Michael Geist explains why he has installed the Canadian government’s COVID App on his phone, despite the privacy concerns such government tracking apps present:
The Canadian COVID Alert app is ultimately as notable for what it doesn’t do as for what it does. The voluntary app does not collect personal information nor provide the government (or anyone else) with location information. The app merely runs in the background on an Apple or Android phone using bluetooth technology to identify other devices that come within 2 metres for a period of 15 minutes or more. Obviously, the distance and timing are viewed as the minimum for a potential transmission risk. If this occurs, a unique, random identifier is stored on each person’s device for a period of 14 days. After the 14 day period, the identifier is deleted from the device.
The identifier does not identify a specific person or location information, and is not sent to any centralized database. If a person tests positive for the virus, they are given a key code to input into the app. Once the key code is inputted, anyone that was identified as being potentially exposed over the prior 14 days receives a notification that this has occurred and they should consider testing and/or self-isolating.
From a privacy perspective, this is very low risk. Indeed, the government’s position – confirmed in the Privacy Commissioner of Canada’s analysis – is that there is no collection of any personal information and therefore the Privacy Act does not apply. The Privacy Commissioner rightly points out this raises some concerns about the state of the law (arguing it should be sufficiently robust to allow for reviews of this kind), however, the use of random identifiers ensures that identification of individual is very unlikely. Moreover, the Privacy Commissioner’s review concludes that “there are very strong safeguards in place” with security of the data, commitments limiting use, independent oversight, and a pledge to de-commission the app (including deletion of all data) within 30 days of the Chief Public Health Officer of Canada declaring the pandemic over.
The Ontario Information and Privacy Commissioner was also engaged in the review process. Her recommendation letter points to commitments for potential ongoing issues, including ensuring that the app is effective, that there is monitoring of third party components such as the Google-Apple Exposure Notification System, and public transparency associated with the app and its use.
While the app passes legal muster, its introduction reinforces the problems with social inequities that COVID-19 has laid clear. Much like the connection between socio-economic status and infection risk, the app itself is only accessible to those who can afford newer Apple and Android devices. That obviously means that those with older phones or no wireless access at all are unable to use it. While I don’t think that is reason to abandon the initiative, the government should be exploring alternatives to allow all citizens to implement these safeguards.
