The Canadian government officially released COVID Alert, its exposure notification app, on Friday. Ontario is the first province to use it with plans to implement it in the Atlantic provinces and B.C. in the near future (other provinces may follow). I posted several tweets about the app, including one that received hundreds of likes and retweets indicating that I have installed it (the tweet included links to the Apple and Android versions of the app). Given the interest, this post expands on the tweet by explaining what the app does and doesn’t do and why I think the government has done a good job of addressing many associated concerns.
There has been enormous attention on the use of apps to assist with countering virus spread in recent months (I wrote a column on the issue in March, was part of the CIFAR group that reported to the National Science Advisor, and I featured podcast episodes on the issue with Lilian Edwards and Alberta Privacy Commissioner Jill Clayton). Many of the initial concerns focused on:
- technological concerns (using GPS rather than Bluetooth, which raised doubts about accuracy and collection of location data)
- effectiveness (using an app to replace conventional contact tracing and testing)
- government surveillance (centralized data collection that could be misused)
- mandatory use of the app (claiming that a voluntary effort would not work or requiring installation as a matter of employment)
- insufficient review or independent oversight
- decommissioning strategy for ending the use of the app
Since many other countries have already introduced apps, some of the issues were addressed elsewhere. A consensus quickly emerged that Bluetooth should be used for these apps, that the technology should not be viewed as a replacement for other essential tracing and testing activities, that app use should be voluntary, and that a decentralized approach in which data resides on the user’s device was preferred.
The Canadian COVID Alert app is ultimately as notable for what it doesn’t do as for what it does. The voluntary app does not collect personal information nor provide the government (or anyone else) with location information. The app merely runs in the background on an Apple or Android phone using bluetooth technology to identify other devices that come within 2 metres for a period of 15 minutes or more. Obviously, the distance and timing are viewed as the minimum for a potential transmission risk. If this occurs, a unique, random identifier is stored on each person’s device for a period of 14 days. After the 14 day period, the identifier is deleted from the device.
The identifier does not identify a specific person or location information, and is not sent to any centralized database. If a person tests positive for the virus, they are given a key code to input into the app. Once the key code is inputted, anyone that was identified as being potentially exposed over the prior 14 days receives a notification that this has occurred and they should consider testing and/or self-isolating.
From a privacy perspective, this is very low risk. Indeed, the government’s position – confirmed in the Privacy Commissioner of Canada’s analysis – is that there is no collection of any personal information and therefore the Privacy Act does not apply. The Privacy Commissioner rightly points out this raises some concerns about the state of the law (arguing it should be sufficiently robust to allow for reviews of this kind), however, the use of random identifiers ensures that identification of individual is very unlikely. Moreover, the Privacy Commissioner’s review concludes that “there are very strong safeguards in place” with security of the data, commitments limiting use, independent oversight, and a pledge to de-commission the app (including deletion of all data) within 30 days of the Chief Public Health Officer of Canada declaring the pandemic over.
The Ontario Information and Privacy Commissioner was also engaged in the review process. Her recommendation letter points to commitments for potential ongoing issues, including ensuring that the app is effective, that there is monitoring of third party components such as the Google-Apple Exposure Notification System, and public transparency associated with the app and its use.
While the app passes legal muster, its introduction reinforces the problems with social inequities that COVID-19 has laid clear. Much like the connection between socio-economic status and infection risk, the app itself is only accessible to those who can afford newer Apple and Android devices. That obviously means that those with older phones or no wireless access at all are unable to use it. While I don’t think that is reason to abandon the initiative, the government should be exploring alternatives to allow all citizens to implement these safeguards.
Moreover, while some have warned against “technology theatre” and the emphasis on contact tracing apps as a substitute for broader policy approaches, the Canadian experience suggests that those warnings have been heeded. The relative ineffectiveness of contact tracing apps elsewhere surely influenced the decision to adopt an exposure notification app which raises fewer privacy concerns and is more effective for its limited goal of notification rather than tracing. Further, the introduction of app months after the emergence of COVID-19 allowed for public study and reports, the use of open code, and the emphasis on the app being only a part of a much larger strategy to deal with a health pandemic.
Yet these reasons were not justification enough for me to install the app. Rather, it is the safeguards combined with the public health benefits that swayed me to do so. Necessity and proportionality are one of the top issues raised by the privacy commissioners. The federal commissioner notes:
While exposure notification apps are new and untested, we believe that in context, the governments of Canada and Ontario have sufficiently demonstrated that COVID Alert is likely to be effective in reducing the spread of the virus, as part of a larger set of measures and subject to close monitoring for effectiveness once the app is in use. The relevant context includes the fact that COVID-19 is novel, has resulted in hundreds of thousands of deaths worldwide, and therefore requires consideration of new mitigation responses with reasonable prospects of success.
The commissioner also called for continuous review of effectiveness and that “the Government of Canada decommission the app if its effectiveness cannot be demonstrated.” In other words, an independent review has found that the privacy risks associated with the app have been addressed and that it is likely to help reduce the spread of the virus. That was reason enough for me – and hopefully many others – to install it.