Canada's privacy commissioners offer guidance on COVID-19 contact-tracing apps

As New Brunswick and other provincial governments contemplate launching COVID-19 contact-tracing apps, privacy watchdogs from across the country have issued joint guidelines on what they are describing as an"extraordinary" measure, urging transparency and accountability.

"The choices that our governments make today about how to achieve both public health protection and respect for our fundamental Canadian values, including the right to privacy, will shape the future of our country," the federal, provincial and territorial privacy commissioners said in a statement Thursday.

The proposedapps, designed to help control the spread of COVID-19,detect and log when a user's smartphone is in proximity to other users. If auser later tests positive for the disease, the app notifiesthat person's close contactsso they know toself-isolate and watch for symptoms.

Such apps"raise important privacy risks," according to the privacy commissioners.

But "if done properly," they can achieve both privacy and public health goals, saidfederal Privacy Commissioner Daniel Therrien.

"Everything hinges on design, and appropriate design depends on respect for certain key privacy principles," Therriensaid in a statement.

The guidelines outline nine principles, including that use of the appsbe voluntary and separate consentbe given for all specific intended public health purposes.

Personal informationshould be "de-identified" when possible, must be used only for its intended public health purpose andshould not be accessible or compellable by service providers or other organizations.

Citizens should be fully informed about whatinformation willbe collected, how it will be used, who will have access to it, where it will be stored, how it will be securely retained and when it will be destroyed, as well as any associated risks, such as online fraud and malware.

Governments should evaluate and report onthe effectiveness of theirapp within a specific timeline. If its effectiveness can't be demonstrated, it should be decommissionedand all personal information, destroyed.

The privacy commissioners also recommendsetting a time limit. "When the crisis ends," the application should be decommissioned and all personal information, destroyed.

Proposed app aligns well

New Brunswick government officials did not respond to a request for an interview Thursday.

Premier Blaine Higgshas said the government is developing a voluntaryapp thatwould speed up the contact tracing process and could help reduce transmissions.

The province's privacy commissioner and ombudCharles Murray says it's "still a work in progress," but a demonstration is expected to be held for Higgs"within days."

Murray, who was briefed on the proposed app last week. said it's "more at the end [of the scale] that the privacy commissioners are signalling that they'd like to see."

"Some versions create a centralized database, which public health authorities can then use to track contacts. And that obviously raises concern about knowing who is in contact with other people and who is also in certain geographic locations at certain times," he said.

New Brunswick's proposedapp, as it was explained to him, "doesn't do those things.

"But that's not to say that that couldn't happen in the future," said Murray.

The province's version isn'ta "true contract tracing app," but rather anotification app, he said.

If an app user is diagnosed withCOVID-19, that person would begiven a code they can choose toinput toanonymously notifythe contacts logged on their phone that someonethey've recently been in close proximity to has tested positive.

No personal information or locations will be recorded, the data will be stored only on each person's phone, not a centralized database, and unique identifiers will be erased from the log after roughly two weeks when contact is no longer relevant to possible infection, as it was explained during the briefing, said Murray.

'So far, so good'

The province has beenreceptive to date about the importance of privacy in developing and implementing such an app, he said.

"If we were in a full blown outbreak like we've seen in New York and in other places you can see how at a time like that people might say, 'You know privacy is not the biggest thing on my mind right now. Right now, I'm trying to control a raging epidemic, which is locally surpassing the hospitals' capacities and posing a lethal risk for a population.'

"So what I can say is, so far, so good," said Murray.

"We all recognize in New Brunswick that this is not over. That there may be a number of waves. But we're in a position now where we have the advantage that our successful navigation of the first wave is giving us time to plan as opposed to just react."

He noted the effectiveness of any app to public health will be dependent on howmany New Brunswickers voluntarily decide to download it. "And if we want them to make an informed decision, transparency is absolutely essential to that process."

Murray said he expected Higgs to discuss contact-tracing apps during Thursday's conference with Prime Minister Justin Trudeau and the other premiers.

Ontario Premier Doug Ford has called for a national contact tracing strategy and intended to raise the issue. Trudeau, however, said on Radio-Canada talk showTout le monde en parlehe hasn't seen the right technology "so far."

Alberta was the first province to introduce a contract-tracing app, with the launch of itsABTraceTogetherlast week.

Newfoundland and Labrador, Manitoba and Saskatchewan have plans to develop their own.

Earlier this week aconsumer group, the Public Interest Advocacy Centre (PIAC) filed an application with the Canadian Radio-television and Telecommunications Commission (CRTC) requesting the telecom regulator oversee pandemic contact-tracing apps and network services that may be offered for Canadians to download to their smartphones.

"PIAC is seeking oversight, clarity and transparency from the CRTC so that Canadians know what role their mobile wireless service providers and home internet providers may play in COVID-19 tracking and that they appropriately safeguard privacy while not in any way impeding appropriate public health measures," executive director John Lawfordsaid in a statement.