Changes to privacy legislation ‘reasonable’ amid pandemic: privacy commissioner

B.C. information and privacy commissioner Michael McEvoy says the NDP government’s move to allow the disclosure of personal information amid the COVID-19 crisis should not be cause for alarm. 
 
The order is “reasonable and reasonably tailored” to allow government bodies to do what they need to do in the midst of “extraordinary circumstances,” McEvoy told BC Today in an interview.
 
The amendments to B.C.’s Freedom of Information and Privacy Protection Act, signed off on by Citizens’ Services Minister Anne Kang in late March, allow government bodies to use third-party programs and apps that store information outside of Canada “to support and maintain” public health orders aimed at slowing the spread of the coronavirus.
 
Since then, the Ministry of Education announced a licensing agreement with Zoom and deployed it in B.C. school districts while in-person classes are closed. The video-conferencing company recently faced backlash for its security and privacy protocols. 
 
McEvoy says Zoom has “lots of switches and bells and whistles” to customize privacy settings and his office is working closely with the ministry to ensure teachers using the program are up to speed on best practices for cybersecurity.
 
McEvoy’s office is also in contact with the health ministry and the public health officer, who has “extraordinary powers” to compel the disclosure of personal information during a public health emergency. 
 
He said the health sector is used to balancing privacy concerns with a need to share relevant health information. 
 
Privacy expert suspects order was made ‘on the fly’
The emergency order suggests a lack of contingency planning on the part of government officials, according to data and privacy security expert John Wunderlich.

“Why was this thought of quickly and not pulled off the shelf?” the former privacy director at Cancer Care Ontario said of Kang’s order. “If you think about it ahead of time, this stuff can be done in a way that protects people’s privacy and means that you can escalate during the crisis and de-escalate in an orderly manner afterwards.”
 
B.C. has some of Canada’s most stringent privacy protection laws. It was one of the few provinces that required government bodies to keep citizens’ personal data inside the province. 
 
But Wunderlich saysthat only makes the emergency order seem more out of place, especially in a health-care context, where the risk of a pandemic — and a need to move personal information quickly and securely — should have been foreseeable.
 
“If there’s a predictable event — and a pandemic was predictable  — then there should have been contingency planning,” said Wunderlich. “A lot of this seems to be done on the fly.”

A lack of planning may lead the government to turn to services and apps without proper vetting. 
 
“It’s expensive and time-consuming to validate that the tool [like Zoom] is actually privacy protected, that it doesn’t leak,” said Wunderlich. “They’re going to have to take these things on face value.”
 
Baked into B.C.’s emergency preparedness plan was the possibility that many people — including public servants — might need to work from home for an extended period of time, according to Minister Kang. 
 
She said her ministerial order went “through the same policy process that any order would,” including a “sharp legal review and consultation,” but under a tighter timeline.
 
“This [order] is just to make sure that we have this tool there to support our public servants and health-care providers, but only during the time set out in the order and also as needed to maintain the operation,” she told BC Today, emphasizing that a minimal amount of information will be disclosed.
 
Kang maintains B.C. privacy laws are in step with other provinces
For Wunderlich, the “dangerous question” is whether the government rolls back the new rules once the pandemic is over. 
 
Kang’s order is set to expire on June 30 but can be extended. Her office said it will work with the privacy commissioner to assess whether the order should be rescinded or renewed “depending on the pandemic landscape” going forward.

She said the change to B.C.’s legislation allows public bodies to use tools already permitted in other provinces.

“It does not permit any broader disclosure of information than what is routinely available elsewhere in Canada,” she added.