longer any protection.
Of course we want to ensure that the process has been done properly and that if it has, the data cannot be used for other purposes. For example, we want to ensure that it cannot be used after the pandemic.
I am not feeling at all reassured at this time. In fact, I am concerned. The origin of the data, the processing of the data and the manner in which the data will be used have me concerned.
214 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:52:22 p.m.
- Watch
Madam Speaker, it is a pleasure to be in the House virtually today.
I am grateful to have the opportunity to rise in the House to speak to how the Government of Canada has started using mobility data and why a request for proposal—
45 words
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:52:49 p.m.
- Watch
1 words
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:52:49 p.m.
- Watch
We are in questions and comments.
The hon. parliamentary secretary to the government House leader.
15 words
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:52:49 p.m.
- Watch
I am sorry to interrupt the hon. member. Apparently, there is no translation.
Is the hon. parliamentary secretary starting his speech?
21 words
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:53:12 p.m.
- Watch
Madam Speaker, I listened carefully to what the member was saying. He made reference to some concerns he had with respect to the Privacy Commissioner.
My question to the member is this. Are there specific things that were expressed by the Privacy Commissioner, regarding the data or the agreement, that concern the member or the Bloc party? Would he be able to highlight something specific the Privacy Commissioner said, outside of being consulted?
73 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:53:54 p.m.
- Watch
Madam Speaker, outside of being consulted, the commissioner was uncomfortable.
He obviously could not comment on a large part of how the data was handled because of an ongoing investigation. However, I will say that he showed concern throughout his testimony. I asked him whether other countries had more effective protections than Canada does, and his answer was a sharp “yes”. I knew this already, having worked on these types of protections with the European community in the past.
The commissioner was concerned about how the data was disaggregated and reaggregated. A lot of technical terms were used, but in essence, he was saying that he was concerned and could not comment on some things because of the ongoing investigation.
122 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:54:53 p.m.
- Watch
Madam Speaker, it is rare to have a subject matter expert to work with at committee. I know this was the member's past area of study and expertise, and he is in fact an author on it. I take special note of the member's perspective. He feels compelled to bring this critical issue to the House, and rightfully so, given the timelines we have on procurement.
What may be considered legal is not always ethical. Can the member expand on his concerns about the use of data in this way, and why he feels it necessary to allow the committee to fully explore this before the government moves forward with the procurement contract?
115 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:55:37 p.m.
- Watch
Madam Speaker, I thank my hon. colleague for his question.
As he said, just because something is legal does not necessarily make it right. What may be considered legal is not always ethical. I tend to say that legality is the bare minimum. In this case, is the bare minimum enough?
Since there are many other places with harsher and more comprehensive privacy regulations, I felt concerned in light of the commissioner's response and the use of this data. I think this is a real problem. Data use is something that happens; it is not a major crime. However, we do need to reflect on this because this issue will come up again.
In previous reports, like his latest annual report, the commissioner said that the federal legislation was inadequate and called for it to be updated to reflect the new reality of big data, for example.
For these reasons, I remain concerned, since it seems as though the bare minimum is being done here.
166 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:56:57 p.m.
- Watch
Madam Speaker, I thank my colleague from Trois-Rivières.
This is a very relevant issue. The government is using data to protect public health because of the pandemic. At the same time, protecting people's privacy is a major challenge. I think that the member is right in saying that it would be a good idea to examine this issue in committee.
I just want to say that I am not sure the government made a mistake. However, the issues are relevant and I think they are new.
90 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:57:49 p.m.
- Watch
Madam Speaker, I thank my colleague for her comments.
Like her, I am not presuming that a mistake has been made. I am simply saying that it is important to shed some light on this issue.
What happened is that the government had to make a very tough decision and find a balance between two difficult situations: protecting public health, which is very important, and protecting people's privacy. Those are both very important things. What we want to know is how the government reconciled these two needs.
Like my hon. colleague, I am definitely not presuming that a mistake was made, but we need to ask these questions. We are here to shed some light on the situation.
119 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:58:37 p.m.
- Watch
Madam Speaker, I thank my colleague.
It is interesting and really quite something to listen to an expert in this field, an ethicist who is well known in Quebec, Canada and around the world.
My question is quite simple. I am new to this field, but I think the process would have been more transparent if the government, whether it be the Minister of Health or his staff, had been clearer and more forthcoming in its explanations.
Why would the government want to continue keeping us in the dark?
In my colleague's view, what does the government stand to gain from the lack of transparency on this RFP?
109 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:59:20 p.m.
- Watch
Madam Speaker, I thank my colleague for her question.
Opaqueness and transparency are two things that we talk a lot about in ethics. It is said that if something has to be opaque to succeed, it is probably less ethical than something that can stand up to transparency and light.
I do not know why the government is dragging things out because, honestly, in its place, I would follow the unanimous recommendation of the committee and shed some light on the situation and, if necessary, prove that everything was done properly. I want to reiterate that I am not presuming that a mistake was made. I would just like confirmation that everything was done properly.
115 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 3:59:59 p.m.
- Watch
Madam Speaker, back home people say, “Be quiet around your phone. China might be listening”, but it turns out that our own government happens to be listening.
I am just wondering this. What does the member have to say about the fact that, right here at home, we have to be worried about how our data is being used by our own government?
65 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 4:00:26 p.m.
- Watch
Madam Speaker, I thank my colleague for his question.
Once again, I am not presuming that the government would misuse the data, but it is showing a lack of transparency and a desire to maintain that lack of transparency. As an ethicist, that concerns me.
45 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 4:00:52 p.m.
- Watch
Madam Speaker, I am grateful for the opportunity to rise in the House to talk about how the Government of Canada started using mobility data and the reasons why a request for proposal was issued.
Our government has seen that using health data to support an effective pandemic response has been a constant challenge. Stakeholders and experts have repeatedly stated that there is a data deficit needing to be filled to make evidence-based decisions in the public health system. They also state that public health data is “fragmented, outdated, not disaggregated, and not timely”. The lack of a common, coherent approach for our health data across the country is contributing to lagging health outcomes for people in Canada, escalating sector costs, expanding health inequities and slowing innovation in Canada's health sector.
The ethical use of mobility data is one element needed to address this problem. During this pandemic, our researchers and infectious disease modellers have used the aggregated data to track the existing spread of the virus and estimate where it is most likely to surge. This has helped to inform our policy and public health responses in a positive way. We as a government are not unique in using de-identified population-level mobility data for this purpose. Countries around the world, and even local governments in Canada, are using mobility data to help guide their response to the pandemic.
The mobility data that our government uses does not include any personal information. It cannot identify individuals and the data cannot be re-engineered to identify any person. I want to be clear: We do not ask for, nor do we receive, any personal information as part of the mobility data we use. We contract for commercially available data that is de-identified and aggregated only. With only de-identified data, we have absolutely no way of knowing or following the actions of individual Canadians.
When people turn on or use their mobile or cellular phone, their phone connects with the closest cellphone tower. When a cellphone is moved, the tower is connecting with it and that can change. Their phone will always look for the closest tower to connect with. Telecommunications companies, as part of their day-to-day business operations, manage and collect this information in order to monitor and maintain their services for their customers. Telecommunications companies also have the ability to take this private business information and remove the information that would connect a phone to a person or to a personal address. The cellular companies' data is stripped down to only the signal or a signal location when moving. There is no personal data included. The data has been de-identified.
These de-identification and aggregation steps protect the privacy of individual Canadians. Companies sell this de-identified data to governments, scientists and researchers to support research and knowledge of how policies, trends and environmental changes impact people. Similarly, some companies make data collected from smart phone applications commercially available. Once again, every effort is made to make sure that the data is de-identified and aggregated so that users cannot be identified.
Once again, I would like to stress that when we purchase this data, it is de-identified and aggregated. We do not ask for and do not accept personal mobility information. The data we receive is in the form of a report. It is a table with percentages and proportions for geographic areas over a time period of 24 hours or more. There is no way to trace this back to individuals.
The Public Health Agency of Canada purchases this data to better understand how people are reacting to public health measures and how population-level movements affect the spread of COVID-19. Mobility data is a complementary data source that works alongside health, case and epidemiological data to support situational awareness. For example, when we analyze mobility data and outbreak data together, the agency can see trends of higher or lower mobility that can help us to predict future COVID cases. This helps us to evaluate the effectiveness of public health measures.
The Public Health Agency of Canada generates reports and summaries from this data, and we share them with Canadians and with provincial and territorial governments to empower everyone to make the best possible decisions during this very trying time. The Government of Canada has been transparently publishing mobility information as part of the COVIDTrends web page since December 2020. The site has seen more than 1.7 million visits and is easily accessed through the popular WeatherCAN app.
COVIDTrends data gives Canadians information they need to best manage their personal lives during the pandemic. It also gives them the ability to know what is happening where they live with respect to COVID-19. The Public Health Agency of Canada has also made announcements about this work on social media, such as Facebook and Twitter, throughout the pandemic. Mobility data on the site shows changes in population movement from one week to the next in the selected area. This change in movement may help us understand the risks associated with COVID-19 transmission.
There are limitations to using this data, as it cannot determine if public health measures such as wearing a mask were followed while someone was moving. As I mentioned, the data, because it is completely de-identified, cannot consider population differences such as age, gender or income level.
Before I conclude, I want to take a minute to talk about the importance of privacy. The Government of Canada is committed to protecting the privacy of individuals with respect to the personal information that is under their control. We recognize that this is an essential element in maintaining public trust. The Public Health Agency of Canada requested data with no personal or identifying information. To further protect privacy, the agency also used a multibarrier approach with regard to the source of the data, along with the data pipeline, and prior to it being received. The Public Health Agency of Canada requires mobility data vendors to apply robust data and aggregation controls to ensure anonymity prior to them sending data so that the agency does not receive any identifying information. Any company selling data within Canada is subject to the Personal Information Protection and Electronic Documents Act, which is consent-based legislation.
In this day and age, we are creating data every time we use our smart phones. It is only natural for people to be concerned about who is accessing that data and what they are using it for.
I want to assure Canadians that the mobility data the Public Health Agency of Canada is using does not contain their personal information or any personal information. The agency cannot link the data to any individuals.
Mobility data is one of the many tools we are using to fill the data deficit that exists in Canada. It has helped us improve our response to COVID-19, saved the lives of Canadians and protected our health care system.
1173 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 4:08:01 p.m.
- Watch
Madam Speaker, there are a couple of issues we are dealing with here today, not the least of which is the request to put off the RFP. However, the real challenge is in this de-identified data being collected by telecom companies and the transfer of that information. It may be that when the Public Health Agency of Canada gets that information, it is aggregated and de-identified, but the challenge exists when those companies collect that data.
There is another challenge with this, and that is the consent of the users. There was no consent given by users to allow the telecom companies to collect this data. It is a challenge that we heard from the Privacy Commissioner this morning. There is a real risk to de-identifying this data. Given that consent was not given, we have to get to the bottom of what security measures and what protocols were put in place to ensure this data was protected.
Does the parliamentary secretary not see that as a concern, and not see it as a reason to hold off on the RFP until the ethics committee does its work and can be assured that the privacy of Canadians was protected?
202 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- Feb/7/22 4:09:19 p.m.
- Watch
Madam Speaker, like the member from Barrie—Innisfil, I have a smart phone. I have it here, as most people do. I use it for all sorts of things. Sometimes when I google a restaurant to see if it is open, it says the restaurant is a little busier than usual. Sometimes if I am driving in traffic and I check applications like Waze or Google Maps, those applications will tell me there is a better route because there are a lot of people on the highway. That information comes from cellphone data that is aggregated and de-identified. It is the same with every app, and it is commercially available to various agencies and organizations.
The member said that there is a privacy issue with respect to consent, but we all know that when we are using our cellphone and we put down a check mark, it is a contract in a sense, and that information is available for daily conveniences like Waze or going to a restaurant. Hopefully, we can—
174 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
- menumenu
- notificationsnotifications
- home
- mailmail
- searchsearch
