In the fight to combat the spread of COVID-19, governments throughout the world have been considering the use of digital contact-tracing apps. Contact-tracing apps seek to interrupt the onward transmission of the coronavirus by identifying and notifying recent contacts of an infected person in an anonymous fashion. Privacy issues have been central to the considerations of how such technology should be implemented to achieve this important public health objective with the least impact on the privacy of individuals.
In some digital contact-tracing systems, location and identity information may be sent to a central system for analysis, most often operated by a government health organization. In others, the systems are decentralized, where the users obtain information and are invited to update their COVID-19 health status (positive test results, for example). This decentralized contact-tracing technology is generally described to work as follows:
The Canadian federal government has yet to release its formal position on the use of contact-tracing apps, but certain provinces (Alberta, Newfoundland and Labrador) have already moved toward the use of this technology on a voluntary basis. Alberta has developed the ABTraceTogether App, a voluntary app that can be downloaded to one’s personal device. Details on privacy safeguards are available on the Alberta government website. Key provisions of the privacy safeguards include the following: only random anonymized user ID and other de-identified data will be used; consent can be withdrawn at any time; and logs used for contact tracing are only stored for 21 days. A number of technology and security issues have been raised in respect of the ABTraceTogether App, slowing its adoption. An updated version is expected soon.
The government of Newfoundland and Labrador has indicated that it intends to offer a voluntary contact-tracing app but the app has not yet been made available.
Federal, provincial and territorial Privacy Commissioners issued a Joint Statement last week to Canadians regarding the use and implementation of contact-tracing apps given the "important privacy risks" raised by such technology. The Commissioners state that some applications of the technology do not provide an effective level of protection. The use of location data is specifically identified as a privacy concern. The Commissioners set out the principles to be respected in the implementation of the technology:
This Joint Statement follows the April publication by the Office of the Privacy Commissioner of Canada of an assessment framework intended to assist government institutions with responding to the COVID-19 crisis. The April assessment framework set out the same principles as those above to guide the government in the assessment of measures proposed to combat COVID-19 and that have an impact on the privacy of Canadians. It is these same principles that form the backbone of the federal privacy legislation and provincial privacy legislation.
Similar direction has been issued by European Data Protection Commission which recently published guidance for EU governments that set out features and requirements that the contact-tracing apps should meet to ensure compliance with EU privacy and personal data protection legislation. Key features identified are the need for people to have certainty that the apps will be used only for the specifically defined purposes, and will not be used for mass surveillance.
The UK Information Commissioner has issued an opinion on the Apple-Google joint initiative on contact-tracing technology. In the written opinion, the Commissioner states that the proposed technology is "aligned with principles of data protection by design and by default." She notes, among other things, that the app only generates a limited amount of data, and the tokens are not associated with any other data that could be used to identify or locate the device user. The Commissioner sets out similar principles to those outlined by the Canadian Commissioners and by the European Data Protection Commission to be respected with the implementation of this technology, including data minimization, as well as transparency and user control.
There have been a number of contact-tracing apps developed or proposed in various jurisdictions. All have come under scrutiny by privacy advocates and regulators. In some parts of the world (such as Indonesia, China, South Korea, Taiwan, India and Norway), governments have already implemented contact-tracing apps. India has made use of a mandatory contract-tracing app for civil servants. In Australia, a voluntary contact-tracing app is currently being finalized by the government.
While some governments have implemented a contact-tracing app without the use of the Apple-Google technology, several are adopting it in place of alternatives. Without the Apple-Google technology, apps built by governments apparently have limitations. For example, one limitation identified is that the phone's screen has to be unlocked for the app to work properly raising a number of technology and security concerns. Germany recently changed course over which type of technology to use, choosing to proceed with the Apple-Google technology. An increasing number of European countries are likewise opting for an approach that incorporates the Apple-Google technology.
The COVID-19 pandemic presents unprecedented issues, which necessarily involve privacy considerations. In this manner, the pandemic has forced innovation and data protection to coexist. While governments roll out the implementation of this technology, it is clear that privacy regulators and commissioners around the world will be watching. For more information on COVID-19 and privacy-related issues, please visit the Bennett Jones COVID-19 Resource Centre.