The House of Commons ethics committee wants the federal government to inform Canadians if they’re being spied on and to give them the option to opt out of data-collection surveillance programs.
The recommendations come as parliamentarians probe the Public Health Agency of Canada (PHAC) secretly spying on the locations of millions of Canadians.
Last year it was revealed that the federal department obtained data from 33 million devices to conduct “population mobility patterns” research during lockdowns.
The project was only unveiled after PHAC put out a tender notice seeking contractors to continue the surveillance program until May 31, 2023.
Committee members have called for the government to notify people included in future sweeps “in a manner that clearly outlines the nature and purpose of the data collection.”
Additionally, parliamentarians said they would like to see upgraded privacy laws to protect de-identified and aggregate information.
In February, the House of Commons narrowly voted to temporarily halt the PHAC surveillance despite opposition from Liberal MPs.
“We are simply not at the point of understanding how this data was collected, whether it was properly de-identified, what the risks of re-identification are and why the Privacy Commissioner was not involved in the process,” said Conservative MP John Brassard.
The program is also currently being audited by the federal privacy commissioner.
Although PHAC officials maintain that personally identifiable information was stripped from the data, privacy experts have disputed the claim and have called the program a violation of Canadians’ rights.
Ontario’s former privacy commissioner and Executive Director of Global Privacy and Security by Design Ann Cavoukian told True North in December that Canadians should have “zero trust” in the federal government’s assurances regarding their conduct.
“They are collecting all of this mobile data,” she said. “33 million mobile devices and mobile devices are usually linked to personal identifiers, and you have to take some measures to remove them and de-identify the data in a strong way so it can’t be reidentified. We have no assurances to that effect whatsoever.”
