Protecting privacy

At the Public Health Agency of Canada (PHAC), we collect and analyze data to help us:

• solve public health problems
• create programs and policies that will improve community health

Understandably, people want to know how their data is used and protected in our digital world. Privacy and security requirements are part of all PHAC initiatives. We always take steps to protect your privacy and handle data according to the Privacy Act and federal privacy policies.

To protect your privacy, we:

• monitor and control access to secure systems that house data
• remove direct personal identifiers, such as your name, address or health card number from the data before using or sharing it
• set up formal agreements with clear rules for how data can be used or shared
• complete privacy assessments to identify and reduce privacy risks, and ensure data meets the requirements in the Privacy Act and related federal policies
• report and respond in the event of a privacy breach

Examples of completed privacy impact assessments are available at Privacy and the Public Health Agency of Canada.

PHAC must follow the Values and Ethics Code for the Public Sector. This means employees are expected to uphold values such as responsible stewardship, integrity, and respect for laws and policies, which includes proper handling of personal information.

Example: National Wastewater Surveillance Program

Wastewater data is a key part of COVID-19 surveillance in Canada. Samples of sewage are collected at the community level by partners such as municipalities, provincial governments and universities. These samples are sent to the National Microbiology Lab (NML) for analysis.

Wastewater surveillance methods protect the privacy of the communities where the samples are collected. Once water is mixed at a community level, it can't be accurately separated again. This makes it highly unlikely that individual households could be identified.

To do this, we ensure that all data is sent and stored securely through encryption. Only authorized employees can access the data. The NML has agreements at the community level about the data they can collect, analyze and share.