Office Of The Privacy Commissioner Of Canada Publishes Special Report On Pandemic-Related Investigations

On May 30, 2023, the Office of the Privacy Commissioner of Canada (the OPC) announced that its Special Report on pandemic-related investigations (the Report) was tabled in Parliament.  The Report details the OPC’s findings on several investigations and advisory initiatives that dealt with the federal government’s privacy practices during the COVID-19 pandemic. 

In the Report, Privacy Commissioner Dufresne mentions that the OPC received around 100 formal complaints in relation to the COVID-19 crisis, with other privacy concerns being raised through media reports and before parliamentary committees.  The Report summarizes the OPC’s investigations into these complaints and discusses consultations that were carried out with government agencies over the last three years.

Overall, the OPC found that the federal government’s personal information privacy practices generally complied with the Privacy Act (the Act).  While each investigation and advisory work had its own key considerations, the OPC specifically highlighted the following matters:

• ArriveCAN: Due to a software error with the ArriveCAN application, approximately 10,000 travelers were erroneously instructed to quarantine under emergency measures imposed during the COVID-19 pandemic and only received notification of the error a month later.  The OPC found that the Canada Border Services Agency (CBSA) contravened the Act by not ensuring that information recorded in the app was accurate.  Additionally, the OPC stated that additional safeguards should be implemented when one uses automated decision-making that could substantially impact individuals.  Following the OPC’s recommendation, the CBSA corrected the erroneous information in its database.
• Collection and Use of Mobility Data: The OPC investigated complaints in relation to the federal government’s collection and use of mobility data during the pandemic.  In this case, the OPC determined that the government did not collect personal information, which meant that the Act did not apply. Furthermore, the OPC found that both the de-identification measures and safeguards in place against re-identification were adequate.
• Vaccine Mandates for Travel: The OPC investigated vaccine mandates that required both domestic air and rail passengers, and international travelers entering Canada to provide proof of their vaccination status to government authorities.  While the OPC found that federal institutions complied with the Act and the mandatory collection of vaccination status was necessary and proportional, it acknowledged gaps in the government’s assessment of less privacy-invasive alternatives, such as pre-arrival COVID-19 testing.  The OPC recommended that institutions in the future should ensure they clearly define the scope and objectives of implemented measures and consider and document their assessment of less intrusive alternatives.

For more information, the Report can be found here.

Summary By: Imtiaz Karamat