Alberta’s smartphone app launched to trace and identify contacts of a confirmed COVID-19 case could be a security risk if used on Apple devices.
That was the finding in the report of the Office of the Information and Privacy Commissioner of Alberta (OIPC) reviewing the ABTraceTogether app.
Commissioner Jill Clayton said Alberta Health was mindful of privacy and security in developing the app and took reasonable steps to protect privacy.
“Despite the positive aspects,” said Clayton, “I have ongoing concerns related to the functionality of ABTraceTogether on Apple devices.”
Clayton noted safeguards are out of Alberta Health’s control, but said nonetheless, there is still a security risk because, to run the app, Apple devices need to remain unlocked, “which significantly increases risk in case of theft or loss.”
The province and Alberta Health Services launched the voluntary smartphone application on May 1. It uses Bluetooth and is free to download.
Three weeks after the app was launched, Alberta Health confirmed it was working with Apple and Google to improve the app but said it was not yet using the updated software.
More than a month and a half later, Alberta Health said it is still working with Apple to develop a fix that would let the app run in the background.
The OIPC said employees storing health or personal information on provided devices or their own, and running the app, could potentially be in contravention of Alberta’s privacy laws.
“AH and AHS have a legal responsibility to safeguard personal and health information in their custody or control,” Clayton said in her report.
She noted that her office does not regulate actions of those who choose to download the app and recommended Alberta Health make potential privacy risks public.
The province said the app continues to play a key role in the fight against COVID-19 and ultimately saves lives.
Alberta Health said it will review the commissioner’s report and make changes where it can.
The OIPC also recommended regular updates on the use and effectiveness of ABTraceTogether, as well as plans to eventually dismantle the app.