COVID-19 pandemic reveals major gaps in privacy law, says watchdog

As it pushes more and more Canadians onlineto work and shop, the COVID-19 pandemic is demonstratingthe need for better laws on data use and privacy, thecountry's privacy watchdog warned the federalgovernment today.

"This year, the COVID-19 pandemic makes the significant gaps in our legislative framework all the more striking," wrote Privacy Commissioner Daniel Therrien in his annual report, tabled in Parliament today.

"With the pandemic accelerating the digitization of just about every aspect of our lives, the future we have long been urging the government to prepare for has arrived in a sudden, dramatic fashion. This rapid societal transformation is taking place without the proper legislative framework to guide decisions and protect fundamental rights."

Therrien said most interactions taking place online now such asremotework,socializing with friends, logging into school or discussing health issues with a doctor use commercial videoconferencing technology.

The situation comes with risks, he said ofcommercial enterprises collecting exchanges betweendoctors and patients, for example,or ofe-learning platforms capturingsensitive information about students' learning difficulties or behaviour.

"Do you want your conversations with your doctors to be available to companies and used in a profile that will affect your future life? No. Obviously, the answer is no," Therrien said.

"Do we want the information of our children to be collected by companies for purposes that have nothing to do with education, and used to build profiles and used for commercial purposes? Again, the answer is no."

Therrien said his office hasn't investigated companies based on those risks yet, but added Canada needs laws that setlimits on permissible uses of data and that do not rely "on the good will of companies to act responsibly."

Push for moreenforcement powers

He also said the pandemic has stirred up heated debates about privacy, including questions about the government's contact tracing app (on which Therrien was consulted)andabout Canadians being asked for personalhealth informationor required to undergotemperature checks at airports or before entering workplaces and stores.

The privacy commissioner's office has long argued forenforcement powers to go after those who violate Canadians'privacy including the ability to make binding orders and impose consequential administrative penalties for non-compliance with the law.

His office is also asking the federal government to define privacy as a human right.

Therriensaidhe hasn't seen much movement on the issue in government.

"I've had discussions with about half a dozen federal ministers who obviously were sympathetic to the arguments that I was putting forward. But we still don't have a law,"he said.

"The short answer is I don't know when the government will table privacy legislation. I see that a number of provinces apparently are getting weary of inaction by the federal government and are starting to act."