While our new reality has brought the implementation of government measures to encourage social distancing, such as the closure of restaurants and playgrounds, government actions impacting privacy rights have been more obscure. Governments have been bending the rules around how the collection, use, and sharing of personal information is protected and privacy maintained.
This blog will help you understand what the government of BC has done to temporarily adjust the privacy laws that apply to its ministries as well as other public entities like health authorities, and school districts. This is my interpretation of an order passed in March by BC’s Minister of Citizen Services, impacting the Freedom of Information and Protection of Privacy Act.
Data Residency
Before I jump into my review of the order, I wanted to set out what data residency is and why we embrace it. BC is one of the few jurisdictions in Canada that has embedded the principle of data residency into the privacy laws binding the government. This means that any personal information collected by public bodies always has to stay within Canada. Given the fact that so much government administration is now digital, public bodies in BC must ensure that computer systems used for the collection, storage or use of personal information must use servers located in Canada. Privacy advocates champion these rules because it helps to ensure that any stored personal information remains subject to Canadian laws, enabling individuals to hold the government accountable should there be a privacy breach.
Health Care Bodies Sharing Information Outside Canada Re: COVID-19
The first part of the order talks specifically about sharing information outside of Canada – including health information – on the condition that sharing the information is necessary for communicating with individuals regarding COVID-19, supporting a public health response to the pandemic or coordinating care during the pandemic.
Ordinarily, the law only allows this information to be shared within Canada. However, the order permits healthcare bodies—like hospitals—and health ministries and authorities to use this mechanism to share information beyond our national borders, but it expires on June 30, 2019.
Furthermore, personal information may only be shared for the purpose for which it was obtained/compiled or for a use consistent with that purpose, or to an officer/employee of the public body or to a minister, if the information is necessary for the performance of their duties. This limits the scope of what can be shared. We’re always happy to see limitations and conditions on the sharing of personal information.
Now, this latter part strikes me as a bit odd, it isn’t immediately obvious why these conditions would be met right now. Why would an officer or employee or a Minister of a BC public body need to get information while outside of Canada? However, considering how quickly the self-isolation rules came down and how they vary around the world, it may be that some key health officials who work for public health bodies in BC may be working outside of Canada right now.
The part that raises the most concern is that it allows the public health bodies to share personal information for “the purposes of communicating with individuals respecting COVID-19.” This seems a little broad as it may open the door to sharing with any individual, depending on interpretation. There is some comfort in recalling the added limitation– that the personal information can only be shared “for the purpose for which it was obtained or compiled.” This may mean that this mechanism was needed to simply tell people who were tested for COVID before leaving the country, whether or not their test is positive. On the other hand, it may allow for relatives/guardians of COVID-19 victims who aren’t in Canada to have test results or treatment plans shared with them. Although it may seem alarming at first, there could be very valid reasons for creating this new avenue of personal information sharing in the face of a pandemic when people and communities are as mobile as we are.
Another obvious reason for this portion of the order is to allow some planning with neighbouring jurisdictions (states) about coordinating care and supporting public health responses. Arguably, “bulk data”, like the number of infected persons and their postal codes, is never completely anonymized. As a result, the government may be taking an abundance of caution to ensure that they can share broader information, like where the infection hotspots are, and which hospitals are at capacity, with counterparts in the USA without running afoul of privacy law.
Disclosure of Personal Information Outside of Canada Through Third-Party Tools
It is clear to me that the second portion of the order is only linked to the COVID-19 pandemic in that thousands of civil servants are now working from home (or wherever they happened to be when they were ordered to shelter in place).
This part of the order is clearing the way for those civil servants who are now outside of Canada to be able to keep doing their jobs remotely. The nature of the personal information would change depending on the work being done, so it could be very sensitive personal health information or other very sensitive personal information about children in care, student performance or vaccination records, employee hiring and firing, social assistance applications, etc. We are happy to see some conditions limiting disclosure by requiring that “any disclosure of personal information is limited to the minimum amount reasonably necessary for the performance of duties by an employee…”
The BCCLA will continue to monitor the implementation of this order—and future ones—to ensure that privacy rights are respected and are properly balanced with other competing interests.
Read more about the BCCLA’s COVID-19 response here.
Pandemic Triggers British Columbia to Alter the Legal Landscape for Personal Information Sharing beyond Canada’s Borders
While our new reality has brought the implementation of government measures to encourage social distancing, such as the closure of restaurants and playgrounds, government actions impacting privacy rights have been more obscure. Governments have been bending the rules around how the collection, use, and sharing of personal information is protected and privacy maintained.
This blog will help you understand what the government of BC has done to temporarily adjust the privacy laws that apply to its ministries as well as other public entities like health authorities, and school districts. This is my interpretation of an order passed in March by BC’s Minister of Citizen Services, impacting the Freedom of Information and Protection of Privacy Act.
Data Residency
Before I jump into my review of the order, I wanted to set out what data residency is and why we embrace it. BC is one of the few jurisdictions in Canada that has embedded the principle of data residency into the privacy laws binding the government. This means that any personal information collected by public bodies always has to stay within Canada. Given the fact that so much government administration is now digital, public bodies in BC must ensure that computer systems used for the collection, storage or use of personal information must use servers located in Canada. Privacy advocates champion these rules because it helps to ensure that any stored personal information remains subject to Canadian laws, enabling individuals to hold the government accountable should there be a privacy breach.
Health Care Bodies Sharing Information Outside Canada Re: COVID-19
The first part of the order talks specifically about sharing information outside of Canada – including health information – on the condition that sharing the information is necessary for communicating with individuals regarding COVID-19, supporting a public health response to the pandemic or coordinating care during the pandemic.
Ordinarily, the law only allows this information to be shared within Canada. However, the order permits healthcare bodies—like hospitals—and health ministries and authorities to use this mechanism to share information beyond our national borders, but it expires on June 30, 2019.
Furthermore, personal information may only be shared for the purpose for which it was obtained/compiled or for a use consistent with that purpose, or to an officer/employee of the public body or to a minister, if the information is necessary for the performance of their duties. This limits the scope of what can be shared. We’re always happy to see limitations and conditions on the sharing of personal information.
Now, this latter part strikes me as a bit odd, it isn’t immediately obvious why these conditions would be met right now. Why would an officer or employee or a Minister of a BC public body need to get information while outside of Canada? However, considering how quickly the self-isolation rules came down and how they vary around the world, it may be that some key health officials who work for public health bodies in BC may be working outside of Canada right now.
The part that raises the most concern is that it allows the public health bodies to share personal information for “the purposes of communicating with individuals respecting COVID-19.” This seems a little broad as it may open the door to sharing with any individual, depending on interpretation. There is some comfort in recalling the added limitation– that the personal information can only be shared “for the purpose for which it was obtained or compiled.” This may mean that this mechanism was needed to simply tell people who were tested for COVID before leaving the country, whether or not their test is positive. On the other hand, it may allow for relatives/guardians of COVID-19 victims who aren’t in Canada to have test results or treatment plans shared with them. Although it may seem alarming at first, there could be very valid reasons for creating this new avenue of personal information sharing in the face of a pandemic when people and communities are as mobile as we are.
Another obvious reason for this portion of the order is to allow some planning with neighbouring jurisdictions (states) about coordinating care and supporting public health responses. Arguably, “bulk data”, like the number of infected persons and their postal codes, is never completely anonymized. As a result, the government may be taking an abundance of caution to ensure that they can share broader information, like where the infection hotspots are, and which hospitals are at capacity, with counterparts in the USA without running afoul of privacy law.
Disclosure of Personal Information Outside of Canada Through Third-Party Tools
It is clear to me that the second portion of the order is only linked to the COVID-19 pandemic in that thousands of civil servants are now working from home (or wherever they happened to be when they were ordered to shelter in place).
This part of the order is clearing the way for those civil servants who are now outside of Canada to be able to keep doing their jobs remotely. The nature of the personal information would change depending on the work being done, so it could be very sensitive personal health information or other very sensitive personal information about children in care, student performance or vaccination records, employee hiring and firing, social assistance applications, etc. We are happy to see some conditions limiting disclosure by requiring that “any disclosure of personal information is limited to the minimum amount reasonably necessary for the performance of duties by an employee…”
The BCCLA will continue to monitor the implementation of this order—and future ones—to ensure that privacy rights are respected and are properly balanced with other competing interests.
Read more about the BCCLA’s COVID-19 response here.
CIVIL LIBERTIES CAN’T PROTECT THEMSELVES