Canadian privacy watchdogs support COVID-19 exposure app

CTV National News: Quebec opts out Quebec will not be endorsing the federal government's COVID-19 contact tracing app over privacy concerns. Genevieve Beauchemin has more.

TORONTO — Federal and Ontario privacy commissioners have concluded their review of the country’s new COVID-19 exposure notification app and say they support its use following initial privacy and security concerns.

Experts and lawmakers have been assessing privacy concerns associated with contact tracing apps in an effort to curb the spread of the virus, and commissioners say that the federally developed app has met all of their recommendations.

COVID Alert was launched in Ontario on Friday, and already has more than a million downloads.

“Canadians can opt to use this technology knowing it includes very significant privacy protections,” says Daniel Therrien, Privacy Commissioner of Canada in a statement released Friday. “I will use it.”

The app is designed to notify users when they’ve been in close contact with someone who has tested positive for COVID-19.

However, it does not track a user’s location itself, or use GPS.

Instead, the app produces random codes, and uses Bluetooth to ping other users’ phones and exchange these codes whenever two people who have the app are physically near one another.

“They kind of handshake electronically,” Carmi Levy, a technology analyst, explained to CTV News Channel on Monday.

This means that if a person with the app reports that they have COVID-19, the app can send a notification to anyone who came close enough to that person to receive the specific code within the last 14 days.

“It gives you awareness of when you’ve crossed paths with someone when it’s problematic,” Levy said, which can let a person know that they “might want to head for the testing centre.”

According to the Government of Canada’s website page on the app, “nobody will get any information about you or the time you were near them.”

For months, privacy watchdogs have been sounding alarms regarding potential security risks associated with contact tracing apps, as other nations look for ways to curb new infections.

Privacy commissioners across Canada issued a joint statement in May advising their respective governments of key privacy principles needed to protect the identity of users and their data.

The use of the app is voluntary and commissioners say it has been developed with robust safeguards; however, they also noted the risk of third parties who may seek to compel the app’s users to disclose information.

The federal government has agreed to involve the Office of the Privacy Commissioner of Canada (OPC) in an audit of the app after it is up and running, though no official details have been announced. The audit will include an ongoing evaluation of the app’s effectiveness and security measures.

In the meantime, several Twitter users have pointed out that the app asks for far less access to a users’ phone and private data than apps such as Facebook and TikTok.

Michael Geist, a law professor at the University of Ottawa and the Canada Research Chair in Internet and E-commerce Law, wrote a blog post on Sunday explaining why he was in favour of the app -- and why he himself had already downloaded it.

“The Canadian COVID Alert app is ultimately as notable for what it doesn’t do as for what it does,” Geist wrote. “The voluntary app does not collect personal information nor provide the government (or anyone else) with location information. The app merely runs in the background on an Apple or Android phone using bluetooth technology to identify other devices that come within 2 metres for a period of 15 minutes or more.”

He added that, “from a privacy perspective, this is very low risk.”

He said that he was persuaded to download the app onto his own phone by the privacy safeguards in combination with the public health benefits of having the app.

“The relative ineffectiveness of contact tracing apps elsewhere surely influenced the decision to adopt an exposure notification app which raises fewer privacy concerns and is more effective for its limited goal of notification rather than tracing,” he wrote.

Contact tracing apps in other countries have largely had a rocky reception. An app used in Norway called “Smittestopp” was pulled after a wave of criticism over its use of GPS data and real-time tracking of its users. The company behind that app also developed apps in use in Bahrain and Kuwait. Amnesty International’s Security Lab has urged those countries to cease using those apps.

Although experts are saying the app doesn’t raise privacy concerns itself, discussions between the OPC and federal government have pointed out broader issues related to the adequacy of Canada’s privacy laws.

A statement from the OPC asserts that given the app does not collect personal information, it is in the government’s view that the federal Privacy Act does not apply to the initiative.

“(I)t bears noting that an app, described worldwide as extremely privacy sensitive and the subject of reasoned concern for the future of democratic values, is defended by the Government of Canada as not subject to its privacy laws,” the OPC’s review report notes.

“This is again cause for modernizing our laws so that they effectively protect Canadian citizens.”