The federal government recently announced that it has chosen a digital contact tracing application to recommend across the country, expected later this summer. In his press conference on June 18, 2020, Prime Minister Justin Trudeau indicated that the federal government “worked with” the federal Privacy Commissioner in bringing this forward. However, the Privacy Commissioner’s office has not yet had access to the app in order to analyze it. The government is not starting on the right foot, and we are highly concerned this lack of accountability and transparency may result in misuse of personal information and lack of public trust. 

Since discussions first arose around the use of contact tracing applications in Canada, the BCCLA has had significant concerns about the impact these applications could have on the privacy rights of people living in Canada. Contact tracing applications have not proven to be effective, and this type of digital surveillance has the potential to erode privacy rights both during and long after the pandemic.

Of the over 200 applications rolled out in over 30 countries around the world, there are no clear examples of where contact-tracing applications have actually been effective – at least not as a standalone. Without proven effectiveness, it is difficult to demonstrate that this measure is necessary and proportionate – necessary for a specific purpose, tailored to that purpose, and likely to be effective – even in the context of a pandemic.

Contact-Tracing App: Option of Last Resort

In April, the BCCLA, alongside Open Media, BC Freedom of Information and Privacy Association, International Civil Liberties Monitoring Group, and the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic) issued a joint statement urging the Canadian government to only adopt surveillance-based measures where demonstrably necessary and as a last resort. If a decision were made to adopt a contact tracing application, we advised them to follow these seven principles.

With Prime Minister Trudeau’s announcement that a nation-wide application will be launched soon, we reiterate our concerns around contact tracing applications and strongly urge the federal government and provincial health authorities to adhere to, at a minimum, the principles issued by the privacy commissioners in early May. Adherence to these principles is critical because, as the privacy commissioners have pointed out, our “current privacy laws do not provide an effective level of protection suited to the digital environment.”

The collection of highly sensitive personal information, coupled with the lack of legal protections and unproven effectiveness of contact tracing applications, is extremely worrisome.

This worry is compounded by the way the federal government is rolling out the application. Trudeau made his announcement before the Canadian privacy commissioner received any of the necessary information to analyze or provide recommendations. To date, no privacy impact assessment has been completed either. The privacy commissioner’s review of the application and monitoring of its implementation is critical to ensure the federal government remains accountable for the collection of this highly sensitive information.

Sufficient accountability can only be achieved through independent oversight of the contact tracing application from the development phase through implementation, and such monitoring should include recourse for breaches, misuse, and violation of rights.

Any App Must be Voluntary, Require Meaningful Consent & Protect Data

Although the application is being touted as voluntary, the application should remain truly voluntary. Third parties should not have the ability to mandate that an individual download the application. When accessing public sector services or engaging in private sector activities like working, grocery shopping, or flying, no entity should require that an individual have downloaded the application as a condition for access or entry. If it is a requirement to have downloaded the application, then the application would not truly be voluntary. This would be an unjust infringement of individual privacy rights. This type of requirement could also lead to a discriminatory impact on marginalized individuals who may not have a cell phone.

The contact tracing application also needs to provide individuals with the opportunity to provide meaningful consent. This means that the consenting individual knows what, why, how, when, and where their personal information will be collected, used, accessed, disclosed, and stored. Consent should not be a one-time occurrence, where individuals agree to the terms and conditions and privacy policy at the outset but can be unilaterally changed by the tech provider without further notice to the user. There should also be separate consents for each specific public health purpose, meaning not just one blanket consent for the government to use the data for public health or research purposes. If the government wanted to collect information for any public health reason beyond contact tracing in the context of the pandemic, then express consent should be required from individuals. For example, in the context of the Ontario contact tracing application, health officials already mentioned the possibility of creating a contact tracing app that could later be used by the healthcare sector to follow-up and send prompts to people suffering from chronic physical conditions.

The fear of the slow creep goes beyond meaningful consent. Once collected, governments may find it tempting to share it with other agencies like law enforcement or immigration enforcement. Data collected in the context of a public health emergency should absolutely not be shared with any other agency for any purpose. We need to ensure this to avoid the slow creep, where data originally collected for one purpose is later used for another purpose, especially if this includes linking with other databases. We need to avoid indefinite government mass surveillance. Any data collected in the application should be firewalled so that it is not accessible by service providers or other organizations.

There needs to be strict limits on the collection, use, disclosure, and retention of personal information. The government needs to ensure that only the minimal amount of data required is collected, that it is stored on individuals phones rather than a centralized database, and deleted as soon as it is no longer necessary for the purpose of the pandemic. Key questions to answer include: Once data is collected, who will have access to it? What can they do with it? Can it be shared with private companies or government agencies like law enforcement? Can it track who people visit and possibly use that information against people? Can it be used to identify how people congregate? Will the data be linked to other databases?

These are important questions to answer before any nation-wide app is rolled out. The public and independent oversight agencies need to be meaningfully consulted in an accountable and transparent process to ensure the privacy rights of people living in Canada are protected. The BCCLA will continue to closely monitor the implementation of any contract-tracing application and advocate against invasive digital surveillance.