The federal government must obtain “meaningful consent” from Canadians if it wants them to use any future smartphone app to digitally track coronavirus cases, the country’s privacy commissioner says.
In an interview with Global News’ Mercedes Stephenson on The West Block, Daniel Therrien said he agrees with Prime Minister Justin Trudeau’s comments last week that such an app should be voluntary to earn public support.
But he added that the app’s design must be done properly, and meet a series of criteria, in order to balance privacy concerns with public health needs.
“It’s not a question of either having public health protection or privacy. It is possible to have both at the same time,” Therrien said.
“But there is no question that privacy is engaged with these obligations.”
Therrien listed some of the important privacy safeguards he said any contact tracing app should have before it’s introduced to the public.
The most important, he said, is that the app only collects location and health data for public health purposes, not for commercial or “state surveillance” purposes.
He also said that data should stay on the user’s phone as de-identified and “aggregate” information.
“Information should be sent to the government public health authorities so that they can monitor trends at a general level, but not know where each individual is,” he explained.
Therrien also said users should know what they’re signing up for, with the government clearly laying out how their data will be used in order to achieve meaningful consent.
Finally, the commissioner said the data collected through the app should only be kept for a limited time period — in this case, when the threat of the pandemic is over — and destroyed once that time period ends.
Trudeau and deputy chief public health officer Howard Njoo both said Wednesday that Ottawa is looking into the potential of using smartphone apps to digitally trace contacts of identified coronavirus cases.
The prime minister said “a number of proposals and companies working on different models” may be adopted by Canada, but said privacy is a top consideration.
“As we move forward on taking decisions, we’re going to keep in mind that Canadians put a very high value on their privacy, on their data security,” he said. “We need to make sure we respect that even in a time of emergency measures and significant difficultly.”
Chief public health officer Dr. Theresa Tam has said both contact tracing and widespread testing are crucial to implement before the economy, which has been largely locked down across the globe to limit the spread of COVID-19, can reopen on a wide scale.
Yet Tam also said on Wednesday that she’s also concerned about the mistakes that could be made by contact tracing apps if not developed properly, particularly the chance of false positives.
On Friday, Alberta — which has already begun taking steps to re-emerge from its coronavirus lockdown — became the first jurisdiction in Canada to introduce such an app. The province said its ABTraceTogether app was developed in close contact with Therrien’s office and appears to follow his important privacy safeguards.
The Office of the Information and Privacy Commissioner’s guidelines for governments to follow during the COVID-19 crisis includes those same safeguards while underlining the need for transparency in introducing any extraordinary measures.
Therrien said his office’s framework has been delivered to the federal government for consideration, but added Ottawa has not reached out for advice on how to develop a contact tracing app.
“They know where we live, so they have our framework and we have offered our services,” he said. “That’s where things stand.”
Australia last month rolled out a voluntary coronavirus tracking app as part of its effort to combat the spread of the virus. In other countries, citizens don’t get a choice.
South Korea amended its laws early in 2020 to let health officials track location data from cellphones, car navigation systems and credit-card systems to keep tabs on its citizens.
Poland requires infected individuals to share photos with geolocation data to prove they are maintaining their quarantine orders.
Singapore uses an app it describes as voluntary, but that allows the government to prosecute people who refuse to share their information through it when asked under the Infectious Diseases Act.
Therrien said if Canada chose to make its app mandatory — or felt it had no other choice but to do so — his safeguards would become even more important to gain the public’s trust.
But he echoed Tam’s concerns over the effectiveness of such an app, and said if people are forced to use it, it must be unimpeachable.
“In order to meet privacy safeguards, the measure must be necessary and proportionate — that is, science-based,” he said.
“If it became mandatory, it would be extremely important that the application be found to be effective.”
—With files from Global News’ Amanda Connolly