Beyond COVID-19: Crisis response or road to recovery?
Crisis response or road to recovery?
In light of the challenges faced by Canadian organizations and government institutions during the COVID-19 outbreak, on March 20 the Office of the Privacy Commissioner of Canada (OPC) issued the following guidance bulletin “Privacy and the COVID-19 Outbreak” (OPC Bulletin). The OPC Bulletin provides a useful reminder to organizations and government institutions of the foundational principles under Canadian privacy laws that allow for the collection, use and disclosure of personal information and how such principles may potentially be altered during a public health emergency such as the current COVID-19 outbreak.
The following summarizes the OPC’s takeaways in the bulletin:
At this time, all provinces and territories have declared states of emergency regarding the COVID-19 outbreak, but a national emergency under the federal Emergencies Act has not yet been declared. Where a public health crisis or situation constitutes a public emergency, the OPC reiterated that an organization’s or a government’s ability to collect, use and disclose personal information of individuals may possibly be extended, particularly regarding the use and disclosure of personal information without the individual’s consent. Whether an organization has an expanded right to collect, use or disclose personal information depends on an analysis of the specific privacy legislation at issue. We address some of the relevant Canadian privacy legislation below.
PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of a commercial activity and to information about employees of federal works, undertakings or businesses.
The OPC reiterated in the bulletin that normally under PIPEDA, organizations are permitted to collect, use or disclose personal information for reasonable purposes and where the individual’s knowledge and meaningful consent has been obtained. However, the OPC noted that the present situation caused by the COVID-19 outbreak may mean that certain provisions under PIPEDA that allow organizations to collect, use or disclose personal information without the individual’s knowledge or consent in the following limited circumstances may be applicable if:
The OPC Bulletin also refers to similar COVID-19 privacy bulletins issued by the respective privacy commissioners of British Columbia, Alberta, Saskatchewan, Quebec, Newfoundland, Yukon and the Northwest Territories and indicated that such provincial and territorial privacy legislation may similarly allow for expanded use or disclosure of personal information by organizations during emergency situations.
For BC, Alberta and Quebec, provincial privacy legislation applicable to private-sector organizations potentially allows for expanded means to use and disclose personal information in emergency situations including:
The OPC Bulletin serves as a useful reminder that while the public health emergency created by the COVID-19 outbreak could allow organizations to collect, use and disclose certain personal information without an individual’s consent under existing privacy legislation, such organizations are nonetheless advised to independently consider each situation to ensure the exemptions discussed above are indeed applicable.
The COVID-19 pandemic has seen governments across the world restricting civil liberties and movement to new levels.