Search

Telecom - Commission letter addressed to John Lawford (Public Interest Advocacy Centre)

Ottawa, 17 August 2020

BY EMAIL

John Lawford
Executive Director and General Counsel
Public Interest Advocacy Centre
285 McLeod Street, Suite 200
Ottawa, Ontario K2P 1A1
jlawford@piac.ca

RE: Application submitted by the Public Interest Advocacy Centre regarding pandemic contact-tracing by major Canadian telecommunications service providers

Dear Sir:

This letter sets out the Commission’s determinations regarding the application from Public Interest Advocacy Centre (PIAC) dated 4 May 2020, in which it requests Commission action to ensure that pandemic contact tracing applications for public health purposes are developed “in the fairest, most open and transparent manner, non-coercively and only for the intended purpose(s)”.

The Commission acknowledges that PIAC’s application has raised important issues that are relevant and of interest to Canadians, as well as to federal, provincial and territorial Privacy Commissioners. The Commission is also concerned with how telecommunications service providers (TSPs) use and manage the confidential customer information of their customers and has put into place frameworks to regulate the behaviours of TSPs in this regard, in accordance with its jurisdiction under the Telecommunications Act (the Act) and the policy objective in s.7(i) of the Act to contribute to the protection of privacy of persons. The appropriate handling of confidential customer information by TSPs is paramount and the Commission has considered PIAC’s application in that context.

PIAC’s application requested that the Commission, as a condition of offering telecommunications services (mobile wireless or Internet access), under the authority of ss. 7, 24, 24.1 and 47 of the Telecommunications Act, require all TSPs to:

  1. Disclose to the public and the Commission any steps taken for any government or private interest to facilitate contact tracing;
  2. Inquire into any such TSPs’ activities related to contact-tracing applications or network-level facilitation of individual consumer location or other personal or communications details;
  3. Require any such TSPs’ activities related to contact tracing respect the confidential customer information rules of the Commission devised for telephony;
  4. Prohibit TSPs from using prior consumer consent to location track mobile devices or to provide databases previously gleaned from these programs to any private or government entities to build, improve or test COVID-19 tracing tools without new, explicit, prior individual consent for this new use or disclosure;
  5. Appoint an inquiry officer under subs. 70(1)(a) of the Telecommunications Act, to inquire into and report upon contact tracing, as well as to liaise with public health authorities and governments and non-telecom private parties, if necessary;
  6. In the alternative, launch a formal Notice of Consultation on the matter.

The Commission received related correspondence from Rogers (7 May 2020), Bell (12 May 2020), PIAC (12 May 2020 and 14 May 2020), Telus (12 May 2020 and 15 May 2020) and the Canadian Wireless Telecommunications Association (CWTA) (13 May 2020). 
In their correspondence, Rogers, Bell and Telus indicated that federal and provincial Privacy Commissioners are already seized of this issue and as such, the application should be dismissed.

PIAC took the position in their 12 May 2020 correspondence that Privacy Commissioners have limited jurisdiction and that the Commission “is the only regulator that has jurisdiction to allow or prohibit use of confidential customer information.” It further noted that the Commission in Telecom Decision 2003-33 “asserted its jurisdiction to apply higher privacy standards than those set in generalist privacy legislation.”
The CWTA noted that none of its members are involved with contact tracing applications and that Canada’s Anti-Spam Legislation (CASL) and the Personal Information Protection and Electronic Documents Act (“PIPEDA”) offer Canadians protections that address the issues highlighted by PIAC.

A Commission staff letter was sent to PIAC on 13 May 2020 indicating that the application would not be considered in light of the fact that the application and later correspondence does not appear to present any evidence that current privacy frameworks are not sufficient or that launching a public proceeding at this time would be beneficial to Canadians. It acknowledged that the federal, provincial and territorial Privacy Commissioners have taken action with respect to privacy-impactful initiatives in response to COVID-19.

In its 14 May 2020 letter, PIAC argued that the Commission has an obligation to post the application and sought a Commission decision on Rogers’ procedural request to dismiss the application.  PIAC cited Telus’ “Data for Good” Privacy Statement as evidence that the Commission should be intervening.

On 15 May 2020, Telus clarified that Data for Good is not contact-tracing, but rather forms part of Telus’s Insight platform and serves to provide Governments, health authorities and academic researchers with de-identified and aggregated data sets that can be used to identify trends and patterns without disclosure of any personally identifiable information. 

The documents referenced in this letter can be accessed through the Related Documents link.
As noted earlier, the Commission considered PIAC’s application in the context of the appropriate handling of confidential customer information by TSPs.

In the Commission’s view, the evidence put forward in PIAC’s application, as well as in the submissions of the CWTA and various TSPs, do not demonstrate that such an inquiry is warranted at this time.  Based on the available information, TSPs do not appear to be involved in the development or implementation of contact tracing applications in Canada, but rather to the extent that applications are being developed, it is by GovernmentsFootnote1, health authorities and third-party developers.  The voluntary contact tracing applications use Bluetooth technology to collect information to alert Canadians that they may have been exposed to a person(s) infected with COVID-19. The available evidence indicates that TSPs are not involved in the collection nor in the communication of that data.  Rather, TSPs, as common carriers, provide the networks over which these, as well as other applications, operate.

As set out in Section 22 of the Canadian Radio-television and Telecommunications Commission Rules of Practice and Procedure (Rules of Practice and Procedure), an application must, amongst other things, “contain a clear and concise statement of the relevant facts [and] of the grounds of the application…”  The Commission finds that PIAC’s application, as filed, is broad in nature and does not identify a specific activity or action by TSPs in the development or implementation of contact tracing measures such that Commission intervention is warranted at this time.  In addition, it does not demonstrate that existing privacy frameworks and protections are insufficient at this time to address the issues it has identified. 

The Commission acknowledges that a joint statement was released on 7 May 2020 by the federal, provincial and territorial Privacy Commissioners outlining privacy principles for contact tracing applications. These principles include, amongst others, meaningful consent, time and purpose limitations, and transparency and accountability. Prior to this joint statement, the Office of the Privacy Commissioner of Canada (OPC) had issued a framework to assess privacy-impactful initiatives in response to COVID-19 on 17 April 2020.

In sum, the application does not support the proposition that TSPs are actively participating in or contemplating participating in contact tracing measures and that the current Commission privacy frameworks that regulate the behaviours of TSPs, in conjunction with other legal requirements flowing from privacy legislation, are insufficient to address current contact tracing initiatives or, more importantly, that additional regulatory measures are required.

Accordingly, the Commission has determined that it is not in the public interest, at this time, for it to engage in a broad-based inquiry of the type requested by PIAC nor to require the production of the requested information. The Commission has considered the application and has determined that an inquiry will not be launched either by the appointment of an Inquiry Officer or by a notice of consultation at the moment.

The Commission continues to closely monitor the situation in the public interest. Should the factual circumstances change or should indications arise that TSPs are participating – or contemplating participating – in contact tracing measures, the Commission may reconsider whether to inquire into these activities in order to determine what, if any, additional measures should be taken.  As part of its monitoring efforts, the Commission will continue to communicate with the OPC.

Yours sincerely,

(Original signed by)

Claude Doucet
Secretary General
CRTC

Date modified: