ETHI Committee Meeting
Notices of Meeting include information about the subject matter to be examined by the committee and date, time and place of the meeting, as well as a list of any witnesses scheduled to appear. The Evidence is the edited and revised transcript of what is said before a committee. The Minutes of Proceedings are the official record of the business conducted by the committee at a sitting.
For an advanced search, use Publication Search tool.
If you have any questions or comments regarding the accessibility of this publication, please contact us at accessible@parl.gc.ca.
Standing Committee on Access to Information, Privacy and Ethics
|
l |
|
l |
|
EVIDENCE
Thursday, February 3, 2022
[Recorded by Electronic Apparatus]
[English]
I'm bringing the meeting to order.
The motion that was adopted called for two separate panels, one with the minister and one with Dr. Tam and officials. The notice that went out had her here throughout. We're just trying to get contact. I'm not sure if it's technical or what the issue is.
I'd prefer to begin the meeting now with the minister. When we've had our hour with the minister then we will reset to a second panel with Dr. Tam.
Welcome to meeting number four of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.
[Translation]
Pursuant to Standing Order 108(3)(h) and the motion adopted by the committee on Thursday, January 13, 2022, the committee is undertaking its study on collection and use of mobility data by the Government of Canada.
[English]
Today's meeting is taking place in a hybrid format, pursuant to the House order of November 25, 2021. Members are attending in person in the room and remotely using the Zoom application. The proceedings will be made available via the House of Commons website, and the webcast will always show the person speaking, rather than the entirety of the committee.
I'd like to take this opportunity to remind all of the participants at this meeting that screenshots or taking photos of your screen is not permitted.
Given the ongoing pandemic situation and in light of the recommendations from health authorities and the directive of the Board of Internal Economy on October 19, 2021, to remain healthy and safe, all those attending the meeting in person are to maintain a two-metre physical distance and must wear a non-medical mask when circulating in the room. It's highly recommended that the mask be worn at all times, including when seated—although I will not wear my mask while speaking. People must maintain proper hand hygiene by using the hand sanitizer provided at the room entrance. As the chair, I will be enforcing these measures for the duration of the meeting, and I thank members in advance for their co-operation.
To ensure an orderly meeting, I would like to outline a few rules to follow. Members and witnesses may speak in the official language of their choice. Interpretation services are available for this meeting. You have the choice, at the bottom of your screen, of either floor, English or French audio. If the interpretation is lost, please inform me immediately and we will ensure interpretation is properly restored before resuming the proceedings. The “raise hand” feature at the bottom of the screen can be used at any time if you wish to speak or alert the chair.
For members participating in person, proceed as you normally would when the whole committee is meeting in person in the committee room. Keep in mind the Board of Internal Economy's guidelines for mask and health protocols.
Before speaking, please wait until I recognize you by name. If you are on the video conference, please click the microphone icon to unmute yourself. If you are in the room, your microphone is controlled as normal by the proceedings and verification officer.
When speaking, please speak slowly and clearly. When you are not speaking, your mike should be on mute.
I will remind you that all comments by members and witnesses should be addressed through the chair. With regard to a speaking list, the committee clerk and I will do our best to maintain a consolidated speaking order for members, whether they are participating virtually or in person.
Now I would like to welcome our witnesses.
I saw your hand there, but I wanted to try to get through the introductions and all of that.
Go ahead, Ms. Khalid.
I'm sorry, I just wanted to seek some clarification. Are we having two panels or are we having one single panel?
I see that all witnesses are here at this time. I'm just trying to sort out the timing piece of it for questioning.
I don't see Dr. Tam...oh, she is here.
It had been my intention to separate and recalibrate the speaking order after the first hour, but if the committee would rather we run this all to the end, I can. My intent was to have our one hour and then recalibrate.
For our witnesses, we're very happy to have the Honourable Jean-Yves Duclos, Minister of Health, for the first hour, and we have with us from the Public Health Agency of Canada, Dr. Theresa Tam, chief public health officer.
Thank you Dr. Tam, for appearing today. We also have Kathy Thompson, executive vice-president and Christopher Allison, acting vice-president.
Minister, you have five minutes for your opening statement.
[Translation]
Thank you, Mr. Chair.
Thank you for inviting me to speak to you today about the Government of Canada's commitment to both safeguarding the privacy of Canadians and working to continue to curb the spread of COVID‑19, thereby protecting everyone's health and safety.
[English]
The departmental officials kindly joining me today include Dr. Theresa Tam, who is the chief public health officer of Canada; Kathy Thompson, executive vice-president of the Public Health Agency of Canada; and Christopher Allison, acting vice-president, corporate data and surveillance branch of the Public Health Agency of Canada.
With lives on the line, the Government of Canada has always taken a range of actions to slow the spread of COVID-19, from implementing strict measures at the border to securing millions of vaccine doses to providing surge support to provinces and territories.
[Translation]
We have made and will continue to make informed decisions about policies and programs by reviewing information and analyzing all available data. By basing our decisions in this way on the best available evidence, expert advice and best practices abroad, we are better able to target our actions where they are most needed.
In the case of COVID‑19, reliable, timely and relevant public health data is informing our response to the pandemic and thus also protecting the health and safety of all citizens. The data we use comes from many sources. We are always looking for ways to leverage the most appropriate data to improve public health outcomes for Canadians.
The use of mobility data is not unique to Canada and the Public Health Agency of Canada. Governments around the world, including the United States, the United Kingdom, Australia, Spain, Germany, Argentina, Brazil and the Netherlands, to name a few, are using this data to guide their pandemic response efforts.
In addition, several reputable international organizations have described the social utility that mobility data can offer in response to the pandemic. These include the United Nations, the World Bank, the U.S. Centers for Disease Control and Prevention and the European Commission's Joint Research Centre.
In March 2020, the Public Health Agency of Canada began using mobility data to provide outbreak information and guide our response to the pandemic. In partnership with the Communications Research Centre of the Department of Innovation, Science and Economic Development, the agency used anonymized, de‑identified and aggregated location data from cell towers to support Canada's response to COVID‑19. This data was provided under a sole-source contract with the TELUS Data for Good program; the contract expired in October 2021.
The Public Health Agency of Canada also entered into a contract with BlueDot during the pandemic. This contract will expire on March 18, 2022.
[English]
On December 17, 2021, the Public Health Agency of Canada published a request for proposals on buyandsell.gc.ca, which opened a competitive process to continue this work.
[Translation]
I can assure all members of this committee that mobility data, both used and researched, is a valuable tool, which fully respects the privacy of all.
We also do not want to see any delays in the acquisition of this data, as this will and would impact the ongoing pandemic epidemiological monitoring activities. To be clear, the data sought [Technical difficulty—Editor] meet our requirements for aggregation, anonymity and privacy security and do not contain personal data that could identify individuals.
No personal data is obtained or provided.
[English]
This de-identified, anonymized, aggregated data is used to monitor the trajectory of the pandemic and how best to respond to it. This information helps governments at all levels determine how the public is responding to public health directives so that we can best tailor our approach and communications.
[Translation]
Mobility data allows us to examine—
[English]
I'm so sorry, Minister, but the motion called for a maximum five-minute introduction, and you're about half a minute over. I will get you to maybe just wrap up in a few seconds, if that's possible.
No, I want to respect the time that the committee thought was appropriate, so I'll stop now and turn back to you.
Okay, thank you very much. We will begin with six-minute question rounds, beginning with Mr. Brassard.
Thank you, Mr. Chair. Before I start—if you can hold off on the time—I just want confirmation that, as is convention around here, the length of the question is the length of the time that it's given to be answered. Is that correct?
Thank you, Minister Duclos, for being here today. I want to say right off the top that we're here today, not because we don't believe that data is important, and that evidence-based data is important, to manage the pandemic. Every one of us around the table understands that information is important. We're here today because of an RFP that was produced by, as the minister said.... It was put out in December and brought to light the fact that the mobility data of Canadians was being collected, as the minister said, since March of 2020.
Now, let me tell you what this is about, and I'll ask the minister a question in a second.
This is about the fact that it was being done without the knowledge and without the consent of Canadians. That's what's so alarming about this. The other thing is that staff at the Privacy Commissioner's office—and I know that there have been, on a couple of occasions, pieces of information that are contrary or contradictory to each other—said that they had not been contacted about this practice being done, so there are conflicting reports on that.
Now, you can speak to anonymized and aggregated data all you want, but there are security and privacy experts, Mr. Chair, who have expressed sincere concern about the security measures and the protocols that were put in place in order to protect the privacy of Canadians and ensure that it isn't compromised. We are going to hear from experts as we move further into the study, who are going to talk to us about how easy it is to re-identify or de-identify that data for commercial purposes.
My question to the minister is this: Does he not understand the concern that has come to light as a result of this?
First, thank you to our colleague Mr. Brassard for stating from the start that the use of science and the use of information has been key, not only to saving billions of dollars and hundreds of thousands of jobs but also to saving tens of thousands of lives. The outcome of what we've done in the last 20 months.... I repeat: Using information, data and science has saved tens of thousands of lives in Canada. Compared to all other countries in the G7 except for Japan, our death rate is significantly lower. If we had followed the example of our friend at the southern border, we would have had 60,000 more people dying in Canada, so we can congratulate each other on those actions based on science and data.
The second thing we all absolutely agree on—and Mr. Brassard certainly stated that very clearly—is the absolute priority to protect the information of Canadians, and that's why de-identified, aggregated, anonymized data have been used, and 1.7 million Canadians over the last few months have been able to see that data on the web. It's been there since 2020. It was announced by the Prime Minister in March 2020. It was implemented in April 2020, and as of January, 1.7 million Canadians have been able to see that data on the web, so nothing is secret. Everything is transparent, fully science-based and saving lots of lives.
Mr. Duclos, can I ask why the Privacy Commissioner wasn't consulted on this practice before it started?
The Privacy Commissioner was informed, and there was a conversation right at the start of the pandemic, in April 2020. Thereafter—
—there has been a meeting twice a month with the Privacy Commissioner since. In April 2020, it was determined that the information that was being used was not private and was not confidential, following the regulations and the laws of the Government of Canada—
Thank you, sir.
There are conflicting reports about the Privacy Commissioner's office not being consulted in advance of this information being put out there. In fact, PHAC officials said they went to security and privacy experts. Who did they use, if not the Privacy Commissioner, for that advice?
The experts, the legal experts, of the Government of Canada determined early in the process, with the collaboration of the various other experts, including comments made and advice provided by the Office of the Privacy Commissioner, that this information was not private and therefore did not follow the Privacy Act. Despite that, biweekly meetings have been held with the Privacy Commissioner since April 2020, and continue to today.
I have one more question: Who in cabinet was aware of the fact this was going on? Was the health minister involved with this? Did cabinet make the decision to start this practice?
Mr. Brassard, you don't need to be a member of the cabinet. The Prime Minister announced that in March 2020. It's been ongoing since April 2020, and 1.7 million Canadians were able to visit the application and the website to look at those data.
I want to start by thanking the minister and the rest of his team for their service during this pandemic. It's been truly extraordinary work, and I appreciate it. I have had the opportunity to ask the minister questions in my previous capacity as a journalist, but this is my first time asking questions of a parliamentary committee panel, so I want to let him know what an honour and a privilege it is to ask about something that's been really concerning me for the past several days, which is the misinformation that is continually repeated, not only online but in Parliament, Mr. Chair.
When misinformation is constantly repeated in places of authority, people get confused. Maybe even some people on this committee are confused about the facts. I'd like to show you one example from yesterday's question period, in which a member called mobility data a data scoop, and went on to say, and I quote, “Why was it done in secret without the users' consent? Why was the Privacy Commissioner not consulted?”
I would just like to ask you, Minister, if you could clarify for Canadians, first, whether this was a data scoop, was done in secret or was done without users' consent, and second, whether the Privacy Commissioner was consulted. I know you've answered a bit of this before, but I think it will do us good to repeat the truth.
We're very fortunate to have you on the committee. Welcome to the committee and to opportunities that I'm sure you'll take full advantage of in your new parliamentary career.
I have three brief reactions.
The first is around the confusion about the facts. As members of Parliament, we have a duty to avoid confusion and to avoid creating fear when there should be no fear. I mentioned earlier that those data were and are anonymized, de-identified and aggregated. Anyone who has had basic training in statistics knows that data that are de-identified, anonymized and aggregated cannot be used for personal information purposes. You don't need a Ph.D. in statistics to understand that.
The second thing is that we have worked with the Office of the Privacy Commissioner from the very start, following all the rules and regulations, and we keep working with and we value very much the work of the Privacy Commission.
The third thing is that this has not been secret. It was announced in March 2020. On the web since 2020, 1.7 million Canadians have been able to see those data on an application called COVIDTrends.
Canadians can see this on the WeatherCAN application or l'application météo. There's no secret about this. It's been public; it was announced; it's there. Canadians can look at the data, and we've been using it to protect the health and safety of Canadians.
Can you clarify for us whether other jurisdictions in Canada or around the world are using mobility data in their fight against COVID-19?
The United States, the U.K., Australia, Spain, Germany, Argentina, Brazil, Colombia, Equador, the Netherlands, Italy, Greece, Austria, Bulgaria, Croatia, Denmark, Estonia, Finland, Portugal, Slovenia, Sweden and Norway. I'm going to stop here. There are many others. We are all in the same boat, fighting the same disease. We need information and science to beat and fight this disease.
Let's talk about what is really concerning to Canadians, which is the security of their data and their privacy being respected. Can you tell us a bit about how the Public Health Agency protected the privacy of Canadians' data and ensured the security of that data?
Maybe you can even talk a little about the Telus data privacy award, which I think was recent.
Thank you, Lisa. For a slightly different perspective, maybe I could turn to Ms. Kathy Thompson, who, as you have heard, is a key expert with her team. She's working very hard in an environment in which information and science are key.
Kathy, if it's fine with you, may I turn to you? You might want to turn to Mr. Allison at some point.
Thank you very much, Minister.
Good afternoon, Mr. Chair.
I'm happy to speak to the measures that were taken to respect the privacy of Canadians, which was utmost in our minds as we embarked on using mobility data, as the minister said, at the beginning of the pandemic, because of and in response to the pandemic. We ensured that the contract we had in place with Telus and the contract we have in place with BlueDot, as well as the RFP that you're aware has been posted, put forward a number of requirements to protect the privacy of Canadians.
We require that all data that is provided to the agency is de-identified and aggregated. It's aggregated either temporally or spatially, so in terms of either a period of time, by volume or by geographic region, to ensure that we cannot identify any single individual.
All the information we get is void of any personal information.
Ms. Thompson, we're just about out of time.
Thank you.
[Translation]
Mr. Villemure, you now have six minutes.
I will divide my time into several questions, but I will reiterate that the Department of Health is using data for a commendable purpose. We do not object to that; it is the means employed that we are discussing here.
Minister, before we go any further, I would like to know if you will suspend the tender, as requested in the motion unanimously passed by the Standing Committee on Access to Information, Privacy and Ethics.
Thank you, Mr. Villemure.
I also thank you for acknowledging that our goal is commendable. I would go even further and say that not only is it for a laudable purpose, but protecting the population's health and safety must be an essential purpose of government.
The global crisis we are in requires us to use all the tools and information we need to protect Canadians. We talked earlier about the tens of thousands more people who would have died if we had not used all the tools at our disposal.
On the issue of the tender, if you want more information from officials, they will be happy to provide it.
Thank you very much
The tender closes tomorrow and I would like to know if you will order its suspension.
The tender was actually supposed to close tomorrow, but the deadline has been extended to February 18, because bidders have asked us for more time to produce a better bid. This will also allow us to benefit from as much competition as possible under the circumstances. We know that competition in a bidding environment leads not only to better costs, but also to better results.
Thank you very much.
Did the 33 million mobile device users who were subject to “monitoring”, or at least whose location data was used, consent to the monitoring?
There was no surveillance, Mr. Villemure. I will repeat in French what I said in English earlier. The data is anonymized and aggregated. It is impossible to have information of a private nature, and it is obvious that this has not been requested. You are an ethicist and a statistician who is not only reputable but also competent enough to understand that aggregated and anonymized data cannot be used to identify people.
I am absolutely convinced that the department cannot identify people. We agree on that. On the other hand, [Technical difficulty—Editor] between the initial cell towers and [Technical difficulty—Editor]
[English]
We've lost you, Mr. Villemure. You'll have to repeat your question. Your audio cut out for a moment.
[Translation]
I am quite sure that the Public Health Agency of Canada cannot identify people. However, the data was collected by a third party, and there is little information about their handling of it, which concerns me. I don't think the department wants to or can identify people. But let's be clear: there is still a concern about consent.
I will ask you [Technical difficulty—Editor].
[English]
It cut out again. I'm sorry. You're having problems, perhaps with your microphone. It's not a question of translation. The audio cut out completely.
[Translation]
[English]
[Translation]
I am putting a question to the minister that directly relates to his area of expertise.
Minister, even though the letter of the Privacy Act was not violated, don't you think the spirit of the act was still trifled with a bit?
Making an announcement does not necessarily mean that information is made public. I want to ensure that such data collection is in keeping with the spirit of the Privacy Act.
You said it: the act was not violated. I am glad to hear you say that, because it may help other members of the committee to understand that. As an expert, you could also see that, given the way the data was transmitted to the Canadian government, it was impossible to identify people. The data cannot be "re-personalized". It is simply impossible. You have two important findings. I think the people who are lucky enough to sit on the committee heard you loud and clear.
With regard to other perspectives beyond this debate, I invite you to work with the committee to see if other experts could look at other aspects of this broader issue. These privacy aspects could be addressed by the committee.
We will certainly do that, thank you.
That said, you still initiated the request, so you can't wash your hands of it. The data may have been clean when returned to you, but you can't wash your hands of the process for obtaining it.
You said it very well. The government absolutely must protect privacy. There are two conditions for doing so. The first is to ensure that we comply with the laws—we understand that the act has been respected. The second condition is to ensure that the data collected cannot create any issue or risk in relation to the protection of privacy—we also did that.
Over the past few months, 1.7 million people were able to view the data on the Canadian Weather and COVIDTrends sites. If you type the words “COVIDTrends” into Google, you will immediately see the web page. You'll be able to search by different regions across the country and you'll see what the data looks like.
[English]
[Translation]
I am not convinced that there was valid user consent. I am not making any judgment or accusation at this point. I'm not. That is not my role, in any case. I am questioning the validity of the consent.
I am sure the committee must continue to do its work on ethics and privacy. Your role, as members of the committee, is to continue to look at these issues, including the narrower ones like today's and the broader ones, for example, such as the well-known link between collecting information and the use of it—the increasingly easy dissemination and use of information that is collected and shared.
[English]
It's certainly an important discussion.
I want to take a moment to thank all the witnesses for finding time in their busy schedules to be here, in particular Dr. Tam, who I understand originally was unable to find the time but has made the time to be here today.
My first question is for Mr. Allison.
Mr. Allison, for the purpose of this committee, could you briefly describe your role?
Thank you. I am very pleased to be here.
Mr. Chair, my role right now is the acting vice-president of the corporate data and security branch in the Public Health Agency. My normal position is the chief data officer for the Public Health Agency of Canada.
Mr. Allison, are there any other scenarios in which the government has engaged in these types of contracts for the purpose of other evidence-based decision-making, or is this the first time it has done that?
I've been in the agency for approximately six months. In this time this is the first contract you're going forward with. The agency broadly does have data-sharing agreements with provinces, territories and research institutions, but I'm not privy to the details of all those agreements, Mr. Chair.
Through you, Mr. Chair, to Mr. Allison, would you be privy to any pre-existing contracts with third-party private corporations that would be a like-to-like comparison today?
Mr. Chair, regarding the mobility data and the question of Mr. Green, there was interest across government and in some of my previous organizations in making use of large-scale mobility data to better understand the population and to better generate policy. The ability to actually do it, though, has come about relatively recently. In terms of mobility data, the first steps that I've seen come with the COVID pandemic and the desire to actually inform an effective pandemic response.
Through you, Mr. Chair, to Mr. Allison, do you know if the Public Health Agency of Canada as a department is sharing this information with other departments for their decision-making and policy?
Mr. Chair, the information is raw data. The data received from vendors is not shared, but reports and summaries of those reports are shared with provinces and territories and other organizations for the purposes through which the information was gathered, which is COVID and pandemic response.
Can you anticipate, through you, Mr. Chair, to Mr. Allison, other instances beyond COVID-19 where this data might be used, or is it your intention, or do you have a policy, to destroy the data after it's done?
I'm not certain of a policy. Right now the contract you're looking at is for a specific period of time, and the intent would be to use the information for the purposes for which it's collected, for that period of time. I believe there are options for several additional years, and there is research internationally about the use of mobility data to support public health.
I believe there are uses beyond COVID, but the agency has not taken any decision to use it beyond the COVID pandemic at this time.
Beyond the intended use.... I can appreciate that.
I will go to Dr. Tam. Again, Dr. Tam, thank you for being here before us. It has been noted by many experts, and in particular Mr. Christopher Parsons, who's the postdoctoral fellow and managing director of the Telecom Transparency Project at the Citizen Lab in the Munk School of Global Affairs at the University of Toronto. He has stated that this is an important opportunity for us to look at the use of data from third parties. On the idea of informed consent—and Mr. Villemure talked about consent—I personally don't believe at face value that consumers, third party, would have known or had informed consent for this particular use of their data.
Through you, Mr. Chair, to Dr. Tam, the repurposing of Canadian cellular networks for things like pandemic mobility travel has provided you with information, yet we're hearing from the minister and others that it wasn't disaggregated, that it didn't have demographic information. It was able to provide only crude assessments of population mobility
I guess my question is, what is the efficacy of this information in assisting PHAC's public health mandate?
Mr. Chair, this is a novel data source, of course, but one feed, in particular, into data for looking at the response to the pandemic.
Mobility data at this kind of aggregated level can be used when provinces and territories or local jurisdictions enact public health measures to reduce contact rates or to ask people to stay at home, for example, to see whether those measures are actually working. You can see it at an aggregated health unit level.
For example, using Ottawa as a city, the data will show how much percentage increase in mobility there has been in the last period of observation. That helps the local public health departments to figure out if their instructions—
I'm sorry, Mr. Chair. I have 30 seconds left for Dr. Tam.
Through the chair, do you intend to use this information beyond its intended procurement or do you intend to have a process through which this information will be destroyed?
You're out of time, Mr. Green. Be real quick and I'll let Dr. Tam have three or four seconds to reply, if she would like. Then we'll move on.
As Mr. Allison has said, the reports are shared with provinces, territories and the departments that are making policies.
Minister, thank you for being here today.
In order to have useful information or useful data, how many times a day would a Canadian citizen's cellphone need to be pinged in order to be valuable to PHAC?
It might be useful to repeat again that the data are not individualized. The data are aggregated, de-identified and anonymized. They have no personal value role and no personal value usefulness. It has nothing to do with personal information.
You're missing the point of my question, Minister.
If my phone was pinged at 3:00 a.m., once a day, you would find it consistently on my nightstand, beside my bed. It would be of little to no value in the managing of COVID-19.
My question is this: In order for the data to be useful, how many times a day would a Canadian's cellphone location have to be provided to the government in order to make an effective decision? How many data points are there per day?
As I said, Mr. Chair, the information that we use is not personal information, so I'm sorry, you should ask those questions to someone else, certainly not [Technical difficulty—Editor] or someone in PHAC. The data we're using are anonymized, de-identified and aggregated.
If you don't know how many times a day a Canadian cellphone is being tracked, how do you know the data is useful? Like I said before, if we're only pinging that phone once a day, how can you be making informed decisions about Canadians' whereabouts or their movements? How many times a day would you need to know where somebody is in order to usefully track people moving around and curb the spread of COVID‑19?
That's a better question about the usefulness of the information. I'll quote the experts and top world researchers from the U.S. Centers for Disease Control and Prevention and from the European Commission's joint research centre. They say that mobility explains transmission and spread and can reduce mortality and mitigate the need for lockdowns. In basic words, that means saving lives and saving jobs.
You talked a lot about de-identified data. Are you talking about data in its purest form? Do you actually have raw data points?
No, Mr. Chair. As I mentioned earlier, the data of which we speak today are data that you can access immediately on your telephone by clicking on COVIDTrends. You can also go to the WeatherCAN application. In recent months, 1.7 million Canadians have done that. You'll see the data. These are mobility data that we have. You'll find out why these data are obviously not individualized and not personalized. They're de-identified, aggregated and anonymized.
De-identified data.... Data is stored in bits and bytes or ones and zeros on a medium. When you delete a file, Minister—and you don't have to have a Ph.D. in computer systems technology or computer science to know this—all you delete is the link on the file allocation table that references the data on the stored medium. Anybody with any skill whatsoever—anybody under the age of 35 today—could probably go back and look at any particular data point on a data medium and re-identify data. It's not a complicated thing to do.
Minister, what assurances can you provide to this committee and to Canadians that their information cannot be re-identified?
We're talking about the deletion of a file. Whether the file is deleted or not makes no difference. The file has no personal information value or content. That file has no individual-level data. It's de-identified, anonymized and aggregated. That file has no value for anyone who would seek personal information.
In your briefing at the start, you mentioned that the information you have would be useful for other levels of government. Has the Public Health Agency of Canada shared this information with other agencies provincially or municipally, or with any other actors, since you've come into possession of this data?
Yes, certainly. Thank you, Minister.
Mr. Chairman, we provide some report summaries that we share with the provinces and territories to help inform their decision-making and their situational awareness with respect to public health and population mobility. In addition, as the minister already mentioned, we prepare summaries of reports that we publish on COVIDTrends.
That is who we share the information with.
I'd like to start by thanking both the minister and my colleague from the Bloc, Mr. Villemure, for making it absolutely clear that the data that PHAC receives through its arrangements with BlueDot and Telus cannot be repersonalized, that the disaggregated, anonymized data that is received by the agency cannot identify the Canadians who are moving about their day throughout this pandemic.
That's a really important point. I want to thank the minister and my colleague for clarifying that to us in the committee room and to Canadians.
I'd like to talk about transparency, because that is something that my colleague Mr. Brassard raised and that there has been some confusion on. On March 23, 2020, the Prime Minister announced the BlueDot contract, and and then on March 26 Health Canada entered the contract with regard to anonymized, disaggregated data. On April 22, 2020, PHAC engaged the Office of the Privacy Commissioner as it moved forward with this useful tool in monitoring the pandemic and the movement of the pandemic throughout our communities.
On September 22, 2020, the privacy management division issued its analysis confirming that the data from both Telus Mobility and BlueDot is not considered personal information, and therefore does not engage the Privacy Act. Furthermore, Canadians were able to engage with Dr. Tam through the COVID tracker to know exactly what was being assessed for the safety and health of Canadians.
I can go on—into the record of January 25, 2021, when consultation was held with the public health and ethics group to assure yet again that the data that was utilized for the health assessments was anonymized and not personalized.
Minister, since there seems to be some confusion about how we engaged with the Office of the Privacy Commissioner, and how the government moved forward in making sure that its contracts received data that was clear of any personalized information, could you maybe go a bit deeper into the details of the steps and the diligence taken by the ministry and by PHAC to ensure that the privacy of Canadians was ensured throughout this process?
Thank you, Ms. Saks, for not only a great question but a great summary of the situation, which I believe will serve to assure and reassure everyone in the committee and anyone else listening and watching us today about the use and the usefulness of those data.
On the link to the Privacy Commissioner, the Privacy Commissioner and his office have an incredibly important job to do in the Government of Canada. Their advice, their input and their guidance are key to everything we do, including through a pandemic. A crisis is no excuse for not protecting the privacy of Canadians. That's why we've done that since the start and will continue to do that as we keep fighting the virus.
As you alluded to, PHAC was engaged from the very start with the Office of the Privacy Commissioner, immediately in April and biweekly thereafter. There was also a process in the Government of Canada to assess whether the information that was being gathered was subject to privacy laws. The determination was made that it was not subject to the Privacy Act. Therefore, the work continued, using, as you mentioned, disaggregated, de-identified and anonymized data.
We will continue to work with the Office of the Privacy Commissioner as we proceed through the crisis. As I have said, protecting the privacy of Canadians is an absolute key priority. Whatever we do must fulfill that obligation.
At this time, perhaps Ms. Thompson or Mr. Allison can just clarify to me if a multibarrier security approach was used when PHAC received the data, to ensure additional privacy and security measures were in place. Yes or no is fine.
I can answer that, Mr. Chair. Yes, a multiple-barrier security approach was in place to protect and ensure that the data was used appropriately.
[Translation]
Thank you, Mr. Chair.
Minister, can you tell me in detail what the process was by which millions of users consented to the collection of data?
Thank you, Mr. Villemure.
As I have stated on several occasions, the Canadian government has never collected and will never collect information of a private nature regarding this issue. The information that was solicited and obtained is aggregated and anonymous information, and therefore cannot in any way lead to the identification of individuals or the sharing or use of personal information about those individuals.
The data we obtained was already aggregated and anonymous. We would never aim to identify these individuals, which would in any case be quite impossible and inappropriate.
Of course, I agree with you.
That said, someone obtained non-anonymized data and anonymized it. How was consent given to obtain the first data?
How did your supplier, who gave you anonymized data, obtain consent from the millions of users?
I will repeat my answer, Mr. Villemure. I think you have understood it, but there may be people who have not yet understood.
The data that we asked for and obtained is anonymous and aggregated data. It is impossible to identify people and it is impossible to use the private information of these people with the data we used, and which is available by the way. As I said, 1.7 million people have been able to view it in the last few months.
I'm telling you what the Canadian government did. Let me repeat that the data we obtained was anonymous and aggregated. It is impossible for it to lead to the identification of individuals, behaviours or individual characteristics, because this information cannot be used for those purposes.
In the context of COVID‑19, the Canadian government has an ethical, moral, economic and health obligation to protect the safety and health of people, while absolutely protecting the privacy of people. Tens of thousands of people have unfortunately died, including in Quebec.
Tens of thousands more could have died if we had not done our job properly.
[English]
Through you, Mr. Chair, to Mr. Allison, I'm hoping to get a straight answer. I have to say I'm not comfortable with the way in which I would say language is being used here in terms of who's culpable for this. What I feel I'm hearing from the minister and from his testimony today is that we're outsourcing potential privacy breaches.
Within the context of your procurement contract, through the chair to Mr. Allison, is it the case that BlueDot and Telus are always actively engaged in the tracking of mobility of Canadians, or was this a specific procurement track of the program that would have requested specific data that would then have been aggregated?
That's a fair point of order. We can have Mr. Green on.
Go ahead. I stopped your clock, Mr. Green. I'm keeping track here.
I think you got your question in. I'll leave it to our panel of witnesses to respond and then we'll carry on.
My apologies, Mr. Chair.
Mr. Green, if you could please repeat the core of your question, I would be very pleased to respond to it.
The question is this, quite simply put: We've heard today that the government is not willing to take responsibility for the collection of this data. You have outsourced potential privacy breaches to BlueDot or Telus because they would be the ones that would be collecting the individual data.
When you crafted the procurement for this particular contract, was it with the understanding that BlueDot and Telus were already collecting this mobility data on people, or did it provide specificity in the request on behalf of the government?
Mr. Chair, both BlueDot and Telus collect this data as part of their business. It may be a point of clarification that in terms of consent, both have options for consent. On Telus, there's a website where folks can go and look at how their data is being used as part of the “data for good” process. All you need to do is enter your [Technical difficulty—Editor]. BlueDot, as a crowd-sourced operator, does this through individual applications on users' cellphone devices.
Then you would agree that in the context of this program, BlueDot and Telus were actively engaged in tracking the individual mobility of their users for purposes for which they did not have users' full and informed consent?
I can't speak directly to the business of BlueDot or Telus. They use cellular mobility data, and they provide that as a service to others. They have both commercial and, again, “for good” or “for social good” uses of these programs.
Here is my last question, through you, Mr. Chair.
We've heard time and again that the Privacy Commissioner was engaged. The Privacy Commission has suggested that they were not consulted, and we heard today that this program was not subject to the Privacy Act. Through you to the minister, if it wasn't subject to the Privacy Act, then why were there bimonthly meetings?
That's because it's an absolutely essential thing to be able to work together on a continuing, ongoing basis. Obviously, this wasn't the only issue being discussed with the Privacy Commissioner.
Mr. Chair, can the minister please provide the answer to this question in writing?
I'm asking whether or not, at any time, the Privacy Commissioner provided caution on the program, and if so, what caution.
Your request is noted, but you're well out of time, and we have the minister for only about another four minutes.
We're going to finish the round with two minutes from Mr. Kurek and two minutes from Ms. Khalid.
To the minister, Mr. Chair, 33 million Canadians had their information observed and then aggregated and sent to PHAC. There are a lot of steps in between what PHAC, I'm being told, has received and the information that was collected from the cellphones of Canadians. Minister, were there clear guardrails involved in ensuring that data was protected, yes or no?
With respect, Minister, it's my time. I hope you can provide that answer in writing to Mr. Green.
Were clear guardrails put into place, yes or no?
I will do that, and any other question I will be pleased to answer.
On the guardrails, as I said earlier and am pleased to repeat again, the information that we received was de-identified, aggregated—
Minister, I think you're missing the point. This data does exist. PHAC may not have received it in the report it got, as we got a copy of one of the BlueDot, but the information exists somewhere.
Did PHAC ensure that there were clear guardrails put in place so that the privacy of Canadians was protected at every step of the way, for the 33 million users of cellphones across this country whose data was then aggregated and sent to the department?
There are a lot of steps between somebody's cellphone being observed and the information that was sent to PHAC. Were clear guardrails in place, yes or no?
Point of order, Mr. Chair. The minister isn't able to answer the question because he's being interrupted.
I've ruled on that already and asked Mr. Kurek to stop so that we can get a quick answer from Mr. Duclos.
Go ahead, Minister Duclos.
The time of the members of the committee is very important. It's great to ask great questions. I'm grateful for that. Sometimes I think it's important for members of the committee to hear answers as well.
If I don't have time to answer those questions sufficiently well, please don't hesitate to use other channels to ask them. My team will be extremely pleased to do so. We have a joint responsibility to look after each other, including protecting the privacy of Canadians. This is what PHAC has done.
Thank you, Minister Duclos.
Now, for the last two minutes, to take us roughly to our hour with the minister, go ahead, Ms. Khalid.
Thank you, Minister, Dr. Tam and health officials, for sharing your time with us today.
Minister, we've had this discussion. I have observed the questions of the members on this issue over the past number of weeks as it has developed. We're talking about a balance between protecting the privacy of Canadians and maintaining and using good-quality data to protect Canadians' health and safety.
Minister, I know you weren't able to get through a lot of your answers with previous questioners. Can you perhaps outline for us what additional steps the ministry, PHAC, took to ensure that safety was protected and that we were able to really secure that balance between security of privacy and security of health for Canadians?
That's a great way to frame the responsibility. It's a joint responsibility, as you've said, to protect the privacy of Canadians—it's an utmost absolute priority of this government—and this other responsibility to protect their health and safety. You've said it really well. We have this joint responsibility.
That's why the data that were used were used in an anonymized, aggregated, de-identified manner, and that's why the usefulness of that data has been demonstrated in about 30 countries. I can list them again. All G7 countries and almost all OECD countries that I know of have been using those same data to protect the health and safety of everyone. It's a joint responsibility. You've explained it really well. We'll continue to address that responsibility, with your assistance and input.
Two minutes go by really quickly. You have maybe five seconds. If you have a yes-or-no question, I'll let it go.
In that case, then, we're just about a couple of minutes over on the hour with the minister. At this point, I will thank him. He may, if he wishes—and of course we wouldn't say no if he wanted to—stay through to the end. At this point, we'll thank the minister for appearing.
We have Dr. Tam, and we still have our other officials on the call, so now I'm going to proceed directly back to Mr. Brassard for six minutes.
Go ahead, Mr. Brassard.
Mr. Allison, I want to go back to something you said. You said that 33 million Canadians who had their mobility data collected had an opportunity to consent by this. I just want to make this clear. The 33-million figure is the number of cellphones that exist in this country, so you're telling me that 33 million Canadians actually consented to having their data collected in the manner in which they did.
Mr. Chair, I actually have no idea where the number of 33 million came from. Through the Telus contract, there were a maximum of approximately nine million people who had consented and whose data was used through the Telus “data for good” platform, and approximately five million whose data was used through the BlueDot contract. Because the data is de-identified and aggregated, we have no idea where the overlap between those two datasets might be. The actual number is somewhere between nine million and 14 million.
Let's say it's nine million, then. Would those nine million people actually have consented for Telus to have that information passed on to the Public Health Agency of Canada? Would they have known that that information was going to come to PHAC?
Mr. Chair, those people would have not opted out of the Telus option that they had related to the “data for good”.
What if they wanted to opt out? What options would have been available to them to opt out of having their data collected for the purposes of PHAC using it? Would they have had that option?
Absolutely. On the Telus website, again, it's a very simple process. You can go and enter your phone number. It's easily findable under Telus privacy mobility. You enter that, you hit submit, and it goes to Telus. I'm not sure they have a 24-hour turnaround, but they commit to getting back extremely quickly and making sure the device is removed.
My next question is for Dr. Tam.
Dr. Tam, as I said at the onset, I think you can understand the concern of Canadians about having this information collected, I would argue, without their consent. I'm wondering why this information would be so important when public health agencies across Canada federally, provincially, municipally, territorially have access to data that could inform public health response, and not just now but going forward. If all of this information is there, why would we put at risk the privacy of Canadians by tracking their mobility data when all of this information already exists? There are significant risks and we'll hear about these as we get the security and privacy experts in front of us, but why would you not just use the data that's available to you and other government data that's available to determine public health response, both for COVID and in the future as it relates to the RFP?
Mr. Chair, I just want to reiterate that this is de-identified and aggregated mobility data, and in the public health context we look at different types of data and often layer on different information. Why we believe it's an important tool for now and moving forward is that you can use it to lay on epidemiological data and determine whether there is an outbreak in a certain location. If you can actually, both in real time but maybe even in modelling and prediction, know how the mobility patterns go between different areas—whether it's Canada or in the global context as well to look at the disease spread potential—that can be one way of using this information.
The other application, as has been mentioned, is to help jurisdictions look at the effectiveness of their public health measures. This de-identified and aggregated data can certainly help with that. We are in the infancy, I believe, at public health in the application of big data, and we are doing this in a very careful way to respect privacy.
However, if you look at other reports and lessons learned, you will see that public health lacks a lot of information, and this lack of information is actually laid up quite nicely in some of our external advisory [Inaudible—Editor] on the pan-Canadian data strategy.
BlueDot is one of the key groups, companies, in Canada. In fact, it was already set up prior to the pandemic to collect information. If there are any further details, I don't actually know that. Mr. Allison may have more specific details about the contracts.
Dr. Tam, I want to thank you for joining us today. Throughout the pandemic, you've been a voice to Canadians about the clear importance that science and data have in guiding us and keeping Canadians healthy and safe throughout the past two years.
In December 2021, the public health officer's annual report discussed the value of mobility data to inform the pandemic. I'd like to ask you, if I may, how important it has been. You mentioned that there was a deficit of data in the Public Health Agency of Canada, so it seems that this process we've gone through has been vital to protecting Canadian communities.
Can you elaborate a bit?
As I said, public health needs more capacity, more tools and more platforms, including data platforms, to inform our decisions. I don't mean that just for the Public Health Agency; my report points to the whole public health system in Canada.
Mobility data is one promising area where.... I think one can appreciate that a virus such as the one that causes COVID-19 is spread by human-to-human contact and via humans moving from one location to another. This type of data helps with both the epidemiologic assessments and forecasting potential areas of outbreak.
This can be added to the suite of tools, such as wastewater monitoring, that we've been trying to expand during this pandemic. That's why I've highlighted this as one of the data sources that could be very helpful, as well, in informing local jurisdictions of the effectiveness of some of the measures.
To follow up on that, with regard to the current RFP that's being contemplated, what would the impact be on public health assessments and measures if it were delayed beyond its deadline, as we move through this fourth wave, the omicron variant?
This is a valuable data source. I think it is most valuable if you have a more continuous ability to [Technical difficulty—Editor] time. As we can all appreciate, the dynamics of viral spread and the epidemiology are changing over time, and the policies being enacted in different jurisdictions across Canada, which can be quite different, are also shifting over time.
Having a gap in this data reduces our ability to look at those important policy measures, but it can be retrospectively looked at as well. It's not as good, maybe, as more real-time and more prospective analysis.
We're here to try to help the committee and provide the information you need. I think the request for proposal has been extended.
We look forward to your deliberations and the outcomes in your report.
[Translation]
Thank you very much, Mr. Chair.
I usually ask my questions in French, but since this is a very specific question, I'm going to speak in Mr. Allison's native language.
[English]
Mr. Allison, in your response to a question from Mr. Brassard, you were talking about the consent of Telus or cellphone users. Can I ask you to phrase it...?
Perhaps you could help me out. From your answer, I think you were trying to say there is a consent that Telus users would give to allow their data to be collected as part of the “data for good” initiative, for an unspecified range of uses. For this, the contract the government had with that company would fall under a framework of data-appropriate use.
Is that a fair way of describing it? If not, could you please clarify?
The way the Telus opt-out works is that you can opt out. You are, I believe, considered by default to have opted in. Again, Telus uses mobility-related services as part of its business, and I'm not privy to that. You'd need to ask the company.
The “data for good” [Technical difficulty—Editor] uses the de-identified, aggregated data to understand the movement of populations. That is the contract PHAC has in place. A strengthened contract is what we're looking at for the new RFP.
I'll maybe clarify here. I stopped your time, Greg.
I am told—and the members participating via Zoom can jump in if I'm incorrect—that the audio is okay on Zoom and for the translators. It is simply our ability to hear live in the room.
I think the problem is understood.
Oh, no. The translator is waving to me, so perhaps we have a problem with translation, too. I'll suspend, and we'll get this sorted out.
We're back in session. I understand that the interpreters also have the same issue we do. Zoom audio is okay, but room audio is a bit of a problem. I'm not sure at what point—
If I may, Mr. Chair, it was at the point he started to describe what the “data for good” was. I was just waiting for the definition, and it disappeared from the screen.
All right. Hopefully, since the Zoom audio is okay, we are going to ultimately end up with a good record of this meeting, but maybe Mr. Allison can address that one point and otherwise wrap up his response, because we are running out of time, Mr. Fergus.
I'll make it quick, Mr. Chair.
The “data for good” program is the specific entity or part of Telus that the contract is with. The original RFP had a number of proposals in place to, again, make sure we were using de-identified, aggregated data, and the new RFP looks to take the best practices we had and continue to build on them.
Thank you very much again, Mr. Chair, for your kindness in allowing me to pose that question.
I will just ask one more thing. If the witness felt he had more information or wanted to make sure we had the complete information, if he thought that it was relevant, I would invite him to submit it to the committee in writing on this particular question.
[Translation]
Thank you, Mr. Chair.
I was very happy to hear Dr. Tam say that it was not the end of the world if the tender was postponed and that it could be reinterpreted in retrospect. Indeed, the fact that the official tender date is being delayed shows us that.
Mr. Allison, if I understand correctly, at TELUS there is a presumption of consent, since the opt-out was not exercised. In your view, is the presumption of consent valid consent?
[English]
Mr. Chair, the question of meaningful consent isn't really one I can answer. Telus is transparent about what it is doing. The Government of Canada is being transparent about what it's doing and how it is using mobility data, but at the end of the day, it is up to users of the service to make the decision whether or not they would withdraw their consent from Telus.
[Translation]
As I understand it, the average mobile phone user won't know about this unless they are a little more informed or have checked the TELUS website.
Is that right?
[English]
[Translation]
You cannot tell me the process by which millions of users implicitly consented to the exchange of data.
Am I right?
[English]
Not exactly, Mr. Chair. Through COVIDTrends, which, again, is a public Government of Canada website that has seen more than 1.7 million people go through, there is a very clear link to mobility data. There's a link to the Telus site. We explain where the data is coming from and we explain that it can be opted out of.
[Translation]
All right.
So one can exercise one's right to refuse if one has the presence of mind to do so.
Was TELUS the only data provider? After all, there are other telephone companies in Canada.
[English]
The only telco that was engaged by the Public Health Agency of Canada was Telus. For the current RFP, of course, there may be other bidders and other vendors. Then, of course, there is BlueDot, which is crowd-sourced data, which is different. That is still active until March 22.
[Translation]
Mr. Chair, I am told that the interpretation is not working.
Can you confirm whether or not this is the case?
[English]
I am receiving interpretation. Are there any other members who didn't?
[Translation]
I'll try speaking in French to see if the interpretation works.
[English]
[Translation]
Thank you.
Mr. Allison, paragraph 2.3 of the French tender call specifications speaks of a use “beyond the pandemic”.
Will the use of location data obtained from mobile devices continue after the pandemic?
And who will decide when the pandemic is over?
[English]
I'm not certain exactly who would decide when the pandemic comes to an end. I believe potentially Dr. Tam would be better placed to answer that question than I am.
The idea behind the contract is, again, that the mobility data can be very useful as we're looking at a range of public health problems across Canada, and could be useful as we gain more experience both with using the data effectively and using it ethically while protecting the privacy of people in Canada. The intent is to explore what could be done after that, but without predisposing any decision that PHAC might make.
[Translation]
The data could therefore be used after the end of the pandemic, although it cannot be determined at this time when it will be over.
Dr. Tam, I'm curious. Are you ever going to say that the pandemic is over? How will that work?
[English]
The definition of a pandemic and the declaration is done at an international level. At the Canadian level, we could certainly, together with the provinces, look at when we pass what I call the “crisis phase” of a pandemic, but we believe this virus is going to continue to affect our population for a significant period of time.
I was not involved in the RFP, but I believe the [Technical difficulty—Editor], for example, beyond the COVID situation we have at the moment.
Of course, we should look at what we learned in terms of the application during COVID, because as I said, I believe public health is insufficiently capacitated, particularly as it relates to the use of big data. Therefore, this is something we will continue to learn.
[Translation]
Thank you very much.
I'll summarize this by saying that it is possible that the data will be used after the pandemic, even though we don't know when the pandemic will end. I understand your reasoning completely, but it is possible that the data will be used after the pandemic. At the moment, we don't know that.
Is that the case, Mr. Allison?
[English]
Mr. Chair, based on the terms of the contract, which, again, is public and is open, there is the option to extend the contract.
[Translation]
[English]
I'm really grateful for this opportunity. I echo again the concerns raised by Mr. Parsons from the Telecom Transparency Project, in that it's opening up an opportunity for the public to just look at how pervasive the collection of mobility data is and how, I would suggest, outdated our notions are of informed consent and privacy as they relate to protecting consumers.
My hope from this committee is that we get to a place where we can get very clear about what that looks like for protecting the individual consumer.
Mr. Chair, members of this committee and witnesses, it still feels that while I continue to hear this government suggest that it has followed the letter of its law, I'm still unclear about what the ethics are around the collection of this in what I would suggest to be a surreptitious manner.
Through you, Mr. Chair, to Dr. Tam, we've heard you and Mr. Allison say you have not been a part of this procurement process. Who within your agency was responsible for the procurement of this project?
Thank you, Doctor.
Mr. Chair, it is my team and I who are responsible for the procurement. My apologies if I—
The question was put to you earlier about why these companies were selected. I'll put that back to you. Why were BlueDot and Telus selected as corporations? Were other agencies within government maybe able to provide this information? I think about the budget and the scope of the Communications Security Establishment.
Mr. Chair, I'm not aware of what decision was taken in 2020. The way the two contracts work together ended up being quite complementary. We had the [Technical difficulty—Editor] from Telus, which we found to be more useful, even then.
In fact, we did not do the actual data collection or the modelling. This was done on our behalf by ISED's communicational research council. They provided us with the reports and with the de-identified, aggregated data. We could then go back and verify or see if we had any questions on the reports.
The dataset from BlueDot is different. It has different levels and different strengths and weaknesses, effectively. By using both of these datasets—which were in place in 2020, long before I joined the agency—the team was better able to understand the actual population-level mobility trends during the pandemic.
Through you to Mr. Allison as a follow-up, do these contracts allow for vendors to make a profit on the sale of the data they submit to PHAC, beyond the scope of the contract?
My apologies, Mr. Chair. I misunderstood the first question.
The sale of this de-identified, aggregated data is part of the business offering of BlueDot and part of the business offering of Telus's “data for good”.
When they're doing their RFP and showing that they can qualify for the tender, what would be other commercial examples where they would be taking this kind of data and selling it to corporate interests?
Mr. Chair, to be clear, they would not be selling the data that's provided to us. Again, I'm not privy to the inner workings of either Telus or BlueDot, so this question would probably be better posed to them.
Through you, Mr. Chair, to Dr. Tam, we recognize that there's been a statement of a need for this to be used as evidence on which to base decision-making. In the chief public health officer's opinion, if this contract were to cease, what would be lost in evidence-based decision-making on a move-forward basis, given this point in our pandemic preparedness and readiness?
Mr. Chair, as I said, public health has had a lack of data to inform this decision-making, so this feeds into helping fill in some of those gaps. I think that insight moving forward is important, because policies are shifting and the spread of the virus is shifting.
[Technical difficulty—Editor] one minute left.
Through you, Mr. Chair, could the chief public health officer provide one specific policy that would have been drafted and implemented using this mobility data?
I cannot point to a specific policy. This is to be used by the provinces. The partnerships we have with them mean we share this information so they can use it for their own applications.
Mr. Chair, in evaluating the re-offering of this contract, surely there would have been some kind of performance measures within the contract that would have shown its efficacy.
Through you to Dr. Tam—or Mr. Allison if it's more appropriate—how would the decision be made on whether or not the first contract actually met its mandate and scope?
Mr. Chair, I will start, but I think Mr. Allison may be the expert in this area.
All I can say is that we are at the actual start of the application of this type of information. If we're looking at an evaluation framework, we would be in the developmental stages of these kinds of data projects. As one can appreciate, in terms of maturation and evaluation, the indicators for success are definitely at the initial stages of the set-up for this type of data.
Thank you.
We are out of time with that.
Now I'm going to go to Mr. Calkins. I understand the time will be shared.
Go ahead and start, Mr. Calkins.
This is a quick question for Mr. Allison.
As the chief data officer, you are responsible for the care and control of the data, but you would not just go and collect data from any source unless you were directed to do so. Who directed you to go and get that information?
Mr. Chair, I was not directed by anyone to go and get this information. The decision to move forward with another RFP was partially due to the first one's closing, and because both the data scientists and—
Mr. Allison, I'm not talking about the current RFP or the withdrawn RFP. I'm talking about the initial data. Somebody would have directed your organization or your portion of the organization to get the data. I'm simply asking who it was.
I do not know who may or if anybody did direct the organization to get data in 2020, as I was not here.
Okay. Thank you.
Dr. Tam, thank you for being here.
In my question for you, I will follow up on my line of questioning that the minister evaded. He did not tell me how many data points a day we would need from an average Canadian's cellphone in order to be effective. Mr. Green has asked a question as to whether or not there were any rubrics for the collection of this information to make it useful.
My question for you is, did the Public Health Agency of Canada buy information for which we didn't have any rubrics about how many times a day an individual's phone was pinged, having had no actual input into the scientific information-gathering process? Am I accurate in that statement?
Mr. Chair, again, I am not the person most intimately involved in this particular initiative. However, I know that because we've asked for de-identified and aggregated data, we do not get any information on pings at the Public Health Agency. I just wanted to clarify that, but in terms of the methodology and the analytics and the sensitivity, etc., of the efficacy of the data requirements, I'm going to have to direct that question to Mr. Allison, or we can follow up after this meeting.
I'm going to have to suspend. We think we may have additional audio problems that may affect the recording of the meeting. The meeting is suspended.
I'm not certain that our problems can be either properly identified or solved, and time is going by, so I'm going to continue with the meeting. We may have a problem with the evidence being recorded properly for the meeting, which I don't think we can resolve immediately. I'm going to continue.
Mr. Calkins, you're sharing your time with Mr. Kurek. He has a little under three minutes.
Go ahead.
Dr. Tam, thank you for being here. I'm curious about the data itself. We've heard a lot of talk about its being anonymized and de-identified and disaggregated, but I'm curious. On the data I've seen in terms of the BlueDot report, the information that's available publicly online, is that what the data looks like when PHAC receives it? Or is there more in-depth data that is provided to the Public Health Agency? Could you describe exactly what that data looks like?
Mr. Chair, may I pass this question on to Mr. Allison? I believe the data frame can be provided to this committee if they don't already have it, but it is very aggregated, like a health unit or a geographical area. I know that it's not even looking at numbers but rather proportions or percentages of shifts in mobility.
Could I pass this on to Mr. Allison, please?
The data, as said, is de-identified and aggregated. I understand that it doesn't mean a lot in and of itself. The level to which it is de-identified and aggregated, though, is quite significant.
Effectively, for one data line, we have a table called “percentage time at primary location”. This basically represents the percentage of time that a cellular device will be at one place. Wherever it spends the most time is the primary location. The dataset would say a date—a single day—and would give a province, would give a health region, or potentially go down to a census subdivision, which is effectively a municipality, and then we get a percentage of time at that location.
For example, for Manitoba in a health region, you might have 91%. We would know that for the aggregate, for the time or the day—it's aggregated for an unspecified number of potential users within that health region—91% of the time that device stayed at its primary location. We would use that as a proxy for movement and adherence with public health measures.
Perhaps I could just dig a little deeper into that. The data sources outlined in the information provided to this committee from the parliamentary secretary talk about filters to exclude more than five unique devices, but also talk about devices being pinged entering or exiting the country, two devices within a household. It gets pretty specific. Forgive me, then, but with the type of data that's actually provided to PHAC versus the massive amount of information that exists with cellphone providers, there is a massive difference that may exist there, and Canadians are concerned about where that line is. I'm wondering if it would be possible for PHAC to provide some of those specifics so Canadians know exactly what that data looks like.
I believe we can provide samples of that data to the committee that would help you understand and make your decisions.
Before I begin, I want to thank Dr. Tam for being here, and obviously the minister before her. Thank you for your service and everything you've done during this very difficult time.
My question is probably best directed to Mr. Allison, and forgive me for oversimplifying. A lot of the technical questions have been addressed, and we're nearing the end here. I just want to compare this in a way to, say, something like Google Maps. When you open up your Google Maps—like probably every Canadian, 38 million of them—you look at your phone and it shows you where you are. I'm sure with every service provider—Rogers, Telus, Bell, whichever you have—when that dot appears, it is ultimately apparent where you are and where you're moving to.
If we look at that and we compare this information that's coming through, the mobility of Canadians, is it similar to that in some way?
Mr. Chair, the comparison between the de-identified aggregated data that PHAC receives and the amount of data that is being transmitted by mobile devices and used by both applications and telcos is like a bucket or even a drop compared to the ocean, effectively. When we're looking at Google Maps.... There are public goods. When I go out, I use it and I consent to my data being used so that I can understand when I show up at the pool with my kids, we can get in. That's one of the social goods that is looked at with this data. The trick really is maintaining the privacy and security of folks while we're doing it.
Again, I know that a member before talked about ones and zeros, and said it's very easy deleting this and that. Forgive me: I'm not under 35, so I don't know what that was all about. Say, you look at the opting out, and again, I refer back to Google Maps. It has those questions on there. Do you want this mobility to be followed? I just say no. Every application we have on our phone asks us questions. Do you want the “speaker” feature to access your phone? Do you want the “photo” feature to be accessed on your phone? For someone like me, I don't engage in too many applications, but I still have a lot of them—the “calendar” feature or the so and so feature. When you look at all of those things and all of these applications, you see that they all have that opt-out feature.
I just want to go back to that and ask, is it as simple as that to opt out of this feature? I'm just relating it to, basically, what Canadians are engaging in every day. Millions and millions of Canadians are engaging with all these applications on a daily basis. What's the difference here, really?
I go back to you again, Mr. Allison. Thank you.
Mr. Chair, I think that's an accurate description. Each of the applications now—because of the changes to operating systems, both Apple and android—requires opt-ins for a large number of the uses, including, usually, mobility data. BlueDot also has an internal process in place whereby it will only provide data to us if a device has appeared over five consecutive days. That also prevents somebody signing in once, getting a ping, and then that making it into the data that's permitted for use in the reports.
Actually, I don't have much more than that.
I want to mention that I thought it was very clear, with the minister's answers to the questions, in terms of initially what the information is being used for and how critical it is. It was very clear that it was already publicly available for so long. I just want to thank the minister for clarifying those points.
Other than that, I don't have any more, so back to you, Mr. Chair.
Thank you. You used most of that or a good chunk of the extra minute, so we'll carry on and go to Monsieur Villemure for two and a half minutes.
[Translation]
Thank you, Mr. Chair.
I would just like to say to Mr. Bains that the minister has answered these questions with less than perfect clarity.
Mr. Allison, as I understand it, there was an analysis done with respect to the need to balance public health needs, which are clear, with privacy. At some point, these two elements were weighed. What were the criteria that led to the choices that were made as a result of that exercise?
[English]
It's pretty fair to say that the focus of the Public Health Agency of Canada is to protect the health of Canadians, but that can never be done while sacrificing privacy or sacrificing the rights of our citizens. In everything I've seen with my teams and the teams of people putting together the RFP, making sure the privacy of Canadians is an utmost priority is key.
[Translation]
Thank you very much.
Does this mean that you followed the law and went beyond the requirements? What were the criteria and how many were there?
[English]
[Translation]
I will repeat my question.
I started by saying that there was public health on the one hand and privacy on the other. You had to balance these two aspects. What were the criteria that led to the choices that were made and how many were there?
[English]
I think I understand.
Mr. Chair, the law in the Privacy Act for the Government of Canada is very clear. Part of what we did, as we were engaging with the Office of the Privacy Commissioner and as our own privacy experts were looking at what we were doing with mobility data and what we wanted to do with the new RFP, was first to look to see if there were any privacy impacts or if any personal information was being held or used. These experts and the external ethics board that guides PHAC came to the conclusion that no personal or private information was part of the mobility data we were looking at.
I don't have a specific list of criteria for Mr. Villemure. I'd say in any specific case we'd be going through, part of the work is to make sure we're doing it ethically and we're protecting and looking after Canadians.
[Translation]
[English]
With that, we're just a little over time, in keeping with the generosity of the last two.
We'll go, then, to Mr. Green. We'll have Mr. Green for three minutes, and we may have enough time for a couple of questions from what would be the final round with Mr. Brassard and Ms. Hepfner.
Go ahead, Mr. Green.
I appreciate your generosity.
Dr. Tam referenced that we are in the beginning of the collection of big data. I would like to know, through you, Mr. Chair, from Dr. Tam, for 2022 what would be her thoughts on the ways in which big data will be used within the Public Health Agency of Canada. Are there other aspects of big data collection of open data that she'll be exploring in her department to make best use of evidence-based decision-making?
Public health has really not taken the best advantage of available big data, so this is one of the key ones being utilized at this point. There are other big data sets that could be examined, and the application of algorithms and artificial intelligence. However, it's quite sad but true that public health hasn't really made the best use of that.
Internationally, I believe flight patterns and that type of information is going to be used and is being used, and other countries are using it to look at the spread of infectious disease. However, there are other applications in terms of healthy living and climate change and other big data sets that we could probably take more advantage of.
Does it reason, then, given the newness of this kind of emerging technology, that perhaps it might be the case that our existing privacy legislation hasn't quite caught up to the technology?
When you were taking briefings from the ethics panel, what were some of the cautions that would have been provided to the health agency to ensure that lines weren't crossed, that ethical breaches didn't happen?
Mr. Chair, as Mr. Allison has outlined, certainly the Public Health Ethics Consultative Group would have been presented with the fact in front of them, which is that we are using de-identified and aggregated data so that privacy is not an issue.
There is a need going forward, as we have in this case, to state our public health goals and why we need this information to help our public health response, so that's really important. In terms of transparency, we have this data posted and explained on the COVIDTrends website and—
Through you to Mr. Allison, prior to taking this position, have you ever been involved in a department within the government that has collected this amount of data on such a mass scale?
With that, we're really getting up against our stop time. We have time for maybe two minutes each.
We'll go to Mr. Brassard, followed by Ms. Hepfner.
Through you, Mr. Chair, to Dr. Tam, are you familiar with the FluWatchers program that exists within the Public Health Agency of Canada?
I'm not directly involved, but yes, of course I know it exists. It's a tool for monitoring influenza, and I think it's run by volunteers.
Right. On the website, it says:
FluWatchers are Canadian volunteers who normally track influenza, but with the global pandemic, they're also tracking COVID-19.
It goes on to say that individuals “can help public health officials identify where influenza and COVID-19 may be circulating” by answering just two quick questions each week, which, the site says, takes only about 15 seconds.
I guess really what I want to point at here is that we have this website that's endorsed by the Public Health Agency of Canada. It's an opt-in program. People opt in with their consent.
Why would we not be promoting this website as a means to determine a public health response, the effectiveness, and where these patterns are developing, as opposed to running a risk, as is clearly identified and, I think, will be identified by security and privacy experts when they come here, including the Privacy Commissioner? Why would we not endorse this website and promote it instead of collecting the data, the mobility data, without consent?
Mr. Chair, these are two entirely different kinds of data. One is volunteers saying, “Oh, I have flu-like symptoms.” Mobility data gives you the ability to look at spread and the dispersion of a virus and some other infectious disease.
They are complementary, but they are not the same kinds of information.
Dr. Tam, if I go further into this website, there are maps that indicate where the spread of influenza and COVID-19 are.
Mr. Chair, yes, you can say, “I have flu and I'm at this spot,” but you can't tell the trajectory and the movement that led to the potential spread of that virus. They are complementary information and support each other if you were laying on the epidemiologic data.
I'm hoping Mr. Allison can help me with this question.
Although I know we don't have any cellphone experts on this panel, I know, from covering a lot of criminal trials, that cellphone data is often used these days to help solve crimes, because it's data that is happening.
When we hear from a member how many phones have to be pinged, it's a bit misleading. It's not like the government's going out trying to ping phones. Every time you pick up your phone, [Technical difficulty—Editor] around you. The companies that run the cellphone towers have that data. The police can ask, through the courts, to get access to that data to find out where a suspect was at any one time, but it's not like we're going out looking to collect data. This is data that's being collected all the time.
That's an accurate representation. Cellphone and telco companies collect this data as part of the business and part of the services they provide to users. That is not any part of the data or information that is coming to PHAC.
I take Mr. Green's point that maybe we need to look at whether consumers really know that they're consenting to this information's being shared. Maybe we do need to look at the privacy laws, but it's not like we're going out looking for data that's not already available. This is data that's available. People opt in to or can opt out of having their data shared.
Mr. Chair, that is correct. As several members of this committee have pointed to, this is a new space for many folks. There are rapid changes happening. Apple made changes in April 2021 to be a more privacy-respecting platform. My expectation is that these changes will continue.
I look forward to seeing the results of this committee's report.
Publication Explorer
Publication Explorer