Inaccurate, Unreliable, Dysfunctional: A Glimpse Into Ontario’s Now-Defunct COVID Database for Police

September 30, 2020

In the spring the Ontario government launched a database of COVID test results, with the aim of providing the personal information of the thousands of Ontarians who had tested positive for COVID directly to first responders – including police.  

From the outset CCLA and others had significant concerns about the utility of this privacy-invasive measure. People going for COVID tests were not asked for their consent to share their personal medical information. And we just couldn’t figure out how this information – which wouldn’t accurately identify those in the community who could transmit COVID – would assist police in responding to the pandemic. There were particular concerns about how sharing personal medical information directly with the police would impact those who are subject to systemic discrimination in their interactions with law enforcement and health care – including Black Ontarians, Indigenous persons, and those living with mental health issues and addictions.  

CCLA, along with our coalition partners, asked questions and got no answers. We then filed a lawsuit challenging the province’s decision to share this personal medical information with police. Shortly afterwards the Ontario government terminated the database – a solid win for privacy and equality.  

With the database shut down we discontinued our lawsuit – but we didn’t stop asking questions. After all, police had searched the database an astounding 95,000 times while it was operational. In August we sent dozens of letters to police services boards across the province. The answers have been trickling in, and we’re starting to get some insight into how, exactly, this database operated. 

It doesn’t look good. 

 As we suspected, it seems clear that the personal medical information that the province shared was pretty useless to first responders. As summarized by Guelph Police Service’s report, the province itself highlighted the many “weaknesses of the portal” in a memo to all Chiefs. The issues included, but were not limited to, the fact that: 

• It might take up to four days for test results to become available; 
• The information in the portal was only updated once a day and did not reflect real-time testing information; 
• Individuals who had tested positive may no longer have COVID-19; 
• Individuals’ addresses may have been recorded inconsistently; 
• An address for a multi-unit building may have had a positive case but not at the relevant unit; and 
• There may have been individuals at an address who did not reside there. 

The province in particular highlighted that “an individual who was included in the portal was never removed, even if they had subsequently recovered” and advised police to “continue to conduct point of interaction risk assessments and take other appropriate precautions when interacting with members of the public.” 

But the data wasn’t just limited – it was unreliable. The province told police services from the outset that the government couldn’t warrant the information in the database was complete, accurate, or up-to-date. Some, like the Toronto Police Service, early on flagged that there were “issues with the accuracy and reliability of the information in the Portal” and never used the database at all. This cautionary approach made good sense to us. How can you justify invading Ontarians’ medical privacy if the information you are using is incomplete and inaccurate?  

Toronto Police Service, however, was an outlier. Ultimately the majority of police services in the province did authorize access to the database. Those that did decide to forge ahead soon found that they weren’t getting entries that they thought should have been there. Several police services reported that information was entered inaccurately or inconsistently, frustrating attempts to call up relevant records. We got reports of police services resorting to querying the database multiple times for each call, using different search terms to try to obtain relevant test results. York Regional Police Service actually ended up writing to the provincial government to ask that their access to the database be revoked because their internal review found that the risks associated with accessing the personal health information outweighed any benefits of the poorly-designed database. 

Other services, however, ended up using privacy-invasive work arounds to try to get information from the portal. Multiple police service ran broad searches that called up a list of COVID test results for wide geographic areas. 

These broad searches were illegal. London Police Service, which was notified of six potentially improper searches, have come to the preliminary conclusion that their dispatch officers occasionally ran generic searches to confirm whether the portal was working at all. Guelph Police Service has suggested that its two instances of city-wide searches were inputted in error. But at least one service – Durham Regional Police – regularly used “wild card” searches as their primary search technique. These were open-ended search parameters that called up a large list of individual medical testing results, presumably done with the hope that some of the medical information might be relevant to the specific call at hand. Even after provincial audits called attention to the inappropriate searches taking place, Durham Regional Police continued to run unauthorized searches. Durham had its access to the database pre-emptively cut off by the province as a result.  

Finally, while most police services reported that they either did not record any health information locally or had already erased anything they had inputted, this process was not always straight forward. York Regional Police Service had to engage its third-party software provider to find a technological solution to erase the records from its local databases. And the Peterborough Police Service indicated that their local computer-aided dispatch database could not be altered – meaning they couldn’t delete two entries in their system that mention the results of their COVID database searches. These difficulties highlight the importance of “privacy-by-design” and ensuring that information technology and processes are properly planned upfront to ensure they facilitate, rather than frustrate, necessary privacy protections. 

Not all the information has come in. We’re still waiting on answers from over a dozen services. But what we’ve heard so far has reinforced our initial concerns about the legality of the government’s decision to share Ontarians’ personal health information. We’re glad the database was shut down. But you can be sure that, with a second wave of COVID upon us, CCLA will be watching the inevitable second wave of government responses closely.  

Curious about what your local police service has been up to? You can look at the number of times different services accessed the database here. And we’ve posted the substantive responses we’ve received to date – and who we haven’t heard from yet – below. 

 Substantive responses received to date 

• Barrie – received an email stating that the Barrie Police Service has “complied with Ministry direction”, no further information provided in response to follow up questions. 
• Belleville – Belleville Police Services Board advised by email that “Belleville Police Service has never kept any of the information obtained through the Ministry Portal.”  
• Brantford – we did receive a letter from Brantford Police Service, although it is not responsive to the questions we asked  
• Brockville – confirmed by email that “the Brockville Police Service did not download to a database or store any data related to any person’s Covid 19 status. The portal tool was utilized by the Brockville Police Service as it was designed in order to increase safety of officers attending calls for service. The police service discontinued its use at the discretion of the Province and no records exist to be accessed or deleted.”  
• Chatham-Kent – Letters 1 and 2 from Chatham-Kent Police Services Board 
• Cornwall – Letter from the Cornwall Police Service 
• Durham – Report from the Durham Regional Police Service 
• Gananoque – confirmed by email that “The Board has received confirmation from our Chief, Mr. Garry Hull, that an audit has been conducted on our records management system as well as hard copy files. We can report that there has been no retention of information that was previously obtained from the COVID 19 Portal.”  
• Guelph – Report from the Guelph Police Service 
• Kawartha Lakes – Letter from the Kawartha Lakes Police Services Board 
• La Salle – Report from La Salle Police Service 
• London – Letter from the London Police Services Board  
• Niagara – Letter from the Niagara Region Police Services Board  
• Ottawa – Report from the Ottawa Police Service 
• Peterborough – Report from the Peterborough Police Service  
• Sudbury – Letter from the Greater Sudbury Police Services Board 
• Thunder Bay – Report from the Thunder Bay Regional Police Service 
• Timmins – Letter from the Timmins Police Services Board  
• Waterloo Region – Letter from the Waterloo Regional Police Services Board and report from the Waterloo Regional Police Service  
• York Region – Report from York Regional Police Service 
• Sarnia – Sarnia Police Services Board advised by email that there was only one entry in the database and it was not downloaded. 
• Smith Falls – Letter from Smith Falls Police Service 
• St. Thomas – St. Thomas Police Service advised by email that no information was stored in local databases. 

No substantive responses received  

• Halton Police Service and Police Services Board 
• Hamilton Police Service and Police Services Board 
• Kingston Police Service and Police Services Board 
• North Bay Police Service and Police Services Board 
• Ontario Provincial Police and Ministry of the Solicitor General 
• Orangeville Police Service and Police Services Board 
• Owen Sound Police Service and Police Services Board 
• Peel Regional Police Service and Police Services Board 
• Sault Ste. Marie Police Service and Police Services Board 
• South Simcoe Police Service and Police Services Board 
• Stratford Police Service and Police Services Board 
• Strathroy-Caradox Police Service and Police Services Board 
• Windsor Police Service and Police Services Board 
• Woodstock Police Service and Police Services Board