Hamilton police accessed your COVID health info. They never should have, says privacy expert
Hamilton police accessed a database containing individuals' COVID-related health information more than 10,000 times over a three-month period, according to provincial data.
A privacy expert says they never should have had access in the first place.
The provincial data, released by the Canadian Civil Liberties Association (CCLA) on Monday after the group obtained it amid a now-discontinued lawsuit against the province, shows Hamilton police accessed a COVID testing results database 10,293 times between April 17 and July 20. Included in the database were names, addresses and dates of birth of Ontarians who tested positive for COVID-19.
The Ministry of the Solicitor General made the database available to police and other first responders in Ontario through an emergency order during the pandemic. The ministry discontinued access on July 20 when the order ended, a ministry spokesperson said.
Hamilton ranked fifth among police services for number of times they accessed the database, with Durham, Thunder Bay, York and London police accessing the database the most. Some forces, such as the Toronto Police Service, did not use the database at all; the CCLA said some police boards decided not to access it.
In my view, they should never have had access to that health data," said Ann Cavoukian, a former Ontario privacy commissioner. They shouldn't be able to look up any health information unless they have a warrant."
Cavoukian called Hamilton's higher rate of access concerning," noting the information is sensitive and personal.
Jackie Penman, Hamilton police spokesperson, said police used the database to protect the health and well-being of our officers and the community."
The database was only accessed in cases where a call for service was generated and where the COVID-19 status of a person was unknown," Penman said. Only communications operators and communications supervisors had access."
The Ministry of the Solicitor General conducted regular" audits relating to police's use of the database and Hamilton police conducted their own audit, Penman said.
Still, Ontario's current privacy commissioner, Patricia Kosseim, has concerns about indiscriminate" use.
While we are pleased to see that the province has since decommissioned the portal, the numbers of times personal health information was accessed in several areas of the province suggests that there may have been some indiscriminate use of the database, which is very concerning," read a statement from the Information and Privacy Commissioner of Ontario. My office will be contacting those police services where there was a disproportionate number of database inquiries to inquire into the circumstances behind those high numbers and ensure there is no unlawful use or retention of the information they may have previously accessed from the portal."
It's unclear if Hamilton police are among those services the office is contacting.
The statement confirmed the privacy commissioner examined the regulation" that would allow police and first responders access to the database before it was put in place.
We were not persuaded that these disclosures, which are highly privacy invasive, were necessary to reduce the risk of harm to those responding to emergency calls," the statement read.
Abby Deshman, criminal justice program director with the CCLA, echoed the privacy commissioner's concerns.
Every time you share personal, private information you increase the risk of inappropriate useage and abuse," she said.
She also worries people's COVID status might be used against them in court, such as in cases where a person is accused of coughing or spitting on someone.
The CCLA dropped its lawsuit against the province when use of the database was discontinued.
Cavoukian questions how useful the database could have been in protecting anyone.
(Police) should be taking precautions with everyone that they meet," she said. They don't need to have a list of people who are COVID-19 positive."
Cavoukian wonders, too, what will happen to the information police already gleaned from the now-discontinued database. Was it downloaded and stored somewhere?
No personal information was stored," Penman said.
Katrina Clarke is a Hamilton-based reporter at The Spectator. Reach her via email: katrinaclarke@thespec.com