Experts converge on how to deploy contact tracing apps responsibly

A handful of developers have been racing to build made-in-Canada contact-tracing applications that promise to enhance public health efforts to combat COVID-19 while safeguarding privacy. Outside Canada, jurisdictions like Singapore and Australia, have moved swiftly to adopt tracing apps as they exit from lockdowns. But their reception has been mixed and their success is far from assured. 

Assuming Canada (beyond Alberta, which launched an app on May 1) follows suit, what will it take to do it right? As Daniel Therrien, Privacy Commissioner of Canada, recently reminded lawmakers: "Technology in itself is neither good nor bad. Everything depends on how it is designed, used and regulated.”

A series of reports, recommendations and statements by Canadian experts, including Therrien and his provincial and territorial counterparts, are urging developers and governments to address the technical, social, legal and ethical issues presented by tracing apps and offering clear direction for doing so. 

The latest contribution to the policy debate, titled The Race to Trace and released Monday, urges decision-makers to evaluate contact-tracing apps against five criteria, from the use of privacy-by-design principles to policies that maintain transparency and trust, while acknowledging that none of the jurisdictions experimenting with such apps “has yet to fully satisfy all these conditions.” 

Published by the Ryerson Leadership Lab’s Cybersecure Policy Exchange, the report joins a chorus of voices offering guidance on the questions and concerns surrounding contact-tracing technology, including an expert advisory group convened by the Canadian Institute for Advanced Research (CIFAR) at the request of Canada's Chief Science Advisor; a newly formed consortium of experts in privacy and security called the National Cybersecurity Consortium; and experts who recently appeared before the House of Commons Standing Committee on Industry, Science and Technology (INDU).  

They are unanimous that contact-tracing apps should only be used to supplement evidence-based public health tools, such as widespread testing and manual contact tracing.

"The expert advisory group wanted to state first and foremost in the report that any consideration of technology needed to be done within the broader public health strategy in response to the pandemic," said CIFAR’s Vice President, Engagement and Public Policy, Rebecca Finlay, who led the group of independent Canadian and international experts. "These technologies need to be integrated with a strong public health effort and seen as a way to support that effort rather than replace it."

What are contract-tracing applications?

Technologies that automatically trace a user's location to provide information about whether the user has potentially encountered someone diagnosed with COVID-19 and been exposed to the SARS-CoV-2 virus. The apps alert users so they can self-isolate or seek health advice.

Right to Privacy

Privacy is front of mind in any discussion about automated tracing. Governments and citizens must weigh the potential of using personal information to mitigate the spread of the virus against the inherent privacy risks. Canada's privacy commissioners have issued a joint statement outlining the privacy principles that should be following by governments to mitigate that risk [See Table 1]. Among the principles, they call for the use of contact-tracing apps to be voluntary, the collection of personal information to be limited to public-health purposes, the destruction of data and decommissioning of the apps once the pandemic ends, and transparency and accountability by governments, including oversight by an independent third party. 

Source: CIFAR's Society, Technology and Ethics in a Pandemic report (April 30, 2020).

Several experts also stressed the urgent need to modernize and strengthen Canada’s legal framework to protect Canadians’ right to privacy. According to the federal Privacy Commissioner, existing laws dictate how the federal government and businesses must handle personal information but do not recognize privacy as a right. A new legal framework for the deployment of contact-tracing apps should address issues including data collection and access, data storage and destruction, and the consequences of unauthorized use or misuse of data. 

National Coordination

In a recent opinion article on her blog, Teresa Scassa, Canada Research Chair in Information Law and Policy at the University of Ottawa, drew attention to another issue: the real possibility that a variety of different contract-tracing apps could be adopted within Canada. (Alberta has already launched ABTraceTogether and other provinces may deploy similar ones.)

“A multiplicity of non-interoperable apps could put their effectiveness in question and could create regional differences in approaches to privacy,” Scassa wrote. Indeed, a recent study from Oxford University found that more than 50 % of people in the United Kingdom would need to install a contact-tracing app for it to be effective. 

“[Regional differences] has been a common problem with doing digital in Canada. In the pandemic context, where everything is happening at the speed of light, this weakness has become even more evident,” Scassa said in an interview with Research Money.

She and other experts stressed that the provinces and territories should harmonize their approach to contact-tracing apps, adopting shared standards and interoperability between systems, and ensuring data can be shared across jurisdictions.

Whether that advice will be followed remains to be seen.

Prime Minister Justin Trudeau reportedly suggested the federal government would soon be “strongly recommending” an app. Health Canada did not confirm that it is working with the provinces to adopt an app nationally. In an emailed statement to Research Money, a spokesperson wrote: “The Government of Canada is committed to continued collaboration with provinces and territories to support our communities during this pandemic. We recognize that important discussions are needed to reinforce current efforts in outbreak containment while continuing to take steps to enable economic recovery.”

R$