The rise of contact tracing apps requires countries to declare where their values lie on privacy, and Canada is no exception.
When Canadians were first ordered to self-isolate, the IPilogue published a blog on the use of contact tracing apps in China that reviewed how useful the apps were in controlling the pandemic, despite the privacy concerns that they raised. However, as China sees a second wave of outbreaks, it’s worth reevaluating how much privacy Canadians are willing to give up for an imperfect system.
What is Contact Tracing?
Contact tracing is a method of tracking a disease’s spread by monitoring social contacts. The hope is that accurate contact tracing will allow people to return to their daily activities, and kickstart the economy sooner rather than later.
In order for a contact tracing app to be effective at stopping the spread of COVID, 80% of the population has to use the app, including seniors who may not have smartphones. Users would also have to be honest and accurate about their symptoms.
How Would These Apps Work?
There are different models under development in different countries. The basic premise underlying all of them is that once a person either confirms that they have COVID symptoms or actually tests positive for COVID, anyone they have been in contact with recently is notified and told to isolate.
In China, people are simply denied the ability to leave their homes until they prove to be asymptomatic. However, in a country like Canada, the success of a contact tracing app would rely on symptomatic or COVID-positive users being voluntarily agreeable and capable of quarantining.
Despite the technological capabilities of these apps, it should be noted that the solution they prescribe when someone is ill or exposed is exactly the solution that is already in place— social isolation. At this point, nothing is safer than following strict social isolation protocol.
Contact Tracing in the United Kingdom
The NHSX is the technology arm of the UK’s National Health Services (NHS). It is currently running a trial of a contact tracing app on the Isle of Wight to determine its broader utility throughout the UK.
The UK’s app is highly centralized, in that it collects data and analyzes it as a whole to find patterns and make predictions. A recent blog by Ian Levy, the Technical Director of the National Cyber Security Center, explains why the UK opted for a centralized model. Such a model allows the NHS to implement measures to protect the population in general rather than just individuals, and to learn more about how COVID is transmitted. It also allows the NHS to make improvements to the app more easily.
The UK model relies on self-reporting of symptoms. If a person who reports having symptoms of COVID has a high calculated risk factor, they may be ordered to take a COVID test.
The only information the UK app stores is the user’s anonymous identification number, and their “postcode district,” which is shared by thousands of households. In terms of privacy, the NHSX website says that the app is specifically designed with privacy in mind, and that users will always stay anonymous, with their data only being used for contact tracing purposes. You can read more about the app on the informational website the UK has set up.
One explanation for why this model has been chosen is that closed circuit video is much more common and accepted in the UK than in North America, largely due to concerns about terrorism and crime. Perhaps this makes British citizens more comfortable with giving up aspects of their privacy in favour of public safety. It may be less likely to be accepted in North America.
Contact Tracing in Germany
Germany looks like it will be taking a far more decentralized approach to contact tracing than the UK. German citizens are highly protective of their privacy rights, and designing the structure of an app has been the subject of controversial public debate.
The proposed German app keeps all a user’s information and data on the user’s phone. If they actually test positive for COVID, their recent contacts are alerted. There is no self-reporting option in the German model, which proponents say will reduce false alarms and unnecessary panic.
However, this model is completely reliant on fast and accurate testing, something that not every country has access to. Germany can afford to implement this model because it currently has the fastest rate of testing in Europe, pumping out tests for 838,000 samples per week.
Contact Tracing in Canada
Currently, contact tracing apps have been voluntarily developed by provinces and private partners, though on May 19th the federal government suggested that they may soon be putting forward a federal framework.
Alberta has already launched its contact tracing app, based on a centralized model, through a partnership with Deloitte. The app only provides the provincial health service with the user’s phone number and duration of exposure to other users who have been identified as high-risk for transmitting COVID. The app does not use GPS to track users’ locations. Instead, it uses Bluetooth technology to record the duration of the contact between users. A user’s data is deleted every 21 days.
While provincial contact tracing is not in full effect in Quebec or Ontario, it appears to be an imminent reality, with apps already developed and ready to launch. One Montreal-based app, “COVI”, hopes to be the app chosen by the provinces’ health authorities. COVI’s creators describe the app as being similar to the UK model, and specifically mention that health authorities will be able to intervene in a targeted manner based on aggregate data if they identify a problematic pattern of infections.
The personal information COVI would gather is significant and includes data such as age, sex, existing medical conditions, and risk factors like whether a user takes public transit. COVI would not ask for users’ emails, names, or phone numbers.
Conclusion
COVID has required countries to decide very quickly where their values lie. The question is whether Canadians will be tolerant of giving up some privacy in order for the government to track COVID more effectively, or whether we will grip tightly onto our privacy rights and risk the downstream effects of a longer social isolation period.
Written by Rachel Marcus, IPilogue Contributing Editor. Rachel is going into her third year at Osgoode Hall Law School, and she is also an IP Innovation Clinic Fellow.