A&S alumna Amanda Cutinha (JD 2021) and Senior Research Associate Chris Parsons of the Citizen Lab.Photo credit: Courtesy of Amanda Cutinha and Riley Stewart.
The authors of a report on how personal information has been collected and shared during the COVID-19 pandemic are raising alarms about potential new privacy legislation.
While the recent federal election derailed the proposed Consumer Privacy Protection Act (CPPA) before it could be passed into law, the threat is still very real, says Christopher Parsons, a senior research associate at the Citizen Lab, in the Munk School of Global Affairs & Public Policy.
“We fully expect that piece of legislation to resurface,” says Parsons, who co-authored the Pandemic Privacy report, which concluded CPPA could open the door to the non-consensual use of personal information by the private sector.
“When the government is handling our data, we have Charter protections, but those protections do not apply when Google or a health company is handling my data.”
The solution is to include a robust human rights framework in any new legislation, he adds.
“It would give consumers an extra level of assurance that those companies aren’t just going to follow the letter of the law, but will be compelled to adhere to the spirit of the law as well, which is an important element when it comes to data protection.”
The report also fact-checked the widespread belief Canada’s existing privacy legislation impedes the ability of governments and public agencies to fight the pandemic.
Even the authors were surprised to discover the claim is simply not true, says Arts & Science alumna Amanda Cutinha, who earned her bachelor of arts in Canadian studies and history as a member of Trinity College in 2018 and her juris doctor from U of T Law in 2021.
“Our initial hypothesis was that privacy protections were an inhibitor, but I think we really busted the myth,” says Cutinha, who co-authored the study before joining Toronto law firm Miller Thomson this fall as an articling student.
Instead, the report illustrates how the pandemic triggered emergency legislation allowing personal data to be shared without prior consent, as long as it's reasonable and necessary to help quell the spread of the virus.
Cutinha says the lack of public understanding about privacy rights in emergency situations is concerning, and underscores why any new legislation needs to be accompanied by clear information about what it contains and how it applies.
“Is the law really serving the people that it's meant to, or are there changes that could make it a bit more transparent? That’s a question we should be asking,” says Cutinha.
Laws enacted in the wake of the Severe Acute Respiratory Syndrome (SARS) outbreak in the early 2000s created a more robust framework for dealing with personal health information, she says.
The COVID-19 pandemic was the first public health crisis in which Canada’s post-SARS federal and provincial privacy, health and emergency legislation operated simultaneously to collect, use and disclose personal information, the report notes.
But sorting through the patchwork of federal and provincial privacy and emergency laws brought to bear during COVID-19 is confusing for anyone, says Cutinha.
“Trying to summarize the vast amount of legislation that applies in a pandemic and make it accessible to people is one of the things I am most proud of in this report, because it's just such a minefield,” she says.
“And I'm hoping when we're looking at privacy reform, the focus is on being transparent and accountable to the people governed by these laws in a way that makes sense to everybody.”
Another cautionary tale from the report — which compared Canadian, U.K. and U.S. responses — is the extent companies such as Apple and Google shape COVID-19 data initiatives around the world, largely because governments rely on access to their platforms and the information they collect, says Parsons.
His biggest concern is whether the political will to follow through on important lessons from COVID-19 may start to wane, as it did during the years of relative calm and shifting priorities after SARS.
“We should expect this type of public health emergency to happen again, and we need to be ready,” says Parsons.
“If anything, this pandemic has taught us that we did not learn the lessons we needed to after SARS, and I just hope to God that we actually learn them this time.”
Story by Peter Boisseau republished from A&S News
