Canadians’ privacy could take a serious hit this coming legislative session

OTTAWA—Government actions coming our way this year will dramatically affect Canadians' personal data if left as is. One action, partly hidden and under-reported, involves federal, provincial, and territorial officials playing politics with our most sensitive personal health data. Behind closed doors, they have been formalizing a Pan-Canadian Health Data plan. This plan is about electronically collecting, shaping, and sharing more “compatible” and “timely” personal population health data, reputedly “de-identified." The political tussle is over what conditions—like the length of wait-times—federal authorities can impose on the provinces and territories in new health transfer agreements, using that personal health data. Health Canada spokesperson Charlaine Sleiman calls the Pan-Canadian Health Data plan one of “streamlining ... for a digital age." She dismisses the fear that it “creates a national data collection program or technology system," though concedes it “creates ... a new interoperable enabling environment ... harnessing health data." The purpose of the Pan-Canadian Health Data Strategy is certainly more effective use of scarce health dollars, but at whose expense? Is that system designed not to misuse or manipulate the amassed personal health data? In a September 2022 resolution, Canada’s privacy commissioners and ombudspeople with responsibility for privacy oversight called upon governments, health-sector institutions, and health providers “to show concerted effort, leadership, and resolve in implementing modern, secure and interoperable digital health communication infrastructure." But the needed restrictions are not directly in the federal legislative schedule this session. And the 40-year-old Privacy Act allows third parties to collect, exchange, and use a great deal of Canadians' personal data. During the pandemic, Ottawa administrators tracked millions of Canadians’ personal mobility without any special legislation. Third-party private sector firms were contracted to extract this data using cellphone tracking towers, claiming the data to be totally anonymous. Of note, Justice Canada authorities are talking about finally overhauling the Privacy Act this year to meet the digital age. But do not expect that such a massive health-sharing scheme, future health-tracing mobility plans or numerous other third-party personal data-sharing agreements will face strong privacy protection restrictions under any proposed amendments to the Privacy Act. If anything, authorities will seek to legally write into these numerous little-known personal data-sharing agreements the go-ahead to reputedly de-identify and further use the personal data they contain, authorizing further use of AI algorithms. Call it the digital poison-pill. When it comes to the other main problem that's festering under the Privacy Act—the growing number of privacy breaches—the government likes to say that there’s been some public reporting of such breaches, and notifications have been sent to those affected. But what's not addressed as yet, however, or will unlikely be in any Privacy Act amendments, is that some agencies with substantial personal data holdings are finding ways to cheat, downplay, suppress, and under-report what are considered as privacy breaches or wanting to see their use of digital upgrades as leading to privacy breaches. The federal privacy commissioner has highlighted the problem in annual reports and is currently dealing with at least one complaint. Canadians will need much more than a “look-the-other-way” house-cleaning in an updated Privacy Act if it’s to become an effective instrument of privacy rights and protection. Other legislation to be debated this parliamentary session will add to the federal government’s digital invasive privacy powers. Bill C-26 on cyber security would, with few restrictions, allow the state to access personal data from telecommunications providers when required. Another upcoming bill, the Senate’s Bill 7, would allow the Canada Border Services Agency greater access to travellers' personal digital devices. A recent House Access to Information, Privacy and Ethics Committee inquiry identified yet another digital privacy gap. It issued a report last October urgently calling for legislation on the use of facial recognition technologies (FRT), and a pause in their introduction. The privacy commissioner suggested a potential legal framework towards restricting police use of FRT. Next up for the House Privacy Committee is an investigation into the Canada Border Services Agency's use of third parties to run the costly and controversial ArriveCan travel app. Meanwhile, on the private-sector privacy front, the divisive Bill C-27 (Digital Charter Implementation Act) is in second reading in the House, and business interests are hoping for its quick passage. The legislation's dual goals are, firstly, to have found the balance needed in corporations amassing and using personal data in the digital marketplace, and, secondly, to convince international and European governments that there will be sufficient protection of Canadians' marketplace personal data. These protection claims are questionable as Bill C-27 downplays the need for personal consent in such legalized digital corporate collections. It claims to resolve any assault on individual privacy by “de-identifying” personal data, making the collected details allegedly anonymous. The bill's separate artificial intelligence act provisions build on this and permit the use of AI algorithms in the marketplace's manipulation of personal data for private gain. As the bill is currently written, it allows for a one-sided set of rather vague privacy safeguards that do not even require public identification of AI's formuli or for any specifics on AI's many daily uses. Mislabelled a “consumer” digital “charter” protection bill, Bill C-27 basically gives businesses legal cover to capture more personal data, and to do more corporate surveillance based on this information. The bill has its many critics and supporters who will no doubt be making presentations to the committee. This is the year that authorities and corporations are looking to Parliament to apply a legal veneer to their desired grab for more digital personal data under the guise of modernization and efficiencies. Canadians should rightfully be distrustful, be prepared to push back against such sweeping efforts to torpedo privacy rights, and to advocate for much tougher privacy protection provisions in the law. Ken Rubin is a long-time information rights advocate, author, and civil libertarian. He is reachable via kenrubin.ca The Hill Times