Regulatory, Advertising & Marketing 2020 Year in Review

On the regulatory front, 2020 was dominated by the government’s response to the pandemic. This included ensuring that Canadians had much needed personal protective supplies on an expedited basis, that any measures to contact trace for COVID-19 would have the privacy of Canadians in mind and that those rushing in to claim their products were cures and treatments for COVID-19 would be properly held in check. Below, we provide a brief survey of the developments throughout the year and where they stand now.

HEALTH CANADA TERMINATES INTERIM MEASURES FOR HAND SANITIZERS AND AN UPDATE ON THE REGULATORY MEASURES DEALING WITH COVID-19 MEDICAL DEVICES

At the start of the pandemic, there was an urgent need for products such as hard surface disinfectants, hand sanitizers and personal protective equipment, or PPE, such as face masks. These are regulated products that require market authorization from Health Canada prior to sale. The type of licence granted by Health Canada depends on the nature of the activity (i.e. manufacture, importation, sale etc.). The standard process to obtain authorization can take many months. To address product shortages, on March 18, 2020, Health Canada introduced interim measures to expedite access to disinfectants, hand sanitizers and medical devices which include PPE. The Interim Order (“IO”) provides for a streamlined regulatory process to authorize the importation or sale of medical devices used to diagnose, treat, mitigate or prevent COVID-19, while maintaining safety standards. The IO is set to expire on March 18, 2021.

In connection with hand sanitizers, under the interim measure, Health Canada permitted certain products to be sold in Canada that may not fully meet regulatory requirements, but do not compromise the safety of Canadians. There were 659 hand sanitizers accepted under the interim measure.

Due to the influx of new hand sanitizer products on the market, Health Canada had to increase its enforcement efforts to ensure public safety. Since June 2020, Health Canada recalled 137 hand sanitizer products because they failed to meet regulatory requirements such as, inclusion of prohibited ingredients, improper labelling, missing risk statements, lack of authorizations, and counterfeiting.

Owing to the stabilization of domestic supply, Health Canada recently announced that as of January 15, 2021, it is no longer accepting new notification forms for the exceptional release of hand sanitizers through the interim measure. Companies that wish to import or manufacture hand sanitizers must now use the standard process to obtain the relevant licence. However, companies with hand sanitizers previously accepted under the interim measure will still be able to import, manufacture and sell these products.

With respect to medical devices, on November 27, 2020, Health Canada stated that it planned to bring forward regulatory amendments to allow many of the flexibilities under the IO to continue after it expires. These transition regulations will ensure that medical devices authorized under the IO can continue to be sold, imported or distributed in Canada.

By way of background, medical devices include a wide range of health or medical instruments used in the treatment, mitigation, diagnosis or prevention of a disease or abnormal physical condition. Masks, including both surgical masks and N95 respirators (or particulate filtering face-piece respirators), which are designed to reduce the risk of inhaling hazardous airborne particles and aerosols, are categorized as Class I devices. Other products such infrared thermometers, gloves and syringes would be Class II devices, ventilators are Class III devices and COVID-19 test kits are Class IV devices.

One or two types of licences are needed from Health Canada to manufacture, import or distribute medical devices in Canada:

1. a Medical Device Establishment Licence, which is issued by the Medical Devices Bureau to the “establishment” or business who is engaged in activities relating to devices namely, their manufacture, importation or distribution (“MDEL”); and
2. a Medical Device Licence, which is issued by the Medical Devices Bureau for the device itself upon a review of evidence of their safety and efficacy (“MDL”).

Whether you need one or both of the above depends on the Class of device and the intended activity relating to the device.

A MDEL is issued to “establishments” or businesses upon certification that they adhere to good manufacturing practices, and quality protocols related to aftermarket oversight such as adverse event reporting and procedures for recall, if necessary. Holders of MDEL are subject to audits and investigation to ensure that the protocols to which they certified are actually in place. A MDEL is required to manufacture, import or distribute a device in Canada. However, certain entities are exempt from the need to hold a MDEL. For example, a manufacturer of a Class I medical device need not hold a MDEL if it imports or sells in Canada through an entity that does.

A MDL is required for Class II, III or IV medical devices and is issued upon review of evidence provided by the applicant concerning the safety and efficacy of the device. A Class I device does not need a MDL, however, it must be fit for its intended purpose.

Under normal circumstances, an application for a MDEL can take months. To help alleviate the shortages of medical devices for use in relation to COVID-19, Health Canada’s IO allows Health Canada to fast-track the necessary authorizations for the importation and sale of COVID-19 related devices. Companies wishing to import or sell COVID-19 medical devices can submit the MDEL Application Form and state that their request is urgent pursuant to the COVID-19 outbreak. A MDEL is granted on the basis of the importer or distributor certifying it meets all the protocols, including aftermarket oversight.

On November 27, 2020, Health Canada announced a twofold plan to deal with the pending expiration of the IO on March 18, 2021: (1) it plans to introduce a second Interim Order to allow COVID-19 devices authorized under the first IO to continue to be imported and sold to the Fall of 2021; and (2) it is developing transition regulations to take effect when the second Interim Order ends in the Fall of 2021 that would remain in place for 2 years to allow manufacturers, importers and distributors an opportunity to transition from a COVID-19 IO authorization to a “regular” MDL or MDEL. Health Canada is currently consulting with stakeholders to refine these two plans and indicated that it will likely release a guidance document this winter.

COVID-19 CONTACT TRACING APP LAUNCHED MID-2020, FEDERAL PRIVACY COMMISSIONER SATISFIED IT MEETS PRIVACY PRINCIPLES

On July 31, 2020, the federal government launched COVID Alert, a COVID-19 contact tracing and exposure notification app (see our overview of the app here). The Office of the Privacy Commissioner of Canada (the “OPC”) simultaneously published its privacy review of the app (the “OPC Review”).

On June 11, 2020, the Government of Canada informed the OPC of its intent to make a COVID-19 app available to Canadians. Since that time, the OPC has conducted various privacy assessments, including setting out several principles in a joint statement issued by federal, provincial and territorial Privacy Commissioners on May 7, 2020 (the “FPT statement”) and making preliminary recommendations about the app’s design to the Government of Canada on July 10. The OPC also received the June 19, 2020 privacy assessment conducted by Health Canada which reviewed the app’s design against the principles in the FPT statement (the “Privacy Assessment”).

The OPC Review considers the design of the app in light of the privacy principles set out in the FPT statement. Overall, the OPC is satisfied that the design of the COVID Alert app meets all these privacy principles and offers the following specific comments.

1. Consent and trust: The FPT statement noted that the app must be voluntary to build public trust and incorporate meaningful consent.

Consent for the app is sought using a privacy notice and notifications. While the OPC thought this information was written in clear and accessible language, it thought the claim that the data collected through the app was “private and anonymous” did not appropriately describe the risk of re-identification. The OPC thought the re-identification of users was improbable, but not impossible, and therefore, the use of the word “anonymous” is inaccurate. This compromises meaningful consent.

The OPC previously recommended that all references to anonymity should be removed from the Privacy Notice and notifications during the sign-up process. Health Canada and the Government of Canada accepted these recommendations and removed the references to anonymity in the current version of COVID Alert.

Recommendation: None

2. Legal Authority: The OPC agreed with Health Canada that s.4 of the Department of Health Act provides sufficient legal basis to establish Health Canada’s authority to operate the app.

The Privacy Assessment confirmed that the app does not collect personal information, but rather it uses randomly generated codes to alert users of possible exposure. According to the Government of Canada, the federal Privacy Act does not apply, and the use of randomly generated codes removes “serious possibility” of identification. While the OPC did not opine on the validity of the government’s position that the app is not subject to its privacy laws, it did state this is further cause for modernizing privacy laws so they effectively protect Canadian citizens.

Recommendations: The OPC offered recommendations to the Department of Justice, Health Canada, and the Government of Canada, including amendments to both the Privacy Act and the federal private-sector legislation, the Personal Information Protection and Electronic Documents Act (“PIPEDA”), to recognize that re-identification of personal information is always a possibility and to redefine “de-identified” information to allow for a more nuanced and targeted application.

3. Necessity and Proportionality: Assessing the principle of necessity and proportionality must be done in context. The OPC considered a variety of sources, including Health Canada’s response to the COVID-19 virus and the World Health Organization’s position on digital proximity tracking applications. The OPC also noted that, while developing the app, the Government of Canada made a conscientious effort to minimize the information required for the app to operate.

As a result, the OPC believes that, in this context, the governments of Canada and Ontario sufficiently demonstrated that the app is likely to be effective in reducing the spread of the virus. Additionally, it’s effectiveness will be closely monitored with any issues being addressed with the aid of an Advisory Council. Later this year, there will be a joint audit between Health Canada and the OPC that includes an analysis of necessity and proportionality.

Recommendation: The OPC recommends Health Canada make a commitment that the app will be decommissioned if shown not to be effective.

4. Purpose Limitation: The OPC is satisfied that Health Canada has established a clear and limited purpose for the app, namely to help reduce the spread of the virus; however, it notes there is a risk that third parties (including private sector companies) may compel individuals to use the app or to provide information from the app for reasons other than exposure notification.

Following the OPC’s preliminary recommendation to discourage such practices, a commitment was added to the draft Memorandum of Understanding (MOU) between the Government of Canada and the Province of Ontario to provide public messaging that individuals should not be required to use the app or disclose information about their use of the app. The OPC is of the view that this commitment will mitigate, but not eliminate, the risk of third parties forcibly making individuals use the app. It also notes that other countries have legislated to prohibit such practices.

Recommendation: As part of any upcoming reform, PIPEDA should be amended to make enforceable against third parties the voluntariness and purpose limitation principles.

5. De-Identification: The app does not collect or disclose any information that would directly identify the user. All data (in use and at rest) is protected by strong encryption techniques and cryptographic hashing functions. The contact matching process takes place on the phone with no personal data leaving the phone. However, a user’s IP address accompanies attempts to verify one-time codes to the server, which are retained for 60 minutes if the code is invalid. These IP addresses may be retained up to two years in certain circumstances, however, the OPC believes the risk of identification is low, and access to the logs is limited.

Recommendation: None

6. Time Limitation: Temporary exposure keys are deleted on the app after 14 days, and the app, along with all data stored on the Government of Canada servers, will be deleted 30 days after the pandemic is declared over. Although the duration of the pandemic is uncertain, clear time periods have been outlined by Health Canada for the use and retention of data collected.

Recommendation: None

7. Transparency: Health Canada and the Government of Canada have agreed to make the full Privacy Assessment publicly available. They have also made some technical information publicly available through GitHub and referred interested stakeholders to documents published by Apple, Google and Shopify. However, the OPC has not been able to sufficiently assess the interaction of the app with federal servers due to an inability to review the entire API code (designed by Google and Apple) which is not publicly available.

Recommendation: The Government of Canada should continually monitor the privacy risks associated with the API code designed by Apple and Google, and communicate with the public any potential privacy risk arising from the same.

8. Accountability: The accountability principle in the FPT statement emphasizes the importance of oversight by an independent third party to help reinforce public trust. The OPC will conduct a joint audit with Health Canada beginning in the fourth quarter of 2020; this will include assessment of respect for the FPT principles, and an ongoing analysis of the app’s effectiveness under the necessity and proportionality principle. Health Canada will also provide the OPC with regular reports on uptake, feedback on functionality, and the work of the Advisory Council.

Recommendation: None

9. Safeguards: The OPC believes the COVID Alert app has strong data encryption methods, and notes that access to data on the server is limited to classified staff. Draft versions of MOU between the Government of Canada and the Province of Ontario are being reviewed to ensure a “privacy-first” approach that does not give away the identity or location of the user unless for security purposes or when required by law. Additionally, there are requirements for Ontario to protect the one-time codes received by users. The app will also be decommissioned with all non-security related data deleted within 30 days of the pandemic being declared as “over”.

Recommendation: The Government of Canada should ensure that the MOU with the Government of Ontario includes the necessary safeguards to protect the privacy of users, and security of information through the app ecosystem.

Overall, the OPC review confirms that the governments of Canada and Ontario have sufficiently demonstrated that COVID Alert app will effectively reduce the spread of the virus, subject to monitoring for effectiveness. Third party circumvention of the voluntary nature of the app and its singular purpose is noted and larger legislative amendments are encouraged. The OPC was ultimately satisfied with the “exceptionally strong technical security safeguards” with respect to de-identification.

On August 20, 2020 the OPC published a “letter to shadow ministers”, an email written by the Privacy Commissioner of Canada in response to inquiries about the privacy implications of COVID Alert. The letter reiterated the OPC’s position in its review of the app. Additionally, the Commissioner re-iterated the concern for the “unintended consequences of proximity alerts” particularly, that third-party private sector organizations may seek information on user download and use of the COVID Alert app. The letter briefly referenced the ArriveCAN Application for travelers entering Canada. The OPC has consulted with the Public Health Agency of Canada (PHAC) and received a privacy compliance evaluation and had provided its recommendations. Information collected will be used and/or disclosed for the purposes of public health follow-ups and monitoring and verifying compliance with the Quarantine Act and the emergency orders made under it. The OPC is of the position that this disclosure is a necessary component of the Quarantine Act.

The OPC asserts that COVID Alert app and related technologies are an important element for achieving public health objectives during the pandemic. Design, use, and regulation of these technologies is paramount, and Canada ultimately requires “updated privacy laws that consider privacy in its full spectrum of rights and provide for effective enforcement and recourse.”

Finally, the letter reiterates the perceived weaknesses in our current privacy laws, particularly in light of effective protection in a digital environment, and advocates for the modernization of federal privacy legislation. The OPC notes that the Government of Canada chose to respect the principles set out in the various OPC guidance documents; however, because these guidance documents are not legal requirements in current Canadian privacy law, there is a risk that other programs and applications could be introduced in the future that are not as privacy-sensitive.

To date, COVID Alert has been downloaded over 6.1 million times, with nine provinces and territories on board. COVID Alert can help break the cycle of infection; however, the app is just one tool in Canada’s public health strategy. Everyone should continue to follow public health guidelines to stay safe, including physical distancing, wearing a face covering and washing their hands.

FALSE OR MISLEADING CLAIMS RELATED TO COVID-19

The toll of the economic and health crisis has been profound on Canadians, leaving people fearful and thus especially vulnerable to claims that products can treat or cure or mitigate the impact of COVID-19. This caused regulators to announce they would vigorously enforce against false or misleading claims relating to COVID-19.

On May 6, 2020, the Competition Bureau issued a press release warning businesses against false or misleading claims that their products and services can treat, prevent or cure the COVID-19 virus.

The Bureau stated that it is actively monitoring the marketplace and has already issued compliance warnings to businesses, including a major national retailer in British Columbia, Alberta, Saskatchewan, Ontario, Québec and New Brunswick to stop potentially deceptive claims. These claims included that herbal remedies and vitamins can prevent COVID-19 infections and that certain air sterilization systems can kill or filter the virus.

The Competition Act prohibits the making of false or misleading claims to promote a product, service or business interest. It also prohibits the making of unsubstantiated product claims. Section 74.01 (1) states:

A person engages in a reviewable conduct, who, for the purpose of promoting, directly or indirectly, the supply or use of a product or for the purpose of promoting, directly or indirectly, the supply or use of a product or for the purpose of promoting, directly or indirectly, any business interest, by any means whatever,

(b) makes a representation to the public in the form of a statement, warranty or guarantee of the performance, efficacy or length of life of a product that is not based on an adequate and proper test thereof, the proof of which lies on the person making the misrepresentation [emphasis added]

The Competition Act does not define what constitutes an “adequate and proper” test. Rather, the determination of whether a test is “adequate and proper” is made on a case by case basis following the consideration of such factors as the scope and nature of the claim, and whether the relevant industry gives any guidance on the manner of testing a particular product. The Competition Act does make it clear, however, that the testing must be completed prior to the representation being made and the onus of proving the adequacy and propriety of the test rests with the advertiser.

The Bureau’s press release followed an April 2, 2020 advisory from Jani Yates, the President of Ad Standards whose own Canadian Code of Advertising Standards mirrors Section 74.01(b) of the Competition Act. For example, Clause 1(e) of the Code states:

All advertising claims and representations must be supported by competent and reliable evidence, which the advertiser will disclose to Ad Standards upon its request. If the support on which an advertised claim or representation depends is test or survey data, such data must be reasonably competent and reliable, reflecting accepted principles of research design and execution that characterize the current state of the art. At the same time, however, such research should be economically and technically feasible, with regard to the various costs of doing business.

With respect to products such as drugs (hard surface disinfectants), natural health products (hand sanitizers depending on composition) and medical devices (COVID-19 test kits), the allowable claims are set by the market authorization granted by Health Canada. Health Canada has issued mechanisms to fast-track the approval of such healthcare products for importation and sale in Canada, such as the IO, discussed above. However, this does not mean there is a liberalization of allowable claims or the evidence supporting such claims.

Health Canada maintains a page on its website entitled “Health product advertising incidents related to Covid-19”. As of January 28, 2021 there are 432 entries of “resolved” and “ongoing” investigations. The page states that Health Canada takes urgent measures to protect consumers from illegal, false or misleading advertising of products claiming to mitigate, prevent, treat, diagnose, or cure COVID-19. These practices are deemed non-compliant with Canadian laws on advertising or marketing of health products. In furtherance of its commitment to transparency, Health Canada publishes the products, company names, and the advertising media (e.g. Amazon, Twitter, Etsy, companies’ Facebook page). Health Canada states that compliance and enforcement action has been taken, as required, as a result of the illegal, false or misleading advertising.