The federal government has been quietly tracking location data of 33 million Canadian devices, a practice that started during the COVID-19 pandemic and hopes to continue through May 31, 2023.
The Canadian Press reports recommendations from a House of Commons committee say Canadians need to be informed by Ottawa if they are tracking Canadian location data from cellphones, plus allow them to opt-out of the practice.
The ethics committee started its investigation into the cellphone data tracking matter in January, after pushback from the public.
The Public Health Agency of Canada (PHAC) tracking 33 million mobile devices to determine “population mobility patterns” during COVID-19 lockdowns. The agency wants to keep tracking location data until May 31, 2021.
According to the committee’s recommendations, the federal government needs to inform people about these tracking programs “in a manner that clearly outlines the nature and purpose of the data collection.”
The government also needs to look into changing privacy laws to allow more privacy protections, plus allow Canadians to opt-out of any tracking.
Consumer non-profit and advocate OpenMedia said the federal government only notified Canadians mobile tracking was happening by posting a notice on its website in March 2020. A website for the tracking program COVIDTrends didn’t launch until 7 months later, while information on the use of the tracked data didn’t appear on the site until December 2020.
Also, the government’s COVIDTrends website did not disclose Telus and BlueDot were the sources of tracking mobile data. “If you look it up on Google, you can see how the data was used,” said Health Minister Jean-Yves Duclos during his ethics committee testimony.
BlueDot created reports for the federal government with anonymized data and provided it to the PHAC, to better understand Canadian travel patterns during COVID-19, recording trips such as going to the liquor store or pharmacy.
Telus Chief Data and Trust Officer, Pamela Snively, told the committee during her testimony, “we did not obtain user consent for this specific purpose,” referring to seeking user permission to share their de-identified location data.
In Bell’s brief, the company said it did not provide mobile location data to the federal government.
“As you are aware, Bell did not provide mobile movement data to the Public Health Agency of Canada during the pandemic and we are not familiar with the details of that initiative. However, there should be no doubt that the appropriate use of de-identified data can serve the public interest in protecting public health and allow policymakers to obtain critical insights to support more informed public policy, while fully protecting the privacy interests of Canadians,” said the telecom.
“PHAC’s use of our mobility data is pointing to a disturbing reality; the federal government has effectively rendered our limited privacy rights negligible by discounting the foundational principle of consent, without introducing an adequate replacement set of principles,” said OpenMedia.
Previously, PHAC said any location data collected from cellphone towers would have personal identifiers removed, while adding it has also received advice from the privacy commissioner along with other privacy and ethics professionals.
