Privacy commissioner has 'some comfort' with proposed COVID-19 contact-tracing app

New Brunswick's privacy commissioner and ombud says he has "some comfort" with the COVID-19 contact-tracing app the government is working on, as it was described to him during a conference call with officials Thursday.

But Charles Murray is quick to temperthat with the fact the appis still under development.

The proposed appwould detect and log when a volunteer user is in proximity to other users and notify them if that person later tests positive for the disease.

"It's fine to say, 'This is how we see it,'" said Murray. "But 10 days from now I may be sitting in a briefing having somebody say, 'Well, we tried to do it that way, but it turned out that wasn't feasible, so we did this instead.' And now I have concerns."

A demonstration of the appis expected to be held for Premier Blaine Higgs"and others"within 10 days, according to Murray. "Because at some point they have to make a go, no-go decision about it."

He says he has requested an opportunity to see the app before thento ask more questions and make recommendations.

"There will be some New Brunswickers who simply will not want to do this no matter how many reassurances they're given.Andthat's absolutely understandable and understood and that's fine.

"There will be others who honestly don't care about their privacy to that degree.They'd much rather have greater security about their health and so they'd be glad to take the app, no questions asked.

"So that's where I'm at on the thing right nowtrying to make a personal decision with the app and then trying to decide when I have the details, how will I communicate with New Brunswickers to help them make an informed decision, because it is their decision."

13 days withno new cases

Friday marked the 13th straight day with no new cases of COVID-19 in the province, Chief Medical Officer Dr. Jennifer Russell announced.

Of the total 118 confirmed cases to date, there are only two known active cases left and no one in hospital, she said.

But Russell expects a second wave of the virusrelated to travel or community transmission asPublic Health restrictions are graduallyloosened duringthe province'sfirst phase of recovery.

The idea behind the app is to speed up the contact-tracing process, reducethe number of possible transmissions and better controlthe spread, Higgstold CBC News earlier this week.

Murray was briefed on theapp during the call Thursday with Department of Health officials, members of the Executive Council and representatives of the privacy branch.

He says people would sign up and every user would be given a unique identifier when they download the app to their smartphone.

If the phones of app users "spend time in proximity" with each other, they would "basically do a sort of Bluetooth handshake."

The technical details of how long and how close the contact would have to be to log another app user's unique identifier are still being worked out, he said.

Bluetooth 'handshake'

But Murrayexpects it to be "longer than a few seconds" and within six feet, or two metres, to avoid situations where, for example,an app user driving by another app user's house would trigger a"handshake."

If one of the app users tests positive for COVID-19, that person would begiven a code to input and the systemwould notifyallthe contacts logged during a previous yet-to-be-specified period of time, he said, possiblytwo weeks, the estimated incubation period of the virus.

"So these people then receive a notification that someone who they've been in close proximity to over the last two weeks has tested positive, and [the system]provides them with information and encourages them to seek testing and provides them with, if you'd like,a fast lane to testing so that they can get tested to confirm their status."

No personal information or locations will be recorded, the data will be stored only on each person's phone, not a centralized database, and unique identifiers will be erased from the log after roughly two weeks when contact is no longer relevant to possible infection, as it was explained during the briefing, said Murray.

Dangers of shortcuts and good intentions

"There are always attractive other uses of data like this, which you say, 'Well if you are collecting this, gee, you'll be able to do X and Y,'" he said. "And [it was] clarified that no, there's no intention, and in a number of cases, no capability for the system to do that.That's reassuring to me with my privacy commissioner hat on."

It's critical to ensure the app is designed to protect the user's privacy, said Murray, because privacy violations are historically almost always about "shortcuts and good intentions."

"It's almost never about nefarious desires to violate people's privacy.It's about weighing that against something else in the expediency ofthe moment and in a situation of a public health emergency, which is what we're currently in, you can see the temptation is there to do that."

He said he doesn't see the potential for misuse in the app's current design, but will keep an eye on it.

2 'downstream concerns'

He notes the app, as proposed, requires the person who tests positive for COVID-19 to enter a code to activate the system to alert the other users.

"But you have to be prepared for the next argument which is, 'Well this person infected a whole lot of people, but they don't want to,for some reason, they haven't put that code in the app,' right?" he said.

"Because they think you know, 'Well maybe we should force it.' You know these are all things that become temptations when you have these tools at your fingertips."

Murray also noted the potential for two "downstream concerns."

"One is, have we missed something and do we have the capacity to notice that we've missed it and then to fix it afterwards?" he asked.

His second worry was that someone would try to expandthe app's capacity in the short term "when everyone's gotten used to it" to use it formore than just COVID-19 tracing.

"Again sometimes because people have the best of intentions and they have a greater degree of trust they go,'Yeah,that's fine. You know really, yes there's some risk here, but nobody would misuse that,'" said Murray.

"That's where the problems almost always occur is that second step. So that to me is where we're at."