Canada's privacy commissioners offer guidance on COVID-19 contact-tracing apps

As New Brunswick and other provincial governments contemplate launching COVID-19 contact-tracing apps, privacy watchdogs from across the country have issued joint guidelines on what they are describing as an "extraordinary" measure, urging transparency and accountability.

"The choices that our governments make today about how to achieve both public health protection and respect for our fundamental Canadian values, including the right to privacy, will shape the future of our country," the federal, provincial and territorial privacy commissioners said in a statement Thursday.

The proposed apps, designed to help control the spread of COVID-19, detect and log when a user's smartphone is in proximity to other users. If a user later tests positive for the disease, the app notifies that person's close contacts so they know to self-isolate and watch for symptoms.

Such apps "raise important privacy risks," according to the privacy commissioners.

But "if done properly," they can achieve both privacy and public health goals, said federal Privacy Commissioner Daniel Therrien.

"Everything hinges on design, and appropriate design depends on respect for certain key privacy principles," Therrien said in a statement.

The guidelines outline nine principles, including that use of the apps be voluntary and separate consent be given for all specific intended public health purposes.

Personal information should be "de-identified" when possible, must be used only for its intended public health purpose and should not be accessible or compellable by service providers or other organizations.

Citizens should be fully informed about what information will be collected, how it will be used, who will have access to it, where it will be stored, how it will be securely retained and when it will be destroyed, as well as any associated risks, such as online fraud and malware.

Governments should evaluate and report on the effectiveness of their app within a specific timeline. If its effectiveness can't be demonstrated, it should be decommissioned and all personal information, destroyed.

The privacy commissioners also recommend setting a time limit. "When the crisis ends," the application should be decommissioned and all personal information, destroyed.

Proposed app aligns well

New Brunswick government officials did not respond to a request for an interview Thursday.

Premier Blaine Higgs has said the government is developing a voluntary app that would speed up the contact tracing process and could help reduce transmissions.

The province's privacy commissioner and ombud Charles Murray says it's "still a work in progress," but a demonstration is expected to be held for Higgs "within days."

Murray, who was briefed on the proposed app last week. said it's "more at the end [of the scale] that the privacy commissioners are signalling that they'd like to see."

"Some versions create a centralized database, which public health authorities can then use to track contacts. And that obviously raises concern about knowing who is in contact with other people and who is also in certain geographic locations at certain times," he said.

New Brunswick's proposed app, as it was explained to him, "doesn't do those things.

"But that's not to say that that couldn't happen in the future," said Murray.

The province's version isn't a "true contract tracing app," but rather a notification app, he said.

If an app user is diagnosed with COVID-19, that person would be given a code they can choose to input to anonymously notify the contacts logged on their phone that someone they've recently been in close proximity to has tested positive.

No personal information or locations will be recorded, the data will be stored only on each person's phone, not a centralized database, and unique identifiers will be erased from the log after roughly two weeks when contact is no longer relevant to possible infection, as it was explained during the briefing, said Murray.

'So far, so good'

The province has been receptive to date about the importance of privacy in developing and implementing such an app, he said.

"If we were in a full blown outbreak like we've seen in New York and in other places you can see how at a time like that people might say, 'You know privacy is not the biggest thing on my mind right now. Right now, I'm trying to control a raging epidemic, which is locally surpassing the hospitals' capacities and posing a lethal risk for a population.'

"So what I can say is, so far, so good," said Murray.

"We all recognize in New Brunswick that this is not over. That there may be a number of waves. But we're in a position now where we have the advantage that our successful navigation of the first wave is giving us time to plan as opposed to just react."

He noted the effectiveness of any app to public health will be dependent on how many New Brunswickers voluntarily decide to download it. "And if we want them to make an informed decision, transparency is absolutely essential to that process."

Murray said he expected Higgs to discuss contact-tracing apps during Thursday's conference with Prime Minister Justin Trudeau and the other premiers.

Ontario Premier Doug Ford has called for a national contact tracing strategy and intended to raise the issue. Trudeau, however, said on Radio-Canada talk show Tout le monde en parle he hasn't seen the right technology "so far."

Alberta was the first province to introduce a contract-tracing app, with the launch of its ABTraceTogether last week.

Newfoundland and Labrador, Manitoba and Saskatchewan have plans to develop their own.

Earlier this week a consumer group, the Public Interest Advocacy Centre (PIAC) filed an application with the Canadian Radio-television and Telecommunications Commission (CRTC) requesting the telecom regulator oversee pandemic contact-tracing apps and network services that may be offered for Canadians to download to their smartphones.

"PIAC is seeking oversight, clarity and transparency from the CRTC so that Canadians know what role their mobile wireless service providers and home internet providers may play in COVID-19 tracking and that they appropriately safeguard privacy while not in any way impeding appropriate public health measures," executive director John Lawford said in a statement.