Privacy experts are raising concerns about some of the guidance the Ontario government is offering to businesses on the verge of reopening under the next stage of the province's COVID-19 recovery plan.
The framework outlining the next phase of reopening, set to take effect across much of the province on Friday, contains advice for certain businesses to collect patrons' contact information in a bid to help with contact tracing in the event of future outbreaks.
But legal experts say the government suggestion is both too broad to have a meaningful impact on public health and potentially too risky for businesses to adopt.
They say salons and other companies urged to collect contact information are not necessarily used to navigating the complexities of Ontario's privacy laws and may simply opt to omit that step to avoid running afoul of the legislation or driving wary customers away.
They also say the guidance is too general, omitting key details like the length of time contact information should be retained.
They're urging the government to clarify such points, potentially following the lead of provinces like British Columbia that have provided more specifics in their advice to local businesses.
"When it comes to collecting information about people in ways that are lawful and privacy-protective, the devil is always in the details," said Brenda McPhail, director of the privacy, technology and surveillance project at the Canadian Civil Liberties Association. "When the guidance is overly broad and vague, it just stands to reason that people are not going to think through those details and that there's going to be problems."
The framework detailing the next phase of Ontario's recovery efforts makes repeated but general reference to measures businesses could take to support contact tracing efforts.
In sections outlining rules for personal care services, tour and guide services, and attractions or heritage sites, the document urges those businesses to "consider operating by appointment and/or recording each patron’s name and contact information for the purpose of contact tracing." No such guidance is provided for sections covering restaurants, retailers, pools, parks or libraries.
The Ministry of Labour said omitting those sectors was not an oversight.
"While some sectors have greater capacity for physical distancing, in others these recommendations are designed to stop the spread of COVID-19," spokeswoman Janet Deline said in a statement.
Ministry of Health spokeswoman Hayley Chazan offered a few more details about the current advice.
"Businesses are not required to collect name and contact info but they are encouraged to do so," she said in a statement. "There is no requirement for the business to verify the authenticity of the information provided."
Teresa Scassa, Canada Research Chair in information law, said the seemingly patchwork approach to contact tracing guidance seems likely to prove perplexing for business owners who may already be reluctant to embrace such measures.
She said most businesses unaccustomed to collecting personal data may not be familiar with the province's privacy laws, which lay out strict rules about how, when and why the information should be gathered.
"Legislation requires that a business give notice of collection of information and the purposes for collection," Scassa said. "So if a business were to follow the recommendation, they would really have to turn their attention to how they would notify customers that they're collecting this information and that they were collecting it for the purpose of possibly sharing it with public health authorities."
Such details are missing from Ontario's COVID-19-related guidance, she said, and the lack of clarity may lead businesses to ignore the advice altogether and negate any potential public health benefits the government hoped to reap.
McPhail agreed, saying rules recently adopted in B.C. offer a clearer path forward for businesses and patrons alike.
She said that province has clearly spelled out that businesses should collect only first and last names, plus either a phone number or email address for one person among a party. B.C.'s rules also state the information should be kept for 30 days and is only to be used for contact tracing purposes.
McPhail said that while requesting such details seems like the kind of step that would not be tolerated if it weren't for the global pandemic, the B.C. approach strikes the right balance and could serve as a guide for other Canadian jurisdictions.
"There's a real concern that habituating people to just handing over information will leave them vulnerable to privacy incursions," she said. "...Orders expanding the kinds of information people have to share just to go about their daily lives deserve careful consideration by governments, careful scrutiny by privacy commissioners, and critical evaluation by the public."
The Canadian Federation of Independent Business said it supports the idea of helping with contact tracing efforts so long as companies aren't asked to overstep their own or their customers' comfort levels.
"Having restaurants getting one phone number from a group/party of people would be fine," said Vice-President of National Affairs Corinne Pohlmann. "But asking for full names and contact info for every person in a group/party would likely be too invasive and difficult for the small business owner to get from their customers. This will likely be the best way to get small businesses and their customers to do their part."
This report by The Canadian Press was first published June 10, 2020.
Michelle McQuigge, The Canadian Press