On April 17, 2020, the Office of the Privacy Commissioner of Canada (OPC) published a privacy assessment framework to assist federal government institutions in understanding their privacy-related responsibilities for the collection, use and disclosure of personal information during the COVID-19 outbreak.  This framework builds on the previous OPC guidance issued last month (as previously reported by the E-TIPS® Newsletter here), noting that “privacy laws still apply, but they are not a barrier to appropriate information sharing” during a public health crisis.

The OPC framework identifies nine principles to help guide government institutions in balancing individuals’ privacy, particularly with respect to handling sensitive health information and location data, with the need to respond to a health crisis. The nine principles are:

  1. Legal Authority: identifying the legal authority to collect, use and disclose personal information;
  2. Necessity and Proportionality: ensuring that any measures taken are necessary and proportionate to the identified purpose;
  3. Purpose Limitation: using personal information to protect public health and no other purpose; 
  4. Safeguarding Measures: using de-identified or aggregate data when possible;
  5. Vulnerable Populations: considering unique impacts on vulnerable populations;
  6. Openness and Transparency: providing clear and detailed information about new and emerging measures, on an ongoing basis;
  7. Open Data: assessing the benefits and risks of releasing public datasets;
  8. Oversight and Accountability: new laws and measures specific to the health crisis should include provisions for oversight and accountability; and
  9. Time Limitation: any privacy invasive measures should be time-limited and should cease when no longer required.

Although the framework is geared towards government institutions, it also serves as a useful tool for private sector organizations when implementing their own privacy-impactful measures to address COVID-19. The OPC acknowledges that the current public health crisis calls for a “flexible and contextual application of privacy laws” while keeping in mind these nine privacy principles.

Summary By: Anna Troshchynsky


20 05 06

Disclaimer: This Newsletter is intended to provide readers with general information on legal developments in the areas of e-commerce, information technology and intellectual property. It is not intended to be a complete statement of the law, nor is it intended to provide legal advice. No person should act or rely upon the information contained in this newsletter without seeking legal advice.

E-TIPS is a registered trade-mark of Deeth Williams Wall LLP.