OIPC: Trust through transparency

Press Release

Information and Privacy Commissioner for British Columbia

Good afternoon, and thank you, Mike, for the introduction and your kind invitation to speak at this event.

Before I begin, I would like to respectfully acknowledge that I present to you today on the traditional territories of the Ləkʷ̓əŋin̓əŋ people, also known as the Songhees and Esquimalt First Nations.

I also want to acknowledge FIPA’s service to the people of BC. The work that you, Jason, and the entire team does, adds immeasurably to public discourse in this province on matters vital to our democracy.

I want to spend the limited time I have this lunch hour with you focusing on the theme chosen for this conference: trust through transparency.

I think those words are more relevant than ever given that we find ourselves in the middle of a global pandemic affecting almost every facet of our lives… the adoption of digital technologies, including remote work, distance learning, and virtual health care, has accelerated rapidly.

Even this conference of course is being held in a new, digital-only manner.

It’s sometimes hard to remember what the world was like pre-COVID… so much has transpired in the last six months.

What hasn’t changed, however, is the need for robust access and privacy rights. In fact, their importance has been magnified by our current health crisis.

Before jumping into more detail on that topic: a brief refresher on the legislation my office oversees.

The Freedom of Information and Protection of Privacy Act (FIPPA) was brought into force in 1993. On the privacy side of things, FIPPA sets out requirements for public bodies in dealing with your personal information.

The law’s essence is that public bodies can’t arbitrarily collect whatever they want about you. They can collect your personal information if authorized by some law or regulation, or if it is otherwise necessary for carrying out their activities or programs. So, for example, turning over certain personal information would be necessary to get your driver`s license.

Sometimes there is a challenge to the authority of government to collect information, as was the case last year with the BC speculation tax, when it wanted to collect your social insurance number.

Ultimately my office ruled that your SIN is in fact necessary to reliably establish an accurate link between a land title holding and a tax return in order to carry out government’s tax objectives.

FIPPA, of course, also establishes an individual’s right to access records, including your own personal information, from a public body with certain exceptions; most people will know my strong view that the breadth of those exceptions has unduly widened in the last 25 years.

So that’s the essence of the law as concerns public sector.

Personal information in the private and non-profit sector is dealt with under the Personal Information Protection Act (or PIPA). You have the right to access your own personal information under PIPA but as importantly the legislation puts limits on how organizations collect and use it.

Both FIPPA and PIPA, especially on the privacy side of things, play a critical and direct role in the everyday transactions we undertake as citizens, clients, or customers.

And what both pieces of legislation really attempt to underpin with regard to those transactions is trust.

Trust through transparency is the key to giving all of us the confidence to engage in a multitude of platforms. And one thing is clear in the face of COVID: there has been a massive explosion of digital platforms.

Contact tracing apps are perhaps most symbolic of the intersection between COVID 19 and technology. There has been a push for a Canada-wide contact tracing app, downloadable to your phone, that could potentially help to trace those people who might have been exposed to the virus. The Prime Minister recently restated his call for Canadians to download it as a means of fighting the pandemic.

The download and use of the app is of course voluntary here in Canada and many places around the world. A great many global public health officials believe the only way such an app can succeed in fighting the virus is if it is downloaded by many people.

For that to happen, British Columbians and Canadians, and here are those words again, will have to, collectively, trust the app.

In places like Singapore and – closer to home – Alberta, New Brunswick, Newfoundland and Labrador, Saskatchewan, and Ontario, the app has been made voluntarily available for download. However, people have shown nowhere near the kind of embrace required to make it practically useful to assist in flattening the virus’s curve.

Since the outbreak of COVID-19, my office has been in contact with Provincial Health Officer Dr. Bonnie Henry and her team to discuss a contact tracing app as well as a range of issues related to information sharing and its potential privacy implications. These communications will continue as Dr. Henry and her colleagues lead the province’s public health response.

From the outset of the pandemic, I have been clear that FIPPA and PIPA are designed to facilitate the sharing of personal information necessary to ensure the public’s health and safety – to ensure that access to necessary information is available to those who need it – but not beyond what is necessary.

Since the outbreak of the pandemic my office has exercised our oversight and guidance role on a number of fronts with the provincial government as they have moved to implement measures to deal with the pandemic. For example, government consulted my office about Ministerial Order 085, an order temporarily lifting BC’s data residency requirements.

Among other things, the order broadens the use of communication tools used by public bodies adapting to COVID-19. It allows health care bodies and workers to use technologies that may be hosted outside Canada to communicate and collaborate for the purpose of continuing service delivery during the public health emergency.

The temporary provisions of the Ministerial Order are, in my view, tailored and reasonable, given the challenging circumstances we find ourselves in. The technology tools allowed by the order, often referred to as third party applications, can only be relied on if they support recommendations or requirements related to minimizing the transmission of COVID-19.

It is important to remember that Ministerial Order 085 and succeeding orders do not give public bodies a free pass to ignore legal imperatives like proper security measures. It is also important to note that the order has a defined end date: it terminates on December 31, 2020.

One area that Ministerial Order 085 directly impacts is education and, in particular, K-12 education. The order does permit the use of a wider range of technology tools for distance learning in cases where students are not able to connect physically in a classroom.

This poses considerable challenges and is an issue that has been on our office’s radar for some time, even before the pandemic. My office has been working with school districts and the BC Teachers’ Federation to ensure e-learning can happen in a privacy protective way. And I should note that this is an issue that is not unique to BC; it has come up in many discussions with our provincial counterparts as well as international colleagues as part of our work with the Asia Pacific Privacy Authorities.

I also want to acknowledge the work done in this space by Mike and Jason and BC FIPA on this front and the contribution it has made to this discussion. I understand that the recent release of the FIPA report on gaps affecting privacy protection in BC’s K-12 education system will be the subject of discussions tomorrow; we will be listening intently to that conversation.

COVID has also absolutely increased the velocity of developing societal trends on many fronts, including distance learning, as I just referenced, to the vast number of people now working remotely. My office has responded quickly to these shifts, answering many queries directly from the public and organizations and issuing guidance to assist individuals, public bodies, and businesses.

All of this ongoing oversight and our public education work I believe plays an important role in building public trust in the efforts to combat the virus.

In normal times, but perhaps more so in a public health crisis, government accountability is not only about the protection of personal information; it is also about the public’s right to access information. Access to information is a critical part of our democracy and necessary to holding governments to account – even more so when the same governments are exercising extraordinary powers.

That said, the operations of many public bodies, especially smaller ones, were significantly affected at the outset of the virus’ spread. For that reason, I proactively made a decision on March 18 that recognized both the challenges public bodies face in reorganizing themselves in the face of COVID-19 and the continuing need for accountability and transparency.

View Full PDF

IHT5

NationTalk Partners & Sponsors Learn More