By Alisha Gauhar, Rebecca Babcock and Jennie Phillips
On July 31st 2020, the Government of Canada announced the release of its national COVID-19 exposure notification application: COVID Alert. Currently in use in Ontario, New Brunswick, Saskatchewan, and Newfoundland and Labrador, the app is the result of a collaboration between public entities including: Health Canada; the Canadian Digital Services; the Province of Ontario; Innovation, Science, Economic Development Canada; and the Canadian Centre for Cyber Security. Also working on this initiative are private entities including Shopify, the Linux Foundation Public Health, and BlackBerry.
What is Digital Contact Tracing (D-CT)?
The purpose of the COVID Alert app is to enable Digital Contact Tracing (D-CT) (or exposure notification as the app is framed by the Canadian government). D-CT is an increasingly popular method to track the spread of the COVID-19 virus around the world. Performed mostly through mobile apps, it is a process by which mobile devices are used to map interactions with other individuals and alert users of the app if they have been in contact with a person who has been diagnosed with COVID-19. The method by which this mapping of interactions occurs, how data is stored, and how people are being notified can vary from country to country.
According to the Government of Canada, the app functions using bluetooth-proximity tracing. The app generates arbitrary codes in five minute intervals and broadcasts them to other devices that have the app and have maintained a 2 metre distance for a duration of at least 15 minutes. The user’s device will maintain a list of all codes received from other devices for fourteen days after which they are deleted. If the user has tested positive for the Coronavirus, they will be given a one-time key to enter into the app. COVID Alert will then inform users who have been in close contact with the infected user (meeting the criteria of 2 metres apart for 15 minutes or longer) over the past 14 days to contact their local public health authority for guidance.
(Photo/Apple App Store)
What is the Benefit of Downloading the App?
The main benefit of using the COVID Alert app is that it identifies who has come into contact with people who have tested positive with the virus without their knowledge. The app aids those who have tested positive to identify their most recent interactions (with known and unknown individuals), thereby preventing recall errors and setbacks in informing contacts that occur with traditional manual contact tracing, while also assisting to identify positive cases faster. Although the app is currently being used in select provinces, the plan is to implement the app Canada-wide. Having a nation-wide app provides the added benefit of interoperability across provinces for individuals that are crossing provincial borders such as health care personnel, truck drivers, and other essential workers who have been encouraged to download COVID Alewrt and the cross-border essential workers app ArriveCan.
But What About Privacy?
During the COVID-19 pandemic, privacy has risen to the forefront of discussion on digital contact tracing amongst many practitioners, academics, social media outlets, and the general public. It is one of the most critical concerns associated with developing and implementing digital contact tracing applications. There are concerns for instance, that data collected via the application may be used without consent, potentially being sold to third parties or being used for law enforcement purposes such as carding which can disproportionately impact already vulnerable populations. Another concern regarding the app is user location information being tracked. People are worried that having their location on all the time would mean their whereabouts are constantly being kept track of, thereby causing fears of increased surveillance of citizens and surveillance creep.
Given that privacy is a human right and that health data requires a particularly high degree of confidentiality, ensuring safeguards are in place to protect personal data are essential. In Canada, to enforce efforts to uphold privacy standards, the Privacy Commissioner of Canada and Ontario have been heavily involved during the security background checks of the app. Furthermore, according to the Government of Canada website, the COVID Alert app does not use GPS technology to track location and information regarding a user’s name, health information, or address is not stored or shared. COVID Alert ensures complete anonymity of those using the app and is free to download and use. The app is also completely voluntary to download and can be deleted at any time. However, the Canadian government has mentioned that the COVID Alert app does store your IP address on a server as a security measure. These addresses would be used by law enforcement officials to trace hacks and other malicious activity but under normal circumstances, this data is only kept for three months.
Despite the precautions taken by the Government of Canada and the praise the application has received from privacy experts, it is crucial to note that no data in the digital realm is ever completely secure; inherent privacy risks will continue to exist. Malicious actors for example, can hack the system and subsequently release/sell confidential information or use the user’s medical information to buy prescription drugs or file false insurance claims. In the above example, should someone’s identity be exposed they are at risk of experiencing discrimination, stigmitization, harrassment, or other forms of harm. Furthermore, since there is currently no legislation in Canada to 1) dictate the application’s lifespan, and 2) protect data collected by the app both during and after the pandemic, there is a risk not only of surveillance creep but that governments or corporations may attempt to leverage users’ data. As a final concern, cell phone companies may also share data with government officials and third parties. Bell Canada for instance, have said they are “willing to share personal information with governments if called upon” in regards to the COVID-19 response. Despite COVID Alert’s privacy centric policy, there is no real control over how (and to what extent) personal data collected by corporations such as mobile companies is used.
In saying that, while privacy risks have been one of the main concerns in regards to exposure notification apps, it would seem that the privacy risks associated with the exposure notification application are similar to, or lower than, many of the other risky privacy-related behaviours individuals engage in. For instance, people do not hesitate to geotag their Facebook or Instagram posts and many individuals are largely unaware of the extensive amount of data that is collected by third parties with everyday use of their phones. Furthermore, while lack of trust in the government in some regions has caused individuals to be quite concerned about privacy, this worry has spread to other communities where there may not be such a cause for alarm.
—
Header Image Source: THE CANADIAN PRESS/Ryan Remiorz; Retrieved from https://www.ctvnews.ca/health/coronavirus/covid-19-exposure-notification-app-now-available-1.5046868