Thread by @caparsons

🚨🚨NEW REPORT from @citizenlab: Pandemic Privacy: A preliminary analysis of collection technologies, data collection laws, and legislative reform during COVID-19 citizenlab.ca/2021/09/pandem… 🚨🚨

This report by @wbaballard, @AmandaCutinha, & myself:

1) performs a comparative analysis of pandemic data collection technologies
2) finds privacy laws didn’t inhibit Canada’s COVID-19 response, and
3) identifies how proposed privacy law reforms would harm Canadians’ privacy

Core findings:

1) how data was collected to combat the COVID-19 pandemic was unprecedented in terms of the sheer volume of data collected, and retasking of commercial services and systems to facilitate health surveillance

2) Google and Apple dictated how exposure notification apps could work, often in opposition to what public health officials thought was needed. Still, these apps are unprecedented insofar as they facilitate mass, consent-driven, and decentralized exposure notification

3) The health, emergency, and privacy laws in Canada meant that Canadian governments could collect, use, and disclose personal information with few exceptions. In short: privacy laws weren’t why Canadian governments often responded poorly to the pandemic

Canada’s inability to handle information effectively does have precedent: the 2003 SARS outbreak. Despite legislation having been passed to prevent the same failures, they re-occurred throughout the current pandemic.

4) There is a worrying divide between what information the law authorizes government to collect, use, or disclose without obtaining consent and what some Canadians think are infringements of their privacy rights

The trend that sees lawfulness and perceived legislative legitimacy separate is something that needs attention. It doesn’t just apply to privacy laws, of course, and more broadly speaks to a need to restore and repair elements of Canada’s democracy.

5) During the pandemic, the federal government introduced new commercial privacy legislation. While the trend for governments to introduce privacy-infringing privacy legislation isn’t new (😮‍💨) it is deeply worrying

Moreover, the Canadian legislation would have lacked a human rights grounding and, by reaffirming old exceptions to consent while introducing new ones, could have significantly and negatively impacted Canadians’ right to privacy

There’s a lot more in the report. In addition to my amazing co-authors, I want to thank @irenepoet and @tamir_i for their peer review, @rizhouto and @MilesJKenyon for their comms assistance, and the rest of @citizenlab for their support.

You can check out the report’s executive summary at: citizenlab.ca/2021/09/pandem…

The full report, “Pandemic Privacy: A preliminary analysis of collection technologies, data collection laws, and legislative reform during COVID-19” is at: citizenlab.ca/wp-content/upl…

(We’ve also put together a short FAQ about the report, which you can find at: citizenlab.ca/2021/09/pandem…)