Wendy J. Wagner
Associée
Co-chef, Groupe national Cybersécurité et protection des données
Article
Despite the novelty of the coronavirus, pandemics are far from a new phenomenon. Even our forefathers had quarantines on their mind. The federal government derives its quarantine powers from the Constitution Act, 1867. Section 91(11) of the Constitution Act provides that quarantine powers are within the exclusive purview of the Parliament of Canada. While healthcare is administered by the provinces, the federal government maintains some jurisdiction over health in national emergencies through the "peace, order and good government" clause embedded in section 91.
If quarantine powers are constitutionally enshrined, what makes them so controversial?
In 2004, the current iteration of the Quarantine Act was introduced in the aftermath of the SARS outbreak to prevent the spread of communicable diseases. The Act broadly provides the federal government with powers to quarantine persons and conveyances (e.g. ships, airplanes, etc.) entering and leaving Canada to prevent the spread of communicable diseases.
Importantly, the Act enables the federal government to appoint quarantine officers to assess and detain persons entering and leaving Canada who have or might have a communicable disease, or have recently been in close proximity to a person who has or might have a communicable disease.
Communicable diseases are defined as follows and may also be specifically included in the Quarantine Act Regulations:
communicable disease means a human disease that is caused by an infectious agent or a biological toxin and poses a risk of significant harm to public health, or a disease listed in the schedule, and includes an infectious agent that causes a communicable disease.
During the SARS outbreak, the former iteration of the Act was invoked, and SARS was added to the list of diseases in the accompanying regulations. There is no data to suggest that quarantine officers issued quarantines against anyone during the SARS crisis, but COVID-19 may prove otherwise.
On March 25, 2020, the federal government introduced an emergency order under Quarantine Act despite the fact that Canada had not declared a state of emergency. The Act is binding on all provinces and territories in Canada. The Act is one of few which provides the Minister of Health with extraordinary measures to designate medical practitioners, or other qualified health professionals, "quarantine officers".
Under section 58(1) of the Quarantine Act, which enables Cabinet to issue executive orders, travelers returning to Canada are now required to quarantine for 14 days upon return. Failure to do so may result in a fine of not more than $750 000 or a term of imprisonment of not more than six months or both.
The Act provides for a host of other sweeping powers. The following powers are worth noting:
The Quarantine Act has a history of being imposed with a heavy hand by officials based on fear and prejudice rather than medical fact (see Nola M. Ries' piece on Quarantine and the Law). One might argue that its invocation in light of COVID-19 is far from heavy-handed and very much rooted in the reality of what medical authorities already know about this virus. However, Canada has not ruled out relying on big data to ensure enforcement. According to one CBC article, "cellphone companies are already sharing data with health authorities around the world".
Canada recognizes that early detection and containment are integral for curbing the spread of COVID-19. Current national surveillance objectives include notifying and disseminating information to stakeholders to facilitate timely and appropriate public health activities. Moreover, the Prime Minister has encouraged provinces and territories to allocate public health funding towards enhancing surveillance and monitoring measures. Despite the Minister of Health mandatory isolation order under the Quarantine Act, given the surveillance measures imposed in other countries, it is conceivable that Canada may also move towards using big data as a quarantine enforcement tool.
National health authorities in European countries subject to the General Data Protection Regulation ("GDPR") are relying on big data in a more limited capacity in comparison with other countries; namely, they are exclusively relying on anonymized data as opposed to personally identifiable information to track individuals. In Germany, Austria, and Italy location data from mobile devices is used to estimate the degree to which the population is complying with stay at home orders. This information is then used to develop models to map concentrations and movements of individuals.
China, Taiwan, and South Korea have pursued more invasive measures which use smart phone location readings to trace the movement and contacts of individuals who have tested positive. For instance, Taiwanese authorities have integrated national health insurance and customs databases to develop analytics that combine travel history with clinical symptoms to identify carriers of COVID-19. High-risk individuals are ordered to remain quarantined at home, and compliance with these orders is electronically monitored by way of mobile phones. Israel has also deployed its internal security service to track the movement of confirmed and suspected COVID-19 cases via geolocation data. Though effective, these measures raise concerns as they involve combining data normally collected for a set of different and unrelated purposes without necessarily notifying the affected individuals. Cognizant of these privacy ramifications, Oxford University has proposed implementing similar contact-tracing technologies but on a voluntary and opt-in basis. Similarly, privacy sector platforms are proposing to build "privacy by design" into systems for contact tracing, including consent and anonymization.
The Office of the Privacy Commissioner of Canada ("OPC") has recently issued guidance on the implications of COVID-19 on Canadians' privacy. The OPC, along with various provincial and territorial authorities that oversee privacy legislation in their respective jurisdictions, has clearly indicated that while privacy laws continue to apply in times of public health emergencies, their purpose is not to impede appropriate information sharing.
In Canada, privacy is a core, Charter-protected value. Section 8 of the Canadian Charter of Rights and Freedoms provides that "everyone has the right to be secure against unreasonable search and seizure". Canada's privacy laws have a foundation in this constitutionally protected right. However, it would seem that some of these laws may provide leeway in times of crisis. For example, the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") applies to the collection, use and disclosure of personal information by private sector organizations including federal works, undertakings or businesses such as airlines and telecommunication providers. While meaningful consent generally drives the collection, use, and disclosure of personal information, PIPEDA contains exceptions that allow for private sector actors operating in times of emergency to share personal information without consent with public authorities [see section 7(3), Para 9 of OPC's Guidance Document].
The OPC has identified that provisions such as section 7(3)(d)(i) of PIPEDA may appropriately be relied upon as providing the authorization for private sector organizations to collect and disclose personal information to public health authorities looking to enforce quarantine orders. This approach is echoed by the European Data Protection Board ("EDPB") which provides that an "emergency is a legal condition which may legitimise restrictions of freedoms, provided these restrictions are proportionate and limited to the emergency period".
The role for big data in addressing the COVID-19 pandemic in Canada remains to be seen but may be legally authorized if the collection and use of the data is: (1) proportional to the seriousness of the public health threat; and (2) limited to what is necessary to achieve a specific public-health objective. Canadians place a high value on privacy protection, suggesting that public health authorities will need to be forthright about what data is being collected, why it is collected, with whom it may be shared with, and how long it will be retained following the extraordinary measures.
All of these legislative guidelines will be critical in the balancing act between protecting privacy and domestic efforts to plank the curve. While our forefathers may not have contemplated the use of big data to do so, it seems the intersection between quarantines and privacy was inevitable.
CECI NE CONSTITUE PAS UN AVIS JURIDIQUE. L'information qui est présentée dans le site Web sous quelque forme que ce soit est fournie à titre informatif uniquement. Elle ne constitue pas un avis juridique et ne devrait pas être interprétée comme tel. Aucun utilisateur ne devrait prendre ou négliger de prendre des décisions en se fiant uniquement à ces renseignements, ni ignorer les conseils juridiques d'un professionnel ou tarder à consulter un professionnel sur la base de ce qu'il a lu dans ce site Web. Les professionnels de Gowling WLG seront heureux de discuter avec l'utilisateur des différentes options possibles concernant certaines questions juridiques précises.