The Canadian Contact Tracing Experiment Begins

A social experiment in technologically-assisted tracking for
public health purposes is about to being in Canada, and we’re the data subjects
(aka guinea pigs). The federal government today announced their support for a
contact tracing app to roll out in Canada, and the province of Ontario will be
the first to test it. The Premier of Ontario later claimed it as a “made in
Ontario” solution.

The COVID Alert app will be available July 2 in Ontario for
voluntary download. The Ontario Digital Service worked with code developed by
volunteers from the e-commerce giant Shopify with security audit help from
Blackberry. It is built on the Apple/Google infrastructure that supports a
decentralized, anonymous form of proximity notifications.

It works by running all the time in the background of a
smartphone, and recording anonymized identifiers every time you are in proximity
for a defined period of time with another app user. If a user tests positive
for the virus, others they have been in contact with will get a notification to
get tested.  Details continue to emerge
about the app. For now, we’re told the server that will hold the data collected
by the app will be managed by Canadian Digital Services federally, while
various provinces will manage the app interfaces. Data is kept for 14 days and
then automatically deleted. It is said to be designed to work as a support for,
rather than a replacement of, manual contact tracing, and indeed, the launch of
the app was coupled with an announcement that Ontario will also double its manual
contact tracing workforce.

Technologically assisted contact tracing has been widely
debated in Canada and globally. Elsewhere, it’s fair to say it’s mostly tanked,
despite high hopes and hype. Countries like Iceland, who rolled out a national
app quickly and got reasonably high citizen buy-in, has said it wasn’t “a
. Norway recently recalled
their ap
p after their data protection authority said it failed to
adequately protect privacy.  Singapore’s much-vaunted
app has peaked at about 25% uptake
amidst concerns about surveillance creep
. The only province in Canada to
launch an app up to now has been Alberta, and in mid-May it seemed to have
failed to gain people’s confidence in its utility or privacy, with only an 11%

In this context, there’s a real question to be asked about
whether an app can be sufficiently helpful to justify any privacy intrusions.
Much has been made of the privacy protections built into the app, but we mustn’t
lose sight of the reality that being asked by the state to allow our contacts
with others to be traced pre-emptively is a significant, unprecedented ask.

Proportionality between the information collected and the public
benefit can only be assessed with a full understanding of how the app is
designed, how it works, and what the policy framework around it will be, in
other words, as usual, the devil will be in the details. More should emerge
soon, and anything less than full transparency is insufficient. At first glance,
the design of this app may be a best case model from a technical privacy
perspective, built to use anonymised data and designed to support public health
contact tracing efforts, not replace them, but that alone is not enough.

It’s widely acknowledged that a precondition for uptake will
be public trust, not just in the built-in privacy protections but in the
governments collecting and using the information.  The emphatic statement from Premier Ford, who
said “personal privacy was our #1 priority” is probably one of the best indicators
of political awareness that privacy has been a huge concern for people when it
comes to these apps. There’s a red flag, however. Prime Minister Trudeau stated
today that “the Privacy Commissioner of Canada has been worked with on this app”;
less than two weeks ago, the Commissioner speaking
to the standing committee of parliament
on Industry, Science and Technology
(INDU) said only one app had been discussed with him directly, and it wasn’t
this one, so it will be interesting to hear more from the Commissioner on this
topic. It’s puzzling and concerning, given the clear acknowledgement of the
importance of privacy, that the announcement didn’t come complete with the
public release of a detailed privacy impact assessment and a review by the Privacy

Privacy is not of course the only civil liberties concern
when it comes to integrating a contact tracing app into our public health
system.  Outside of the privacy context,
there are also significant social considerations for the use of such apps that
run on technology not all people in Canada can afford, and that raise concerns
regarding creeping functionality if employers or others seek to turn a
voluntary tool into a de facto standard for access to workplaces or other social
settings.  These apps will have social
consequences, and monitoring those impacts to ensure they are not stigmatizing
or discriminatory is necessary. The public conversation about how that
monitoring needs to happen is yet to emerge, but it needs to start, now.

CCLA’s wrote a letter to the Prime Minister and all the
other first ministers across the country in April, where we laid out recommendations
for COVID-related data surveillance, which included not just the need to
technical privacy protections, but a set of social wrap-around protections, including:
the need for independent oversight, measures to ensure the app won’t introduce
new forms of discrimination into health measures to address the pandemic, and a
hard stop to data collection—with no secondary uses by police or anyone else—when
the health emergency is past.

As more information about the roll-out of COVID Alert
emerges, we’ll be advocating and watching closely to see whether these
necessary measures are in place.

The post The Canadian Contact Tracing Experiment Begins appeared first on CCLA.


Get involved!


No comments yet