Contact Tracing Applications Flatten the Curve and Raise Privacy Issues

| 21 minutes

Contact tracing applications are a public health solution that Canadian governments are considering to combat the COVID-19 pandemic. While these apps can help flatten the curve, they also raise particular privacy and cybersecurity issues.

On May 26, 2020, leading privacy and technology lawyers from McCarthy Tétrault discussed the implications of contact tracing applications on a two-part podcast published by McCarthy Tétrault. This article provides a preview of some of the interesting points we discuss in more depth in the podcast.

1. Contact Tracing is More Than Apps

Contact tracing is a tool intended to interrupt the spread of infectious diseases. It involves interviewing a person who is or might be infected, and tracing the people with whom the person has had contact. These people may then be offered screening, preventative care and treatment and may be asked to quarantine.

While contact tracing can involve a manual process, a contract tracing app might help. Apps may be faster, more accurate and less labour-intensive than other methods or they might supplement or support manual efforts. 

2. Canada Already has a Contact Tracing App

The federal government is currently beta testing a national contact tracing app called “COVID Alert”. Meanwhile, Alberta already has a contact tracing app in operation. It is called “ABTraceTogether”.

ABTraceTogether is a good illustration of the privacy law issues that contract tracing apps present. On July 9, 2020, the Office of the Information and Privacy Commissioner of Alberta (“Alberta Commissioner”) released its report on ABTraceTogether. While the Alberta Commissioner praised Alberta Health for being “mindful of privacy and security in deploying the app”, she also made a number of findings about issues with the app from a privacy and security perspective. Unfortunately, we recorded the podcast before the report was released.

3. Your Data May Never Leave Your Phone

Many contact tracing apps do not automatically send data to a health authority or other centralized database. They store data on the user’s device, and do not turn it over to the health authority. The user is given the option to submit the data if they are suspected of being infected.

4. Discrimination is a Consideration

By definition, contract tracing apps run on smartphones, and some proposed apps only work on the latest models. Not everyone has a smartphone, and that can be due reasons like socioeconomics and age. Policy makers need to appreciate these issues and take steps to avoid and mitigate discriminatory effects.

5. Cybersecurity is a Consideration, Too

Contract tracing apps need to consider cybersecurity. As a cautionary tale, the Alberta Commissioner expressed concerns related to ABTraceTogether’s functionality. Specifically, to run the app on an Apple device, the app must run in the foreground and the device must remain unlocked. This requirement poses a security risk in case of theft or loss.

Auteurs