OPC Publishes a Privacy Assessment Framework in Response to COVID-19

On April 17, 2020, the Office of the Privacy Commissioner of Canada (OPC) published a privacy assessment framework to assist federal government institutions in understanding their privacy-related responsibilities for the collection, use and disclosure of personal information during the COVID-19 outbreak.  This framework builds on the previous OPC guidance issued last month (as previously reported by the E-TIPS® Newsletter here), noting that “privacy laws still apply, but they are not a barrier to appropriate information sharing” during a public health crisis.

The OPC framework identifies nine principles to help guide government institutions in balancing individuals’ privacy, particularly with respect to handling sensitive health information and location data, with the need to respond to a health crisis. The nine principles are:

1. Legal Authority: identifying the legal authority to collect, use and disclose personal information;
2. Necessity and Proportionality: ensuring that any measures taken are necessary and proportionate to the identified purpose;
3. Purpose Limitation: using personal information to protect public health and no other purpose; 
4. Safeguarding Measures: using de-identified or aggregate data when possible;
5. Vulnerable Populations: considering unique impacts on vulnerable populations;
6. Openness and Transparency: providing clear and detailed information about new and emerging measures, on an ongoing basis;
7. Open Data: assessing the benefits and risks of releasing public datasets;
8. Oversight and Accountability: new laws and measures specific to the health crisis should include provisions for oversight and accountability; and
9. Time Limitation: any privacy invasive measures should be time-limited and should cease when no longer required.

Although the framework is geared towards government institutions, it also serves as a useful tool for private sector organizations when implementing their own privacy-impactful measures to address COVID-19. The OPC acknowledges that the current public health crisis calls for a “flexible and contextual application of privacy laws” while keeping in mind these nine privacy principles.

Summary By: Anna Troshchynsky