Digital contact tracing for restaurant patrons raises questions about privacy

A contact tracing program developed in Nova Scotia that has made logging restaurant patrons' information during the pandemic as easy as sending a text is raising questions about how thatdata is being stored and what people can do to protect their privacy.

For the past several months, Dartmouth marketingcompany SimplyCast has been working with theRestaurant Association of Nova Scotia (RANS) and the province's health authority on a contactless check-in program.

"It's more efficient, it takes less time," saidGordon Stewart, executive director of RANS.

Instead of having staff members manually jot down the names of customersas they enter the business, the SimplyCast program asks patrons to text a unique passphrase created by the restaurant to 11011to confirm their attendance.

If the customer doesn'thave a cellphone, they areasked to fill out a digital form with their name and phone number for contact tracing purposes.

Contact tracing is used to identify and manage people who've been exposed to COVID-19 to prevent further spread.

Although the new system might make things easier forPublic Health officials and restaurants, a Halifax-based data consulting and analysis firm said users should askabout what's happening to their information once it's been provided.

Kevin D'Aguiar,owner of Matters of Data,saidSimplyCast has the capability and tools already in place to collect thedata and use it for marketing.

He said he was unable to find reassurance on SimplyCast's website that the information collected through the program won't be shared or sold.

"I recommend that they [SimplyCast]state really clearly that the data will not be used for anything other than contact tracing because at the end of the day, if you're being forced to share data that will end up being used in a non-transparent way by a company to increase their revenue, there could be a real issue there," he said.

SimplyCast's founder and CEO, Saeed El-Darahali, saidhe understands the concerns people might have when it comes to protecting their private information, but in this case it's a non-issue.

He said there are three levels of protection for the information that's collected.

Firstly, El-Darahali said only one employee at SimplyCast has access to the data.Otherwise, onlyPublic Health officials are able to access the database where the information isstored. Additionally, every time the data is accessed, a log is created with the time and date of access.

The second level of protection involves actually encrypting the data, meaning converting the information so that it's unreadable.

"God forbid an outbreak or some form of a leak was to happen, anyone gathering that information or even recording itwould not be able to decipher that into a phone number or a name," said El-Darahali.

He saidthe final step to protecting the data is ensuring only Public Health officials are given the code todecipher the encrypted data. The information is stored for 41 days before it is deleted.

Stewart saidthere was never any intention of using the SimplyCastprogram for marketing.

David Fraser, a privacy lawyer in Halifax, said this kind of contact tracing compared to the pen and paper versionlessens the chances that someone's personal informationwill be lost or misused.

However, he said peopleshould always be careful when giving out their personal information considering the slew of scams happening during the pandemic.

He recommends ignoring unexpected or unsolicited textsand emails that askforpersonalinformation because they are more than likely a scam.

"I've even heard about people [outside Canada]getting text messages being told to sign up for their COVID vaccination appointment and are then prompted to enter their full name, date of birth and social insurance number,and that's exactly what an identity thief needs to compromise your identity," said Fraser.

El-Darahalisaid thecheck-in program is still evolving. The program was born in 2013 as a way to help transit users find out when the next bus was coming.

He said the company isalways open to receiving feedback from the public when it comes to increasing its transparency. He saidtheyplan on updating the check-in program and their websiteto reflect that.

"At the end of the day, we didn't think of a pandemic10years ago when we created this solution, so all we're trying to do is help the public and help our government ensure that we stay safe," he said.