Ontario police forces misused private COVID-19 database

According to CCF Litigation Director Christine Van Geyn, several police forces "were caught using the COVID-19 database to look up names unrelated to active calls, to do wholesale postal code searches for COVID-19 cases, and to even do broad based searches outside officers' own cities," something that the CCF says there is "no rationale for."

With such malfeasance, the CCF has filed a complaint to the Ontario Privacy Commissioner for violations of the Personal Health Information Act and the Ontario Independent Police Review Director for "officer misconduct."

Reports from the CCF show that Ontario police conducted "over 95,000 searches," with 40 percent of those being conducted by the Thunder Bay Police Service or Durham Regional Police Service.

"Early reports of the high numbers of searches suggested that the COVID-19 database was being abused by police," said Van Geyn. "But the document we are releasing today reveals the extent and details of this abuse. Canadians have a constitutionally protected right to privacy, and police should not be permitted to look up our confidential health information in order to satisfy their morbid curiosity."

When speaking to The Post Millennial, Van Geyn said that the improper use of first responder's COVID-19 database "undermines trust in our institutions."

"We are told by government that we can trust them with our data, but in this case we saw the government took very little care to safeguard that data and it was abused," said Van Geyn. "We don't know exactly what police were looking for when they conducted these unauthorized searches. That is why we have asked the privacy commissioner for an investigation. Any individuals who are found to have had their right to privacy violated needs to be notified."

Van Geyn said that the situation could have been prevented by safeguarding data, as the data was "inaccurate and incomplete," and therefore did not help police.

"It actually puts police safety at risk to ask them to rely on inaccurate information. So the database should never have been shared with police to begin with, police would have been safer treating every interaction as a presumptive positive case of COVID," said Van Geyn.

"This improper use of data shows the importance of "privacy by design." The database was not designed with privacy in mind. In contrast, the COVID-19 alert app is decentralized in order to protect privacy, and could not be abused the way this database was. But if governments want us to trust them, they need to show the public they are worthy of trust."

In all, 52 employees within the Thunder Bay Police Service (TBPS) Communications Centre had access to the COVID portal.

"These individuals were call-takers, dispatchers, supervisors and managers of the Communications Centre," said TBPS in a statement. "The COVID portal was accessed by these employees for work purposes only and all of those who had access to the portal were properly."

"In some cases it was necessary to conduct multiple checks on one name or address given the way the information was stored in the portal. The Ministry did not warrant that the information available through the portal was complete, accurate or up-to-date and further indicated that there may be inconsistencies in the way address information was found within the portal. To that end it was sometimes necessary to run multiple searches for one address to ensure the results, if any, were found. These above reasons explain why the Thunder Bay Police Service had a high number of 'hits' in the COVID portal database," said police.