The most widely read magazine for Canadian lawyers
Issue link: https://digital.canadianlawyermag.com/i/1260101
26 www.canadianlawyermag.com LEGAL REPORT PRIVACY AND DATA JOINT STATEMENT FROM PROVINCIAL AND TERRITORIAL PRIVACY COMMISSIONERS Privacy principles for contact tracing apps 5 Consent and trust 5 Legal authority 5 Necessity and proportionality 5 Purpose limitation 5 De-identification 5 Time limitation 5 Transparency 5 Accountability 5 Safeguards their recent history whether an employee is a risk to others in the workplace, and Michaluk says the privacy issues emanating from the practice have been "a constant source of work" for him and his colleagues. The threshold employers need to meet is whether active screening is "reasonably necessary," says Michaluk. He adds that while consent is also required, employers can make entry into their facility condi- tional on providing it. There is also protocol on storing records and how a temperature test is administered. When an employee tests positive for COVID-19, that's when things get more interesting, he says. Pre-pandemic, when a worker called in sick, the employer would not get involved unless it was a long-term absence, and even then, the specifics of the disease would not be known right away. Now, a positive COVID-19 diagnosis creates the impetus for the employer to know immediately and gather information on who the employee could have infected, he says. Overreacting runs the risk of shutting down operations unnecessarily and losing money, but disclosing too much infor- mation may bring a privacy complaint, a grievance if it is a unionized workplace or — although rare — a legal claim, Michaluk says. Responding with precision is helped with contact tracing apps, which Michaluk says are a frequent source of client inqui- ries. "Generally, employers want to know where people are in the workplace now more than ever," he says. On May 7, provincial and territorial privacy commissioners put out a joint state- ment, calling on governments to respect the following principles in their plans to use contact tracing applications: consent and trust, legal authority, necessity and propor- tionality, purpose limitation, de-identi- fication, time limitation, transparency, accountability and appropriate legal and technical security safeguards. Apps must be voluntary, the data extracted must be done so because it is scientifically necessary and likely to be effective in preventing COVID spread and data must be extracted in a minimally intrusive way, the commissioners state. But as more is learned about the novel coronavirus, the standards of "necessary" and "effective" are not static. Whether it be contact tracing or workplace policies tracking sensitive employee health data, Stikeman Elliott LLP privacy lawyer David Elder says, "The big grey area right now is the legitimacy of the objectives and the effectiveness of the measures." Elder, who is chairman of the commu- nications and privacy and data protection groups, says it is difficult for organizations "If we don't think about the long-term consequences of data being used for a different purpose than originally intended . . . I think we might have a trust crisis on our hands afterwards." Sylvia Kingsmill, KPMG Canada