VANCOUVER — British Columbia has temporarily modified its access to information and privacy act in response to COVID-19, lifting a requirement that personal data must be stored in Canada.
The province says the pandemic requires those who work for public bodies, such as health-care workers and teachers, to use digital communication tools that are normally restricted.
Michael McEvoy, B.C.'s information and privacy commissioner, said his office was consulted about the change and will soon release guidelines to help people working in the public sector choose the right online tools.
The new provisions are reasonable given the extraordinary circumstances and they are not without limitation, he added.
"It's a tailored response to a specific need at a specific time."
In an emailed statement, the Ministry of Citizens' Services used someone in self-isolation who may only know how to use one specific phone application to communicate with a nurse as an example of why the exemption is needed. It also allows teachers and university professors to access more digital tools.
There are limits on the information health-care bodies can disclose outside Canada, so the tools can only be used to communicate about COVID-19, says the ministerial order that allows the exemption.
Other public bodies, such as educational institutions, can also disclose personal information outside Canada through the use of third-party applications under certain conditions related to their own operational requirements and the public health response to the pandemic. The disclosure of personal data must be minimized overall, the order states.
Wherever personal information is being stored, each public body is still responsible for making sure the proper terms and conditions are in place to protect privacy, McEvoy said.
"That means properly reading the privacy policies that companies have," he said.
"They need to think ahead and look to see what the terms of service are."
Under the ministerial order that allows the exemption, public bodies must also remove personal information from each platform as soon as it's operationally reasonable to do so.
That means if a health-care team set up a Slack channel that contains personal information, or if a doctor was using WhatsApp to communicate directly with a patient, those messages should be deleted, the ministry statement said.
McEvoy said it's always important to avoid sharing sensitive information, even if a platform's privacy policy appears to protect it.
It makes sense to share a lesson plan between teachers and students, for example, but teachers should talk to their students about what might not be appropriate to share, he said.
The Ministry of Education announced Wednesday that it has secured and funded licences for Zoom online conferencing for all kindergarten to Grade 12 schools in the province on a Canadian-based server.
Although the new provisions are limited and temporary, advocates for privacy and civil liberties are watching closely.
The change has the potential to place personal information outside Canadian law, said Jason Woywada, executive director of the B.C. Freedom of Information and Privacy Association.
"If information is used inappropriately or resold without the consent of the individual that it's related to, that's where the problem occurs. So, if Canadians are part of a data breach that occurs in the U.S., what recourse do they have?"
Harsha Walia, the executive director of the B.C. Civil Liberties Association, noted the order does not define or restrict which online platforms and companies public bodies may share B.C. residents' personal information with.
She said it's important to ensure the information isn't being used beyond what's necessary, and in the long term this kind of "privacy creep" should not be normalized.
"We don't want to become acclimatized to the encroachment of civil liberties," she said.
"We have to be incredibly vigilant to ensure that state encroachment is not more than is reasonable, is incredibly defined and temporary, is transparent, and that it's rationally connected to public health."
The ministerial order is in effect until June 30 and the province said it will work with McEvoy's office to either rescind or renew it, depending on the pandemic.
Typically, B.C. has some of the strictest requirements in the country on where personal data can be stored, said McEvoy. Nova Scotia is the only other province with similar legislation that applies to public bodies.
"Access and privacy laws are designed to allow for the sharing of information, particularly in crises like these," he said.
This report by The Canadian Press was first published April 4, 2020.
