Metrolinx tweeted Monday that it gave Toronto Public Health contact information associated with Presto payment cards used on specific trips between March 2 and 4 after a rider was diagnosed with COVID-19.
Experts applauded the Ontario transportation agency, saying others must have the ethical responsibility to ensure there is documentation and proper screening in place when faced with requests for user information. They say this will balance protecting individual privacy against the broader public threat.
In its tweet, Metrolinx said that under Ontario’s privacy act it was permitted to “disclose personal information in compelling circumstances affecting the health or safety of individuals, provided we notify them.”
Anne Marie Aikins, senior manager of media at Metrolinx, said in an interview that the agency has had a “very strict process” put in place since the 2003 SARS outbreak and has since been “strengthened over the years.”
Aikins added the information given is very limited and only includes the name and contact information.
“We don’t just give [requested information] automatically. It goes to our privacy office... and they vet the circumstances. They have to look at the information that Public Health or police enforcement has to fill in, [a form] or it includes a warrant,” she said. “Our privacy officer has to sign off on it and say ‘yes this fits the criteria, they’ve given the right documentation,’ and then we give it to them.”
This process is put in place for every individual file, Aikins said, adding that those customers are immediately notified as well of the actions taken place.
Warrants are needed to protect privacy: Cavoukian
Ann Cavoukian, former information and privacy commissioner of Ontario, commended Metrolinx’s approach to protecting the privacy of its customers, and advised that other organizations and agencies should do the same.
“There are legitimate reasons why this information is sought out by various departments, law enforcement, public health. But to do so with a court warrant, because then that provides the necessary justification that this is truly a justified request for justifiable reasons,” she said in an interview.
If warrants or proper documentation are not put in place, Cavoukian said it could do more harm to innocent individuals than good.
“Theoretically, a lot of people’s information could be requested by law enforcement or public bodies because they want to be on the safe side... that could cause a lot of harm to individuals who weren’t at all affected by say the coronavirus or anything else,” she said. “It could put them in harm’s way when it was completely unnecessary.”
Chris MacDonald, an ethics professor at Ryerson University, said in an interview that in times like these it’s a good reminder to anyone who uses ID cards that have online accounts or are linked to a digital identity, to understand that their information could be used for surveillance.
“There is a privacy concern, and [proper] procedures need to be followed. It seems like [Metrolinx] has a process in place, and as an outside observer, it looks like a fairly robust one,” MacDonald said. “In this particular case, it seems like a very good use. But it’s still a worthy reminder for all of us that there’s always the possibility of information being used for less noble purposes.”
Like Cavoukian, MacDonald said it is important that agencies employ proper methods to acquire information and that they should “gather as little as possible to achieve the goal.”
“They didn’t say, we want all Metrolinx information for the entire [Greater Toronto Area] for this month. That would be silly. It seems like they’re taking a targeted approach... the less the better,” he said.
MacDonald said that while Metrolinx has a system in place, he advised that systems and policies are kept up to date and that staff are properly trained as well.
“Organizations should be asking ‘do we have the training and the systems in place, not just to deal with data and privacy on a regular business day, but on a day when public health comes calling in the middle of a crisis?’”