Question Period Note: Use and Privacy Protection of Public Health Mobility Data

N/A

• Public concerns surrounding the Public Health Agency of Canada’s (PHAC) use of mobility data have emerged in response to a public posting of a mobility data Request for Proposal (RFP) on December 17, 2021, to access cell-tower/operator location data to assist in the response to the COVID-19 pandemic and for other public health applications. This RFP has raised public concerns regarding individuals’ right to privacy, and concern over the Government gathering information on individuals.
• Reliable, timely and relevant health and public health data remain crucial to inform policy and decision-making during the pandemic, and more broadly during public health emergencies and to improve long-term public health outcomes for Canadians.
• The Public Health Agency of Canada takes the privacy of individuals seriously and has ensured that no personal information was asked for, or received, and no individual or identifiable data was contained in mobility data received by the agency.
• The Agency is aware that the Office of the Privacy Commissioner is investigating complaints on the Agency’s use of mobility data. The Public Health Agency of Canada has proactively provided information to the Office of the Privacy Commissioner over the past year and a half on its use of mobility data and will continue to cooperate fully with the investigation. The investigation is ongoing.
• The Agency is currently reviewing the recommendations issued by ETHI on May 2nd 2022.
• The Government Response to the ETHI report should have been tabled on September 19, 2022.

If asked about the ETHI report
● The ETHI report was in response to a motion to study the collection and use of mobility data by the Government of Canada.
● There was consensus that the Public Health Agency of Canada did not violate any laws.
● Witnesses agreed that there was no suspicion of tracking individual Canadians nor any indication that the mobility data was de-anonymized or disaggregated.
● Some witnesses advocated for legislative reform, which carried into the final recommendations.
● The Government Response to the ETHI report was tabled on September 19.
o The Public Health Agency of Canada sees value in the recommendations made, but notes some recommendations go beyond the scope of the study as proposed by the motion.
o Out of the 22 recommendations of the Report, five were directly related to mobility data or the mobility program. The focus of these five recommendations was transparency with the public about the source, collection, use and handling of the data, and about consulting with the Office of the Privacy Commissioner.

If pressed on user privacy
● The Public Health Agency of Canada engaged internal privacy and ethics experts to ensure the Government of Canada’s use of mobility data follows best practices. The Agency also met with the Office of the Privacy Commissioner on this initiative in April 2020 and in January 2022.
● The Public Health Agency of Canada will continue to protect user privacy by ensuring that all future Request for Proposals require that the contractors protect user privacy by only providing secure, de-identified and aggregated data. This means all personal identifiers are removed before the Agency receives the data, that it represents a population of people, and that it cannot be used to identify or track individuals. Consistent with previous requirements for mobility data, future proposals will also include the same requirements for individuals to easily opt out of third party vendor’s mobility data sharing programs.
● The Agency will only consider vendors who meet the Government of Canada’s strict security, legal, privacy and transparency requirements.

If pressed on secrecy or transparency
● Previously, this work has been made publically available on the COVIDTrends website as a means to provide Canadians with local information on COVID-19 in their communities with explanations of how this data is used, and privacy protections in place.
● Since both mobility contracts have now expired, the mobility indicator was removed from the COVIDTrends website as of March 31, 2022.
● Mobility insights were also shared with provinces and territories as part of joint efforts on COVID-19.
● The Public Health Agency of Canada is committed to increasing public transparency and education, and building trust.

If pressed on the government’s response to the order of the House of Commons to immediately suspend this data-gathering program
• De-identified and aggregated mobility data is an important tool to understand the impact of public health measures on the pandemic. This data is used by other governments, both nationally and internationally, to help make better public health decisions.
• We understand the concerns of Canadians. We understand that trust in government is key and that preserving the privacy of people in Canada must be core to our service while we work to improve and protect the health of the people in Canada.
• The Government has been criticized for not having the data needed to understand and inform the pandemic response. Direction from the Auditor General and Canadians has been clear: Canada needs a better health data system that can meet the needs of our country during the pandemic and beyond.
• The Request for Proposal closed on February 18, 2022 and the Agency allowed it to expire in June 2022. No contract has been awarded, as no applicant met the requirements for transparency to the public in terms of being able to provide a simple opt-out. This requirement to provide options to opt out of the third party operator’s data collection was consistent with previous contracts for mobility data.
• We cannot speak to the details of the procurement process and any questions on procurement should be directed to Public Services and Procurement Canada.

Mobility data is a useful tool to inform public health analysis. To date, the Public Health Agency of Canada (PHAC) has used two types of mobility data: crowdsourced mobility data and operator based mobility data (which is complementary to and used to verify crowdsourced data).
Early in the COVID-19 response, operator-based mobility data was provided to PHAC through Innovation, Science, and Economic Development’s Communication Research Centre (CRC) in partnership with Telus Mobility.
PHAC established a sole-source contract, which expired on October 8, 2021, with Telus Mobility for this data in March 2021. PHAC also entered into a contract with Bluedot Inc. for de-identified and aggregated crowdsourced data. This contract expired on March 18 2022.
The data received from Telus was secure, de-identified, aggregated (i.e., not at the level of an individual), and vetted for security, legal, privacy and transparency considerations by both Telus and PHAC.
This data helps to contribute to generate public health insights including the ability to estimate the impacts of public health interventions and risk factors. This includes using mobility data analysis to contextualize the public health situation over time, examining possible links between population movement within Canada and propagation of COVID-19, measuring the effectiveness of public health measures, and empowering Canadians with information to improve and protect their health.
Since September 2020, COVIDTrends, PHAC’s COVID-19 public-facing dashboard, has provided Canadians with a population movement indicator to raise awareness of mobility patterns in relation to possible easement or tightening of public health measures within their health region. Mobility data is used to support that indicator. Since the contracts with Telus and Bluedot have now expired, the mobility indicator has been removed from the COVIDTrends website as of March 31, 2022,
PHAC has been producing report summaries to look at how movement trends of the Canadian population have changed over the course of the pandemic, including identifying new patterns to help direct public health messaging, planning and policy development. These summaries have been regularly shared with provinces and territories throughout the pandemic via the Special Advisory Committee.
In early fall 2021, PHAC launched an internal survey to mobility data users. Survey results indicated users find this data valuable and informative for COVID-19 situational awareness. Users also perceived the scalable potential of this data to inform other public health challenges.
PHAC launched a Request for Proposal (RFP) for its next partnership for operator-based mobility data in order to increase transparency and align with the Government of Canada’s “Open Data” initiatives.
An RFP was posted on the Buyandsell.gc.ca site in December 2021. In order to ensure identity protection, this RFP required that the vendor supply data that has been de-identified and aggregated (i.e., not individualized) in a secure format that is vetted for security, legal, privacy and ethical considerations.
Ethics and consultations
In response to an internal request for a privacy analysis for the planned uses of mobility data, PHAC’ Privacy Management Division (PMD) concluded in August 2020 that while the data is considered sensitive, it does not contain personal information and therefore is not subject to the Privacy Act.

In January 2021, internal consultation with the Public Health Ethics Consultative Group (PHECG) for advice related to consent and ways to mitigate potential public concerns surrounding perception of state surveillance provided an ethical analysis that outlined the need for PHAC to be clear about public health goals, transparent, and to engage the public. PHAC accepted all recommendations. Due to the priority of the pandemic response, Data Management, Innovation, and Analytics was not able to conduct a public consultation.
In addition, since April 2020, PHAC met with the OPC every two weeks to provide them verbal updates on all our COVID files, including mobility data. While the OPC was not asked formally for written comments on the mobility data initiative, at no time did they raise any concerns with PHAC on the numerous occasions when it was discussed with them and the information provided.
January 6, 2022 was the most recent meeting with OPC representatives to describe the mobility data project, associated RFP currently out for tender, the types of analyses performed to date, and future plans to support public health. The Agency provided OPC with a very detailed presentation including data types and pipelines, epidemiological uses, privacy, and safeguards, as well as user opt-out options.
For operator data, a number of security measures—at a contractor-level, at PHAC, and through IRCC’s Communications Research Centre—exist to preserve the privacy and integrity of mobility data:
● Contractors must have a secure platform with clear security protocols (e.g. two-factor user identification), data that is anonymized (e.g. scrambled SIM), and ensures that precise locations are not included (e.g. location of nearest tower only)
● Analyses performed within the platform use standard codes and protocols to ensure data is de-identified.
● Prior to data extraction, anonymized user IDs are removed, data are aggregated to at least 20 devices at no smaller than census subdivision level (i.e. municipality), and measurements must be transformed into percentages. This pre-processing of mobility data prevents tracking movement patterns of individual users, including at the cell tower level.
● Exported, aggregated data are stored securely in the AWS cloud, where automated reports are created by Communications Research Centre and sent to PHAC.
● Reports generated display population-level trends within health regions (with no fewer than 20 devices) and all measurements are in proportions.
PHAC employees attended the February 2, 2022 meeting of the ETHI committee and responded to questions from the committee both directly and via remit.
On February 8, 2022, the House of Commons passed a motion calling on the government to suspend the PHAC’s cellular data tender until the ETHI Committee reports to the House that it is satisfied that the privacy of Canadians will not be affected.
As there is no option to suspend an RFP, PHAC allowed the RFP to close on February 18, 2022. PHAC allowed the RFP to expire in June 2022, as no applicant met the requirements for transparency to the public in terms of being able to provide simple opt-out. This requirement to provide options to opt out of the third party operator’s data collection was consistent with previous contracts for mobility data.

• De-identified and aggregated mobility data at the population level was explored to evaluate the effectiveness of public health directives during the pandemic. By analyzing population movement data, the intent was to better understand the public’s responsiveness during lockdown measures.
• De-identification of the mobility data prior to receipt by PHAC meant that it did not include any personal identifying information (i.e. phone numbers, names, addresses). Further, anonymized device user IDs were also removed.
• The mobility data was also aggregated to at least 20 devices at no smaller than census subdivision (i.e. municipality). The vendor pre-processing of mobility data protects privacy and prevents tracking movement patterns of individual users.
• Analyses and findings from the mobility data were also regularly shared with provinces and territories as a supplemental source of information to support policy decisions and evaluation in their pandemic response.
• The mobility contract with Telus expired on October 8, 2021, and the mobility contract with Bluedot expired on March 18, 2022. As such, PHAC is no longer receiving this data.
• The data received was focused at the regional public health level and does not include any individually identifiable or personal information.
• The Ethics Committee (ETHI) and the House of Commons voted to suspend the data gathering program until the committee could release its report.
• ETHI submitted its report on May 2, 2022. The Government Response is expected to be tabled on September 19, 2022.
• As there was no option to suspend the RFP, PHAC allowed the RFP to close on February 18, 2022.
• The RFP was allowed to expire in June 2022 and no contract was awarded as no applicant met PHAC’s requirement for transparency to the public in terms of being able to provide simple opt-out. The provision of options to opt out of the third party operator’s data collection was consistent with previous requirements for mobility data.