According to CBC, the Windsor (Ontario, Canada) police have accessed the provincial database of Covid 19 patients during the period between April 17 and July 20 of this year. Such expiration date was the consequence of the revocation of access to said database by the Canadian authorities.
Within the period that the Windsor police had access to this information they searched more than 1841 times, this placed it among the ten police headquarters with the most searches in this database within the province of Ontario, why? What is the impact?
According to the University of Windsor professor Sukanya Pillay, an expert in constitutional law and human rights, the actions by the Windsor police are to say the least, “concerning”, adding: “Anytime the police want to invade our personally identifiable information, they must have a constitutionally sound reason to do so”. Similarly, Abby Deshman, director of the criminal justice program of the Canadian Civil Liberties Association, notes that “undermines the confidentiality of the medical system, undermining patient care".
What data did they find? names, addresses and dates of birth of those with a positive diagnosis for the new coronavirus.
What was the response of the Windsor police? "Information on the portal was only accessed to help communicate information on the status of Covid 19 to first responders, strictly for the purpose of helping staff make informed decisions about whether to take additional precautions to prevent the spread of Covid 19 ".
According to Professor Pillay, the rationale given by the Windsor police is quite questionable, “seems like a very inefficient way to keep first responders safe. We know that Covid 19 is very contagious and infected people may appear asymptomatic”. As stated by Professor Pillay, there is not really a sufficient rationale to validate the need for access to such information by the police.
On the contrary, privacy experts point out that having access to this information identifies marginalized communities and generates distrust among neighbors, without taking into account the obvious concerns for the privacy of such people. Likewise, they express concern about the dissemination that the information that was accessed may have had, they question whether such information was entered into local records, or whether it is still accessible locally.
In this regard, it is important to bear in mind that the processing of personal data must follow certain basic principles, such as the principle of proportionality, in the sense that the treatment must be "adequate, relevant and not excessive" and the principle of quality , “Necessary, pertinent, adequate”. This analysis must be present before deciding the convenience of granting access to certain personal data, such access cannot be granted in a whimsical or unreasonable way, it must obey to logical and well-founded reasons, it is not possible to carry out data processing "just in case" , there must be a specific need identified, and the data processing must be able to satisfy it.