A March 26 relaxation of B.C. privacy laws on sharing health data during the COVID-19 pandemic set to expire June 30 has been extended until year’s end.
Minister of Citizens Services Anna Kang initially ordered that people’s health information might be shared with others inside and outside of Canada. Kang extended that to December 31 in an order issued June 3.
For B.C.’s Information and Privacy Commissioner, however, the situation presents a problem in that his office does not have the legislated power to fine companies handling such data should it be misused.
Many other ministerial orders have a sunset date timed with the end of the state of emergency declared in March. That end date has been extended several times.
The earlier order allowed, under B.C.’s Freedom of Information and Protection of Privacy Act, that B.C.’s ministries of Health, Mental Health and Addictions or the Provincial Health Services Authority may disclose information:
• for the purposes of communicating with individuals respecting COVID-19;
• for the purposes of supporting a public health response to the COVID-19 pandemic, or;
• for the purposes of coordinating care during the COVID-19 pandemic.
The order further said public bodies may disclose such information inside or outside of Canada on condition that disclosure is for the following:
• to support and maintain the operation of programs or activities of public bodies;
• to support public health requirements related to minimizing COVID-19 transmission such as social distancing, working from home, etc.
Disclosure is limited to the minimum amount reasonably necessary for the performance of duties by an employee, officer or minister of the public body.
The ministry said B.C. strictest privacy and data-residency laws in Canada. It is one of two provinces with legislation requiring the personal information of its citizens to be stored in, and only accessed from, Canada.
Despite that, the new order reiterates the first order’s allowance for data to be disclosed outside of Canada
But, the ministry said, “these leading privacy protections also mean these common communication and collaboration software tools, which are routinely allowed in other provinces and are useful in the fight against COVID-19, are not normally permitted for use by B.C. public-sector staff.”
McEvoy said “it’s an unfortunate reality” that much of the technology handling British Columbians’ data is U.S.-based.
“I’ve told government that they need to help wean public bodies off that technology,” McEvoy said. He’d prefer to see Canadian companies using servers in Canada.
While some companies have begun to do just that, McEvoy said, he remains concerned British Columbia privacy law remains without penalties for misusing data.
“That‘s a huge gap in legislation in B.C.’ McEvoy said. “What the government has done is a short-gap measure. There needs to be legislative reform so that if something goes wrong, we have the ability to impose penalties on companies that misuse data.”
And, all such orders involving people’s personal and private date have been under close scrutiny of civil liberties groups such as the B.C. Civil Liberties Association (BCCLA) as the pandemic
BCCLA senior staff counsel Meghan McDermott said the first order only lasted for about three months while this one will be in affect for twice as long.
“It signals that the province expects pandemic responses to last at least until the end of the year, though of course this could be rescinded before the expiration date,” McDermott said. “We would be concerned if the provincial declarations of emergency end without revoking this order, as it only seems reasonable in the context of COVID-19.”
Further, McDermott said, the order specifies that public bodies are required to “make all reasonable efforts to remove personal information which is collected, used or disclosed using third-party application from the third party application as soon as is operationally reasonable and the public body retains and manages the information”
Said McDermott: “This is a good aspiration, but we wonder if this is in fact possible given the spectrum of third-party applications available, the complicated nature of end user agreements that tend to privilege software companies over their users, and the complex reality of how data moves through networks.”
She said civil liberties groups champion keeping personal information within Canadian jurisdictions because it’s very difficult to control what happens to data once it flows into another legal jurisdiction, regardless of what obligations are placed on the Canadian entities involved.”
“What if the public body in B.C. makes all reasonable efforts to have personal health information scrubbed from third party servers in another country, but ultimately fails?” McDermott asked. “In that case it seems like the data would remain at large in a foreign land, without the person whose information it is being notified or having any recourse or remedies available.”
In a poll released May 4, B.C.’s Freedom of Information and Privacy Association (FIPA) reported 75% of British Columbians are concerned about an organization transferring their personal information from B.C. to organizations outside of Canada.
“The longer this is in place the less likely it is to be removed. This order increases our concern,” FIPA executive director Jason Woywada said. “We are still encouraged there is an end date to this extension. It is unfortunate that this is no longer being viewed in the same emergency intervals as the emergency it is meant to address.
“To have this order not just extended by a few months but half a year leads to the concerning possibility the government is viewing this as a new normal rather than an exception to the rule."
He said such data sharing puts the privacy of BC residents at possible risk and decreases their agency and consent in making decisions about their own data and information.
Federal Privacy Commissioner Daniel Therrien said in a March 20 statement that, “during a public health crisis, privacy laws still apply, but they are not a barrier to appropriate information sharing.”
A guidance from Therrien’s office said under federal and provincial laws, governments are authorized to declare formal public emergencies.
“Where that is done, the powers to collect, use and disclose personal information may be further extended and can be very broad.”
Kang’s March order did allow the minister to rescind or extend it in full or in part before June 30.
