On the regulatory front, 2020 was dominated by the
government’s response to the pandemic. This included ensuring
that Canadians had much needed personal protective supplies on an
expedited basis, that any measures to contact trace for COVID-19
would have the privacy of Canadians in mind and that those rushing
in to claim their products were cures and treatments for COVID-19
would be properly held in check. Below, we provide a brief survey
of the developments throughout the year and where they stand
now.

HEALTH CANADA TERMINATES INTERIM MEASURES FOR HAND SANITIZERS
AND AN UPDATE ON THE REGULATORY MEASURES DEALING WITH COVID-19
MEDICAL DEVICES

At the start of the pandemic, there was an urgent need for
products such as hard surface disinfectants, hand sanitizers and
personal protective equipment, or PPE, such as face masks. These
are regulated products that require market authorization from
Health Canada prior to sale. The type of licence granted by Health
Canada depends on the nature of the activity (i.e. manufacture,
importation, sale etc.). The standard process to obtain
authorization can take many months. To address product shortages,
on March 18, 2020, Health Canada introduced interim measures to
expedite access to disinfectants, hand sanitizers and medical
devices which include PPE. The Interim Order (“IO”)
provides for a streamlined regulatory process to authorize the
importation or sale of medical devices used to diagnose, treat,
mitigate or prevent COVID-19, while maintaining safety standards.
The IO is set to expire on March 18, 2021.

In connection with hand sanitizers, under the interim measure,
Health Canada permitted certain products to be sold in Canada that
may not fully meet regulatory requirements, but do not compromise
the safety of Canadians. There were 659 hand sanitizers accepted
under the interim measure.

Due to the influx of new hand sanitizer products on the market,
Health Canada had to increase its enforcement efforts to ensure
public safety. Since June 2020, Health Canada recalled 137 hand sanitizer products because
they failed to meet regulatory requirements such as, inclusion of
prohibited ingredients, improper labelling, missing risk
statements, lack of authorizations, and counterfeiting.

Owing to the stabilization of domestic supply, Health Canada
recently announced that as of January 15, 2021, it is no longer
accepting new notification forms for the exceptional release of
hand sanitizers through the interim measure. Companies that wish to
import or manufacture hand sanitizers must now use the standard
process to obtain the relevant licence. However, companies with
hand sanitizers previously accepted under the interim measure will
still be able to import, manufacture and sell these products.

With respect to medical devices, on November 27, 2020, Health
Canada stated that it planned to bring forward regulatory
amendments to allow many of the flexibilities under the IO to
continue after it expires. These transition regulations will ensure
that medical devices authorized under the IO can continue to be
sold, imported or distributed in Canada.

By way of background, medical devices include a wide range of
health or medical instruments used in the treatment, mitigation,
diagnosis or prevention of a disease or abnormal physical
condition. Masks, including both surgical masks and N95 respirators
(or particulate filtering face-piece respirators), which are
designed to reduce the risk of inhaling hazardous airborne
particles and aerosols, are categorized as Class I devices. Other
products such infrared thermometers, gloves and syringes would be
Class II devices, ventilators are Class III devices and COVID-19
test kits are Class IV devices.

One or two types of licences are needed from Health Canada to
manufacture, import or distribute medical devices in Canada:

  1. a Medical Device Establishment
    Licence, which is issued by the Medical Devices Bureau to the
    “establishment” or business who is engaged in activities
    relating to devices namely, their manufacture, importation or
    distribution (“MDEL”); and

  2. a Medical Device Licence, which is
    issued by the Medical Devices Bureau for the device itself upon a
    review of evidence of their safety and efficacy
    (“MDL”).

Whether you need one or both of the above depends on the Class
of device and the intended activity relating to the device.

A MDEL is issued to “establishments” or businesses
upon certification that they adhere to good manufacturing
practices, and quality protocols related to aftermarket oversight
such as adverse event reporting and procedures for recall, if
necessary. Holders of MDEL are subject to audits and investigation
to ensure that the protocols to which they certified are actually
in place. A MDEL is required to manufacture, import or distribute a
device in Canada. However, certain entities are exempt from the
need to hold a MDEL. For example, a manufacturer of a Class I
medical device need not hold a MDEL if it imports or sells in
Canada through an entity that does.

A MDL is required for Class II, III or IV medical devices and is
issued upon review of evidence provided by the applicant concerning
the safety and efficacy of the device. A Class I device does not
need a MDL, however, it must be fit for its intended
purpose. 

Under normal circumstances, an application for a MDEL can take
months. To help alleviate the shortages of medical devices for use
in relation to COVID-19, Health Canada’s IO allows Health
Canada to fast-track the necessary authorizations for the
importation and sale of COVID-19 related devices. Companies wishing
to import or sell COVID-19 medical devices can submit the MDEL
Application Form and state that their request is urgent pursuant to
the COVID-19 outbreak. A MDEL is granted on the basis of the
importer or distributor certifying it meets all the protocols,
including aftermarket oversight.

On November 27, 2020, Health Canada announced a twofold plan to deal with
the pending expiration of the IO on March 18, 2021: (1) it plans to
introduce a second Interim Order to allow COVID-19 devices
authorized under the first IO to continue to be imported and sold
to the Fall of 2021; and (2) it is developing transition
regulations to take effect when the second Interim Order ends in
the Fall of 2021 that would remain in place for 2 years to allow
manufacturers, importers and distributors an opportunity to
transition from a COVID-19 IO authorization to a
“regular” MDL or MDEL. Health Canada is currently
consulting with stakeholders to refine these two plans and
indicated that it will likely release a guidance document this
winter.

COVID-19 CONTACT TRACING APP LAUNCHED MID-2020, FEDERAL PRIVACY
COMMISSIONER SATISFIED IT MEETS PRIVACY PRINCIPLES

On July 31, 2020, the federal government launched COVID Alert, a
COVID-19 contact tracing and exposure notification app (see our
overview of the app here). The Office of the Privacy
Commissioner of Canada (the “OPC“)
simultaneously published its privacy review of the app (the
OPC Review“). 

On June 11, 2020, the Government of Canada informed the OPC of
its intent to make a COVID-19 app available to Canadians. Since
that time, the OPC has conducted various privacy assessments,
including setting out several principles in a joint statement
issued by federal, provincial and territorial Privacy Commissioners
on May 7, 2020 (the “FPT statement“) and
making preliminary recommendations about the app’s design to
the Government of Canada on July 10. The OPC also received the June
19, 2020 privacy assessment conducted by Health Canada which
reviewed the app’s design against the principles in the FPT
statement (the “Privacy
Assessment
“).

The OPC Review considers the design of the app in light of the
privacy principles set out in the FPT statement. Overall, the OPC
is satisfied that the design of the COVID Alert app meets all these
privacy principles and offers the following specific comments.

1. Consent and trust: The FPT statement noted
that the app must be voluntary to build public trust and
incorporate meaningful consent.

Consent for the app is sought using a privacy notice and
notifications. While the OPC thought this information was written
in clear and accessible language, it thought the claim that the
data collected through the app was “private and
anonymous” did not appropriately describe the risk of
re-identification. The OPC thought the re-identification of users
was improbable, but not impossible, and therefore, the use of the
word “anonymous” is inaccurate. This compromises
meaningful consent.

The OPC previously recommended that all references to anonymity
should be removed from the Privacy Notice and notifications during
the sign-up process. Health Canada and the Government of Canada
accepted these recommendations and removed the references to
anonymity in the current version of COVID Alert.

Recommendation: None

2. Legal Authority: The OPC agreed with Health
Canada that s.4 of the Department of Health Act provides
sufficient legal basis to establish Health Canada’s authority
to operate the app.

The Privacy Assessment confirmed that the app does not collect
personal information, but rather it uses randomly generated codes
to alert users of possible exposure. According to the Government of
Canada, the federal Privacy Act does not apply, and the
use of randomly generated codes removes “serious
possibility” of identification. While the OPC did not opine on
the validity of the government’s position that the app is not
subject to its privacy laws, it did state this is further cause for
modernizing privacy laws so they effectively protect Canadian
citizens.

Recommendations: The OPC offered
recommendations to the Department of Justice, Health Canada, and
the Government of Canada, including amendments to both the
Privacy Act and the federal private-sector legislation,
the Personal Information Protection and Electronic Documents
Act
(“PIPEDA”), to recognize that re-identification
of personal information is always a possibility and to redefine
“de-identified” information to allow for a more nuanced
and targeted application.

3. Necessity and Proportionality: Assessing the
principle of necessity and proportionality must be done in context.
The OPC considered a variety of sources, including Health
Canada’s response to the COVID-19 virus and the World Health
Organization’s position on digital proximity tracking
applications. The OPC also noted that, while developing the app,
the Government of Canada made a conscientious effort to minimize
the information required for the app to operate.

As a result, the OPC believes that, in this context, the
governments of Canada and Ontario sufficiently demonstrated that
the app is likely to be effective in reducing the spread of the
virus. Additionally, it’s effectiveness will be closely
monitored with any issues being addressed with the aid of an
Advisory Council. Later this year, there will be a joint audit
between Health Canada and the OPC that includes an analysis of
necessity and proportionality.

Recommendation: The OPC recommends Health
Canada make a commitment that the app will be decommissioned if
shown not to be effective. 

4. Purpose Limitation: The OPC is satisfied
that Health Canada has established a clear and limited purpose for
the app, namely to help reduce the spread of the virus; however, it
notes there is a risk that third parties (including private sector
companies) may compel individuals to use the app or to provide
information from the app for reasons other than exposure
notification.

Following the OPC’s preliminary recommendation to discourage
such practices, a commitment was added to the draft Memorandum of
Understanding (MOU) between the Government of Canada and the
Province of Ontario to provide public messaging that individuals
should not be required to use the app or disclose information about
their use of the app. The OPC is of the view that this commitment
will mitigate, but not eliminate, the risk of third parties
forcibly making individuals use the app. It also notes that other
countries have legislated to prohibit such practices.

Recommendation: As part of any upcoming reform,
PIPEDA should be amended to make enforceable against third parties
the voluntariness and purpose limitation principles.

5. De-Identification: The app does not collect
or disclose any information that would directly identify the user.
All data (in use and at rest) is protected by strong encryption
techniques and cryptographic hashing functions. The contact
matching process takes place on the phone with no personal data
leaving the phone. However, a user’s IP address accompanies
attempts to verify one-time codes to the server, which are retained
for 60 minutes if the code is invalid. These IP addresses may be
retained up to two years in certain circumstances, however, the OPC
believes the risk of identification is low, and access to the logs
is limited.

Recommendation: None

6. Time Limitation: Temporary exposure keys are
deleted on the app after 14 days, and the app, along with all data
stored on the Government of Canada servers, will be deleted 30 days
after the pandemic is declared over. Although the duration of the
pandemic is uncertain, clear time periods have been outlined by
Health Canada for the use and retention of data collected.

Recommendation: None

7. Transparency: Health Canada and the
Government of Canada have agreed to make the full Privacy
Assessment publicly available. They have also made some technical
information publicly available through GitHub and referred
interested stakeholders to documents published by Apple, Google and
Shopify. However, the OPC has not been able to sufficiently assess
the interaction of the app with federal servers due to an inability
to review the entire API code (designed by Google and Apple) which
is not publicly available. 

Recommendation: The Government of Canada should continually
monitor the privacy risks associated with the API code designed by
Apple and Google, and communicate with the public any potential
privacy risk arising from the same.

8. Accountability: The accountability principle
in the FPT statement emphasizes the importance of oversight by an
independent third party to help reinforce public trust. The OPC
will conduct a joint audit with Health Canada beginning in the
fourth quarter of 2020; this will include assessment of respect for
the FPT principles, and an ongoing analysis of the app’s
effectiveness under the necessity and proportionality principle.
Health Canada will also provide the OPC with regular reports on
uptake, feedback on functionality, and the work of the Advisory
Council.

Recommendation: None

9. Safeguards: The OPC believes the COVID Alert
app has strong data encryption methods, and notes that access to
data on the server is limited to classified staff. Draft versions
of MOU between the Government of Canada and the Province of Ontario
are being reviewed to ensure a “privacy-first” approach
that does not give away the identity or location of the user unless
for security purposes or when required by law. Additionally, there
are requirements for Ontario to protect the one-time codes received
by users. The app will also be decommissioned with all non-security
related data deleted within 30 days of the pandemic being declared
as “over”. 

Recommendation: The Government of Canada should
ensure that the MOU with the Government of Ontario includes the
necessary safeguards to protect the privacy of users, and security
of information through the app ecosystem.

Overall, the OPC review confirms that the governments of Canada
and Ontario have sufficiently demonstrated that COVID Alert app
will effectively reduce the spread of the virus, subject to
monitoring for effectiveness. Third party circumvention of the
voluntary nature of the app and its singular purpose is noted and
larger legislative amendments are encouraged. The OPC was
ultimately satisfied with the “exceptionally strong technical
security safeguards” with respect to de-identification.

On August 20, 2020 the OPC published a “letter to shadow ministers“, an
email written by the Privacy Commissioner of Canada in response to
inquiries about the privacy implications of COVID Alert. The letter
reiterated the OPC’s position in its review of the app.
Additionally, the Commissioner re-iterated the concern for the
“unintended consequences of proximity alerts”
particularly, that third-party private sector organizations may
seek information on user download and use of the COVID Alert app.
The letter briefly referenced the ArriveCAN Application for
travelers entering Canada. The OPC has consulted with the Public
Health Agency of Canada (PHAC) and received a privacy compliance
evaluation and had provided its recommendations. Information
collected will be used and/or disclosed for the purposes of public
health follow-ups and monitoring and verifying compliance with the
Quarantine Act and the emergency orders made under it. The
OPC is of the position that this disclosure is a necessary
component of the Quarantine Act.

The OPC asserts that COVID Alert app and related technologies
are an important element for achieving public health objectives
during the pandemic. Design, use, and regulation of these
technologies is paramount, and Canada ultimately requires
“updated privacy laws that consider privacy in its full
spectrum of rights and provide for effective enforcement and
recourse.”

Finally, the letter reiterates the perceived weaknesses in our
current privacy laws, particularly in light of effective protection
in a digital environment, and advocates for the modernization of
federal privacy legislation. The OPC notes that the Government of
Canada chose to respect the principles set out in the various OPC
guidance documents; however, because these guidance documents are
not legal requirements in current Canadian privacy law, there is a
risk that other programs and applications could be introduced in
the future that are not as privacy-sensitive.

To date, COVID Alert has been downloaded over 6.1 million times, with nine
provinces and territories on board. COVID Alert can help break the
cycle of infection; however, the app is just one tool in
Canada’s public health strategy. Everyone should continue to
follow public health guidelines to stay safe, including physical
distancing, wearing a face covering and washing their hands.

FALSE OR MISLEADING CLAIMS RELATED TO COVID-19

The toll of the economic and health crisis has been profound on
Canadians, leaving people fearful and thus especially vulnerable to
claims that products can treat or cure or mitigate the impact of
COVID-19. This caused regulators to announce they would vigorously
enforce against false or misleading claims relating to
COVID-19.

On May 6, 2020, the Competition Bureau issued a press release warning businesses
against false or misleading claims that their products and services
can treat, prevent or cure the COVID-19 virus.

The Bureau stated that it is actively monitoring the marketplace
and has already issued compliance warnings to businesses, including
a major national retailer in British Columbia, Alberta,
Saskatchewan, Ontario, Québec and New Brunswick to stop
potentially deceptive claims. These claims included that
herbal remedies and vitamins can prevent COVID-19 infections and
that certain air sterilization systems can kill or filter the
virus.

The Competition Act prohibits the making of false or
misleading claims to promote a product, service or business
interest. It also prohibits the making of unsubstantiated
product claims. Section 74.01 (1) states:

A person engages in a reviewable conduct, who, for the purpose
of promoting, directly or indirectly, the supply or use of a
product or for the purpose of promoting, directly or indirectly,
the supply or use of a product or for the purpose of promoting,
directly or indirectly, any business interest, by any means
whatever,

(b) makes a representation to the public in the form of a
statement, warranty or guarantee of the performance, efficacy or
length of life of a product that is not based on an adequate and
proper test thereof, the proof of which lies on the person making
the misrepresentation [emphasis added]

The Competition Act does not define what constitutes an
“adequate and proper” test. Rather, the determination of
whether a test is “adequate and proper” is made on a case
by case basis following the consideration of such factors as the
scope and nature of the claim, and whether the relevant industry
gives any guidance on the manner of testing a particular product.
The Competition Act does make it clear, however, that the
testing must be completed prior to the representation being made
and the onus of proving the adequacy and propriety of the test
rests with the advertiser. 

The Bureau’s press release followed an April 2, 2020 advisory from Jani Yates, the President of Ad
Standards whose own Canadian Code of Advertising Standards mirrors
Section 74.01(b) of the Competition Act. For example,
Clause 1(e) of the Code states:

All advertising claims and representations must be supported by
competent and reliable evidence, which the advertiser will disclose
to Ad Standards upon its request. If the support on which an
advertised claim or representation depends is test or survey data,
such data must be reasonably competent and reliable, reflecting
accepted principles of research design and execution that
characterize the current state of the art. At the same time,
however, such research should be economically and technically
feasible, with regard to the various costs of doing business.

With respect to products such as drugs (hard surface
disinfectants), natural health products (hand sanitizers depending
on composition) and medical devices (COVID-19 test kits), the
allowable claims are set by the market authorization granted by
Health Canada. Health Canada has issued mechanisms to fast-track
the approval of such healthcare products for importation and sale
in Canada, such as the IO, discussed above. However,
this does not mean there is a liberalization of allowable claims or
the evidence supporting such claims. 

Health Canada maintains a page on its website entitled
“Health product advertising incidents related to
Covid-19”. As of January 28, 2021 there are 432 entries of
“resolved” and “ongoing” investigations. The
page states that Health Canada takes urgent measures to protect
consumers from illegal, false or misleading advertising of products
claiming to mitigate, prevent, treat, diagnose, or cure COVID-19.
These practices are deemed non-compliant with Canadian laws on
advertising or marketing of health products. In furtherance of its
commitment to transparency, Health Canada publishes the products,
company names, and the advertising media (e.g. Amazon, Twitter,
Etsy, companies’ Facebook page). Health Canada states that
compliance and enforcement action has been taken, as required, as a
result of the illegal, false or misleading advertising.

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.