The movement of British Columbians’ health-care information across borders is one of many parts of digital change accelerated by the COVID-19 pandemic, B.C.’s information and privacy commissioner said March 11.
“The virus has rocketed the trajectory of our digital information,” Michael McEvoy told Vancouver International Privacy and Security Summit delegates.
British Columbians’ educational and health information were high on the list of data that the provincial government began sharing across borders as the pandemic picked up steam in 2020.
Governments issued reassuring words, telling people their data being stored in other countries is nothing to be worried about, McEvoy said.
“There is indeed much to be concerned about,” he said.
B.C.'s move away from what is known as "domestic residency of data" happened early in the health crisis. The province moved to allow British Columbia’s health and education information to be shared across geographic borders into other legal jurisdictions. It was done through ministerial orders to allow for health-data sharing to battle the virus and to allow for online schooling.
Such orders do not go before the provincial legislature.
However, in November, the data residency provisions of the Freedom of Information and Protection of Privacy Act were amended to remove the prohibition (with certain exceptions) on disclosure of personal information outside of Canada.
“Once personal information leaves the country, Canadian laws do not apply and contractual or technical protections may not be enough to protect the information adequately,” a commissioner’s office guidance document said.
The government, however, said data-residency requirement changes would “bring B.C. in line with other jurisdictions” by allowing more “access to digital tools and technologies.”
The guidance said any risk assessment involving disclosure of data outside Canada must include an assessment of the legal framework in the jurisdiction where personal information is being disclosed.
Jurisdictions with the hallmarks of a healthy democracy would likely protect data while authoritarian countries could pose threats to the privacy of Canadians if their data were stored there, the document noted.
“The new discretion to disclose personal information outside Canada demands a very high level of rigour and should only be undertaken after a careful assessment,” the guidance said. “Disclosure outside Canada will always involve risks that no administrative, technical and contractual controls can eliminate.”
.jpg;w=120;h=80;mode=crop)