Police forces across Ontario engaged in broad, illegal searches of a now-defunct COVID-19 database, two civil rights groups alleged Wednesday, claiming the use of the portal violated individual privacy rights for months.
The Canadian Civil Liberties Association and the Canadian Constitution Foundation said in separate reports that many services used the database to look at COVID-19 test results for wide geographic areas and sometimes pulled up personal information unrelated to active calls.
“People weren’t told that when they went for COVID tests that this information was being shared with police and they certainly weren’t asked for their consent,” said Abby Deshman, the criminal justice program director for the CCLA.
“That should be a decision every person makes about what they want to do with their own personal medical information.”
In early April, the Ontario government passed an emergency order that allowed police to obtain the names, addresses and dates of birth of Ontarians who had tested positive for COVID-19. The portal was aimed at helping to protect first responders.
Police access to that database ended on Aug. 17, after a legal challenge was filed by a group of human rights organizations.
The group, which included the CCLA, argued that allowing police to access personal health records violated individuals’
constitutional rights to privacy and equality.
Data released in the context of the legal action showed that Ontario police services conducted over 95,000 searches of the database while it was active.
The CCF filed a freedom of information act request to the province related to police use of the database.
On Wednesday, the CCF made public a June memo from the Solicitor General’s office to chiefs of police that warned against using the database beyond the “express purpose” of the emergency order.
The CCF said the memo revealed a “shocking misuse” of personal health information by police.
“Police were caught using the COVID-19 database to look up names unrelated to active calls, to do wholesale postal code searches for COVID-19 cases, and to even do broad based searches outside officers’ own cities,” said CCF litigation director, Christine Van Geyn.
The CCF said it has filed a complaint with Ontario’s privacy commissioner over violations of the Personal Health Information Protection Act, and with the Ontario Independent Police Review Director for officer misconduct.
Meanwhile, the CCLA sent letters to 37 police forces, asking them for details of how the database was used and if any information was retained from it.
Twenty-three responded and Deshman said she expects more to do so.
Many forces found the database difficult to use and resorted to problematic broad searches in an attempt to find workarounds, the CCLA said.
The association notes that more than 40 per cent of the 95,000 searches of the database were conducted by either the Thunder Bay police or Durham Region police.
Thunder Bay police accessed the personal health information in the database more than 14,800 times – a rate of access 10 times higher than the provincial average – even though the area reported a total of just 100 COVID-19 cases while the database was active.
In Durham Region, police continued to run unauthorized searches even after provincial audits called attention to the inappropriate searches taking place, the CCLA said. The force’s access to the portal was cut off by the province as a result, the CCLA said.
“Durham is a particularly concerning example,” said Deshman.
“In those cases there needs to be disclosure (to citizens whose information was accessed) and accountability by following up with the individuals in the police service that looked up information inappropriately.”
Holly Walbourne, the legal counsel for Thunder Bay police, said in a letter sent to the groups that filed the legal challenge that the force understood their concerns but that police had “lawful authority” to use the database to protect first responders.
“(T)here was a shortage in personal protection equipment (PPE) in the beginning months of the pandemic,” reads the letter dated Sept. 24. “The COVID portal allowed our officers to ration the use of their PPE by knowing when it was necessary to take all precautions.”
Durham police Supt. Peter Cousins wrote a report to the force’s police services board on the issue on Sept. 1 saying access to the portal and its information was treated “seriously and with due care.”
Toronto police never used the database because of “issues with the accuracy and reliability of the information,” the CCLA reported. York Region police said they asked the province to revoke access to the database after an internal review found the risks associated with accessing personal health information outweighed any benefits.
Deshman said anyone concerned about police access to the province’s COVID-19 database should contact their local police force and the Ontario Privacy Commissioner.