Travel Insurance

Public health agency’s data tracking of Canadians spurs calls for new laws

Share via email
Written by Publishing Team

But Canadians may have no idea how regularly their data is collected, stored and sold, experts also say

Article content

Analysts say the outcry over Public Health Canada’s use of anonymous mobile data for millions of Canadians reveals an urgent need to update the country’s privacy laws.


Article content

But experts also say Canadians may have no idea how regularly their data is collected, stored and sold.

“Data brokers,” insurance and credit companies, banks, and companies involved in data analytics and artificial intelligence “are doing this every day and are not subject to the same kind of scrutiny that we have in terms of the federal public service,” said Tracy Lauriolt, associate professor at Carleton University.

“The Canadian government needs to update its privacy laws,” said Christopher Parsons, a senior researcher at Citizen Lab at the University of Toronto.

“Hopefully, if there is any benefit emerging in the current struggle over access to this information, it will in fact be to advance meaningful legislative reforms.”


Article content

Earlier this week, lawmakers from the three opposition parties called for a review after the Primary Health Care Center (PHAC) admitted using anonymized and aggregated data obtained from third parties to track Canadian travel patterns during the pandemic. It plans to continue to do so until at least 2023.

Opposition MPs called PHC’s actions “extremely concerning” and “an intrusion into the privacy of Canadians.” The Commons Ethics Committee will meet on Thursday to discuss the issue.

However, Parsons said the data was “almost lawfully collected and lawfully disclosed to the Government of Canada, in an anonymous aggregate format.”


Article content

But he added, “People look and say ‘That’s inappropriate’ or ‘I don’t think that’s right.’ So even though that’s allowed, they don’t feel like they have an opinion. They don’t think they would have said yes.”

The problem, he said, is that Canada’s privacy laws, the Personal Information and Electronic Document Protection Act (PIPEDA) – which covers the private sector – and the Privacy Act – which covers the government – deal with personally identifiable information, not anonymizing or anonymizing data like PHAC used.

“There is a growing gap between what the government can lawfully do with regard to the collection and use of … anonymised and aggregated personal information, and what Canadian individuals believe,” Parsons said.


Article content

It does not address Canadian privacy laws, and many Canadians may not be aware of the extent to which information about their physical location and what they do online is sold and resold by a wide range of companies.

Detailed location data is collected not just by connections, but by companies like Google and Fitbit, and “any number of apps that have nothing to do with navigation, but collect this data in any case,” said Theresa Scasa, a professor at the University of Ottawa. .

It’s part of a massive amount of information about all Canadians that has been collected, anonymised, and sold privately. Companies like Google and Facebook collect data that they use to sell targeted ads.

There are also data brokers — companies that obtain and buy data from social media feeds, credit registry companies, banks and loyalty cards — and then combine that with statistical information to create profiles, Laureault said. From there, they can perform analyzes on this data for customers.


Article content

“The question might be, how many people defaulted on their loans in Canada, where did they live and what kind of loans did they default on?”

In Canada, there is little information available about these companies and what they already know about Canadians, Lauriault said. “We know almost nothing about them,” including where they buy the data and who their customers are.

She said, “We actually need to be able to look at what’s going on inside these companies, what they’re buying and selling, and then we have to develop some legislation and some oversight.”

A 2018 draft report from Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC) noted that data brokers do not use this term to refer to themselves, using terms such as marketing analytics, or “data as a service provider”. She cited Acxiom, Oracle, Salesforce, and Adobe as examples of some of the companies working in this field.


Article content

The anonymized data is used for profiling and targeted marketing, and it “can also be used for artificial intelligence, to develop tools, products or services,” Skasa said.

Large Canadian telecoms companies have also entered the data business. PHAC obtained some of its data about the location of Canadians from the Telus Data for Good program, which provides aggregated, anonymous data to governments, health authorities and researchers. In 2020, Bell bought data and analytics company Environics Analytics.

If carriers are making location data available for non-technical purposes, such as network planning, Parsons said, “they need to be more transparent about what they do.”

Parsons also noted that PHCC did not proactively explain what it was doing. “We’re just starting to see what’s been done in Canada and other jurisdictions” when it comes to data collection for COVID-19 purposes, he added.

Both Parsons and Skasa said the privacy law urgently needs updating. Parsons noted that it was created in the 1980s and has not received meaningful updates since then. A bill to update private sector legislation, PIPEDA, died on the order sheet when last year’s federal election was called.

So far, Cassa said, Canadian privacy laws have focused on information about identifiable individuals. “I think we need to think about how much we also want some kind of transparency and oversight and governance when we’re talking about anonymous personal information,” she said.



Postmedia is committed to maintaining an active and civil forum for discussion and encouraging all readers to share their opinions on our articles. Comments may take up to an hour to be moderated before they appear on the Site. We ask that you keep your comments relevant and respectful. We’ve enabled email notifications – you’ll now receive an email if you receive a response to your comment, if there’s an update to a comment thread you’re following or if it’s a comment follower user. Visit our Community Guidelines for more information and details on how to adjust your email settings.

About the author

Publishing Team

Leave a Comment