Ontario COVID-19 Status Disclosures Raise Privacy Concerns

Advocacy groups across the country sounded the alarm on Doug Ford’s decision to release COVID-19 database information to Ontario police. The Canadian Civil Liberties Association (CCLA), along with the Black Legal Action Centre (BLAC), First Nations Legal Services, and the Ontario Legal Network of People Living with HIV/AIDS will challenge this potential privacy issue in the Ontario Superior Court of Justice in November.

COVID-19 Status Disclosures and the Right to Privacy

The Ontario government passed an Order-in-Council under the Emergency Management and Civil Protection Act in early April, giving it the authority to obtain and provide police with the names, addresses and dates of birth of Ontarians who tested positive for COVID-19.

The Canadian Civil Liberties Association argues, among other things, that this decision violates the constitutional rights of Ontario residents to privacy and equality. Indeed, not only do COVID-19 status disclosures raise human rights concerns, but they open a Pandora’s box of privacy issues.

According to the CCLA, police forces asked the province at the beginning of the pandemic to obtain access to this type of data in order to protect their officers from COVID-19 when they come into contact with the public. Although this reasoning, based on the frequently used “public safety” or “state of emergency” rationale, may justify the potential privacy and equality rights violations, but the CCLA argues that sharing COVID-19 data is unnecessary.

Often, COVID-19 data is incomplete, because many infected people do not get tested and those who test positive have usually recovered since their diagnosis. Therefore, they argue, obtaining private and personal data will not help protect police or the public.

Another important concern raised by the CCLA and other advocacy groups is that COVID-19 status data is very sensitive and could be used by law enforcement against groups facing discrimination, such as First Nations, Black communities, or drug addicts.

BLAC’s lawyer, Nana Yanful, reportedly added that Premier Doug Ford’s Order-in-Council goes beyond the constitutional powers of the state. She noted that the socio-economic figures on COVID-19 already draw a parallel between the infection rate and the poverty rate in some marginalized groups, such as Black communities, therefore raising the possibility that such information will be used in a discriminatory manner.

An Ontario court will have to determine whether the disclosure of COVID-19 database information to law enforcement violates Ontario privacy law, equality rights and constitutional powers. However, this potential privacy issue raises another very unique question: How do public sector privacy laws apply during a pandemic? Does a global health crisis automatically confer more powers to the State to collect and share citizen health information? In this COVID-19 privacy exclusive, we aim to answer those pressing questions by outlining federal and Ontario privacy laws and applying them to the COVID-19 pandemic.

The Privacy Act: Personal Information is Private

Every province and territory has its own laws that apply to provincial government agencies and their handling of personal information. The federal government is regulated by the Privacy Act. Like PIPEDA, the Privacy Act sets rules for the collection, use and disclosure of personal information. However, unlike PIPEDA, the Privacy Act applies to the federal government, as opposed to the private sector.

The Privacy Act defines personal information as any recorded information about an identifiable individual including, among others:

• Race, national or ethnic origin, colour, religion, age or marital status;
• Education, medical, criminal, employment history of an individual, or information about financial transactions;
• Assigned identifying number or symbol;
• Address, fingerprints or blood type;
• Personal opinions or views except where they are about another individual or about a proposal for a grant, an award or a prize to be made to another individual by a government institution; and
• The name of the individual where it appears with other related personal information and where the disclosure of the name itself would reveal information about the individual.

Ontario’s Freedom of Information and Protection of Privacy Act, provides a similar list of what constitutes “personal information.” Importantly, the information the Ontario government agreed to share with police is personal information as per provincial and federal law because it contains health information and the names and addresses of individuals.

Collecting and Disclosing Personal Information

According to the Privacy Act the federal government can only collect personal information if it directly relates to the operation of one of its programs or activities. A government institution cannot collect personal information without first obtaining consent from residents, unless it is one of the situations specifically mentioned in the Privacy Act that allows for a government institution to disclose personal information to another institution. Section 8(2) of the Privacy Act lists about 10 situations in which the government can collect personal information without consent, among them are:

• For any purpose in accordance with any Act of Parliament or a regulation that authorizes disclosure;
• Where disclosure would clearly benefit the individual;
• Where the public interest in disclosure outweighs any invasion of privacy;
• To comply with a subpoena or warrant issued or order made by a court; and
• For law enforcement or investigative purposes.

Ontario’s public sector privacy law also lists similar reasons authorizing the collection and disclosure of personal information without first obtaining consent. Among the most important reasons provided by the law, in regards to Ontario’s COVID-19 database disclosures, are the exceptions for law enforcement, permission by another law that authorizes disclosure and the COVID-19 pandemic.

Although the exact details and the legality of the government’s plan to disclose personal health information to Ontario police will need to be determined in court, the provincial government may be justified in sharing COVID-19 information for the reasons listed above. The groups challenging Doug Ford’s database project argue that personal health information will be useless to police and may cause more harm than good. However, they face a major impediment to their bold privacy and human rights challenge: COVID-19.

COVID-19 and Privacy

According to the Privacy Commissioner of Canada, the COVID-19 pandemic “is raising questions about privacy issues during a pandemic. During a public health crisis, privacy laws still apply, but they are not a barrier to appropriate information sharing.”

The global pandemic has seemingly transformed the legal stage into a rabbit hole of abstract legal concepts, force majeure events, complex standards of care and privacy loopholes. Although governments would normally not be legally permitted to collect and disclose personal health information, such as COVID-19 status, the current health crisis brings a whole set of exceptions and rules centered on “public safety” and the “state of emergency,” sanctioning the disclosure of personal information without consent.

Perhaps most crucial to the determination of whether personal information can be shared without consent is whether a state of emergency has been declared. In the case of a public emergency, such as COVID-19, both federal and provincial government powers to collect, use and disclose personal information are extensive. Often, a public state of emergency constitutes an exception to general privacy rules.

According to the Privacy Commissioner of Canada, personal information may be disclosed by a government institution without consent for a wide array of COVID-19-specific reasons.

For example, personal information may be disclosed by the government to employers if employers wish to use their employee’s phone number to provide updates about the pandemic. Another exception is where a public health authority has the legislative authority to require disclosure. Sharing personal information under both of these circumstances can be necessary for public safety and for the proper functioning of health organizations. Moreover, it presents virtually no risks for misuses of private information or discrimination.

However, this next exception, more reminiscent of the COVID-19 database disclosure project, can be more difficult for Canadians to easily accept and may present greater risks. According to the Privacy Commissioner, where the public interest of disclosing personal information “clearly outweighs any invasion of privacy that could result from the disclosure,” or “where the disclosure would clearly benefit the individual to whom the information relates,” the government can disclose the personal information without first obtaining consent.

An example of this would be if the Minister of a public health organization deemed that a disclosure to another institution where a COVID-19 infected individual recently visited and may have spread the virus satisfied the balancing test. Although the Privacy Act specifies that the federal institution needs to notify the Privacy Commissioner in advance of a public interest disclosure, “it also recognizes that in certain matters, time is of the essence.” Another example is where the government deems that it is in the best interest of the public to disclose COVID-19 status information with the RCMP.

Ontario’s Personal Health Information Protection Act allows for the disclosure of COVID-19-related information to individuals other than public health authorities, such as law enforcement, in certain circumstances. For instance, personal health information can be disclosed if there are reasonable grounds to believe the disclosure is necessary to eliminate or reduce a significant risk of COVID-19 infection.

In the case of disclosing COVID-19 database information with law enforcement, this highly sensitive and private information may be shared in compliance with provincial privacy law to ensure the security of the public and police officers. However, the disclosure should be limited to what is necessary and, where possible, the government should avoid revealing the identity of the individual infected with COVID-19.

What do you think about COVID-19 status information being shared with law enforcement? Share your thoughts with us in the comments below!

Read More Class Action Lawsuit & Settlement News:

LifeLabs Facing Multiple Class Action Lawsuits After Privacy Breach

Long-Term Disability Lawyer | Insurance Claim Denial Help

COVID-19 Concerns Linger as Ontario Courts Reopen

Canada Roundup Glyphosate Cancer Class Action Lawsuit Investigation