Question Period Note: Use and Privacy Protection of Public Health Mobility Data

Public concerns surrounding the Public Health Agency of Canada’s (PHAC) use of mobility data have emerged in response to a public posting of a mobility data Request for Proposal (RFP) on December 17, 2021, to access cell-tower/operator location data to assist in the response to the COVID-19 pandemic and for other public health applications. This RFP has raised public concerns regarding individuals’ right to privacy, and concern over the government gathering information on individuals.

● Reliable, timely and relevant health and public health data are crucial to inform policy and decision-making during this pandemic, and more broadly during public health emergencies and to improve long-term public health outcomes for Canadians.
● The Public Health Agency of Canada takes the privacy of individuals seriously and has ensured that no personal information was asked for, or received, and no individual or identifiable data is contained in mobility data received by the agency.
● The Agency is aware that the Office of the Privacy Commissioner is investigating complaints on the Agency’s use of mobility data. The Public Health Agency of Canada has proactively provided information to the Office of the Privacy Commissioner over the past year and a half on its use of mobility data and will continue to cooperate fully with the investigation.
● The Agency is currently reviewing the recommendations issued by ETHI on May 2nd 2022.

If asked about the ETHI report
● The ETHI report was in response to a motion to study the collection and use of mobility data by the Government of Canada.
● There was consensus that PHAC did not violate any laws.
● Witnesses agreed that there was no suspicion of tracking individual Canadians nor any indication that the mobility data was de-anonymized or disaggregated.
● Some witnesses advocated for legislative reform, which carried into the final recommendations.
● PHAC sees value in the recommendations made, but notes some recommendations go beyond the scope of the study as proposed by the motion. Privacy Act reform (as well as PIPEDA reform) is the purview of the Department of Justice. PHAC has been actively engaged with the Department of Justice over the past three years.
● The report contains the dissenting opinion of the Liberal Party of Canada, which articulates support for the efforts of the Committee but notes the original motion was based on misleading reports around PHAC mobility data collection and use, and that the ETHI recommendations extended beyond the scope set by the original motion.

If pressed on user privacy
● The Public Health Agency of Canada engaged internal privacy and ethics experts to ensure the Government of Canada’s use of mobility data follows best practices. The Agency also met with the Office of the Privacy Commissioner on this initiative in April 2020 and in January 2022.
● The Request for Proposal requires that the contractor protect user privacy by only providing secure, de-identified and aggregated data. This means all personal identifiers are removed before the Agency receives it and the data represent a population of people and cannot identify or track individuals using this data. The proposal also requires that individuals have the ability to easily opt out of their mobility data sharing programs.
● The Agency only considers vendors who meet the Government of Canada’s strict security, legal, privacy and transparency requirements.

If pressed on secrecy or transparency
● Previously, this work has been made publically available on the COVIDTrends website as a means to provide Canadians with local information on COVID in their communities with explanations of how this data is used, and privacy protections in place.
● Since both mobility contracts have now expired, the mobility indicator has been removed from the COVIDTrends website as of March 31, 2022.
● Mobility insights were also shared with provinces and territories as part of joint efforts on COVID-19.

If pressed on the government’s response to the order of the House of Commons to immediately suspend this data-gathering program
• De-identified and aggregated mobility data is an important tool to understand the impact of public health measures on the pandemic. This data is used by other governments, both nationally and internationally, to help make better public health decisions.
• We understand the concerns of Canadians. We understand that trust in government is key and that preserving the privacy of people in Canada must be core to our service while we work to improve and protect the health of the people in Canada.
• The Government has been criticized for not having the data needed to understand and inform the pandemic response. Direction from the Auditor General and Canadians has been clear: Canada needs a better health data system that can meet the needs of our country during the pandemic and beyond.
• The RFP closed on February 18, 2022, no contract has been awarded. We are keenly interested in the concerns and considerations of the Committee and this will allow the Public Health Agency of Canada to take into account the findings of their report as we determine whether it is in the public interest to award a contract as part of our work to ensure that Canada has the data it needs to protect our people.
• We cannot speak to the details of the procurement process and any questions on procurement should be directed to Public Services and Procurement Canada.

Mobility data is a useful tool to inform public health analysis. To date, the Public Health Agency of Canada (PHAC) has used two types of mobility data: crowdsourced mobility data and operator based mobility data (which is complementary to and used to verify crowdsourced data).

Early in the COVID-19 response, operator-based mobility data was provided to PHAC through Innovation, Science, and Economic Development’s Communication Research Centre (CRC) in partnership with Telus Mobility.

PHAC established a sole-source contract, which expired on October 8, 2021, with Telus Mobility for this data in March 2021. PHAC also entered into a contract with Bluedot Inc. for de-identified and aggregated crowdsourced data. This contract expired on March 18 2022.

The data received from Telus was secure, de-identified, aggregated (i.e., not at the level of an individual), and vetted for security, legal, privacy and transparency considerations by both Telus and PHAC.

This data helps to contribute to generate public health insights including the ability to estimate the impacts of public health interventions and risk factors. This includes using mobility data analysis to contextualize the public health situation over time, examining possible links between population movement within Canada and propagation of COVID-19, measuring the effectiveness of public health measures, and empowering Canadians with information to improve and protect their health.

Since September 2020, COVIDTrends, PHAC’s COVID-19 public-facing dashboard, has provided Canadians with a population movement indicator to raise awareness of mobility patterns in relation to possible easement or tightening of public health measures within their health region. Mobility data is used to support that indicator. Since the contracts with Telus and Bluedot have now expired, the mobility indicator has been removed from the COVIDTrends website as of March 31, 2022.

PHAC has been producing report summaries to look at how movement trends of the Canadian population have changed over the course of the pandemic, including identifying new patterns to help direct public health messaging, planning and policy development. These summaries have been regularly shared with provinces and territories throughout the pandemic via the Special Advisory Committee.

In early fall 2021, PHAC launched an internal survey to mobility data users. Survey results indicated users find this data valuable and informative for COVID-19 situational awareness. Users also perceived the scalable potential of this data to inform other public health challenges.

PHAC launched a Request for Proposal (RFP) for its next partnership for operator-based mobility data in order to increase transparency and align with the Government of Canada’s “Open Data” initiatives.

An RFP was posted on the Buyandsell.gc.ca site in December 2021. In order to ensure identity protection, this RFP requires that a vendor supply data that has been de-identified and aggregated (i.e., not individualized) in a secure format that is vetted for security, legal, privacy and ethical considerations.

Ethics and consultations

In response to an internal request for a privacy analysis for the planned uses of mobility data, PHAC’ Privacy Management Division (PMD) concluded in August 2020 that while the data is considered sensitive, it does not contain personal information and therefore is not subject to the Privacy Act.

In January 2021, internal consultation with the Public Health Ethics Consultative Group (PHECG) for advice related to consent and ways to mitigate potential public concerns surrounding perception of state surveillance provided an ethical analysis that outlined the need for PHAC to be clear about public health goals, transparent, and to engage the public. PHAC accepted all recommendations. Due to the priority of the pandemic response, DMIA was not able to conduct a public consultation.

In addition, since April 2020, PHAC has also met regularly with the Office of the Privacy Commissioner (OPC). As part of the briefings, the Agency provided OPC a very detailed presentation including data types and pipelines, epidemiological uses, privacy and safeguards, as well as users opt-out options. In addition, over the past 15 months, PHAC has also met with the OPC every two weeks to provide them verbal updates on all our COVID files including mobility data. While the OPC was not asked formally for written comments on the mobility data initiative, at no time did they raise any concerns with PHAC on the numerous occasions when it was discussed with them and the information provided.

January 6, 2022 was the most recent meeting with OPC representatives to describe the mobility data project, associated RFP currently out for tender, the types of analyses performed to date, and future plans to support public health.

For operator data, a number of security measures—at a contractor-level, at PHAC, and through CRC—exist to preserve the privacy and integrity of mobility data:
● Contractors must have a secure platform with clear security protocols (e.g. two-factor user identification), data that is anonymized (e.g. scrambled SIM), and ensures that precise locations are not included (e.g. location of nearest tower only)
● Analyses performed within the platform use standard codes and protocols to ensure data is de-identified.
● Prior to data extraction, anonymized user IDs are removed, data are aggregated to at least 20 devices at no smaller than census subdivision level (i.e. municipality), and measurements must be transformed into percentages. This pre-processing of mobility data prevents tracking movement patterns of individual users, including at the cell tower level.
● Exported, aggregated data are stored securely in the AWS cloud, where automated reports are created by CRC and sent to PHAC.
● Reports generated display population-level trends within health regions (with no fewer than 20 devices) and all measurements are in proportions.

PHAC employees attended the February 2, 2022 meeting of the ETHI committee and responded to questions from the committee both directly and via remit.

On February 8, 2022, the House of Commons passed a motion calling on the government to suspend the PHAC’s cellular data tender until the ETHI Committee reports to the House that it is satisfied that the privacy of Canadians will not be affected.

As there is no option to suspend an RFP, PHAC allowed the RFP to close on February 18, 2022. Currently, no contract has been awarded through the RFP process.

Key Facts
• Anonymous and population-level mobility data analysis was explored to evaluate the effectiveness of public health directives during the pandemic. By analyzing population movement data, the intent was to better understand the public’s responsiveness during lockdown measures.
• Analyses and findings from the mobility data were also regularly shared with provinces and territories as a supplemental source of information to support policy decisions and evaluation in their pandemic response.
• The mobility contract with Telus expired on October 8, 2021, and the mobility contract with Bluedot expired on March 18, 2022. As such, PHAC is no longer receiving this data.
• The data received was focused at the regional public health level and does not include any individually identifiable or personal data.
• The Ethics Committee (ETHI) and the House of Commons voted to suspend the data gathering program until the committee could release its report in mid-April.
• ETHI submitted its report on May, 2 2022.
• There is no option to suspend an RFP. PHAC allowed the RFP to close on February 18, 2022. Currently, no contract has been awarded through the RFP process.