Canada’s proposed contact-tracing app takes the right approach on privacy

I published an op-ed in the Globe and Mail taking a look at the announced Canadian government supported phone app COVID Alert, privacy concerns and potential benefits.

Across Canada, people are taking measures to protect the rest of society: maintaining safe distances while waiting in line for stores, wearing masks and working from home. In a progressive society such as Canada, this abiding sense of social responsibility is our greatest hope for overcoming the COVID-19 pandemic.

Now, as we approach the fourth month of the pandemic, governments around the world have considered launching “contact-tracing” apps as part of these socially responsible behaviours. In places such as South Korea, Singapore and Germany, they’ve already been rolled out. And in a press conference on Thursday, Prime Minister Justin Trudeau announced a voluntary nationwide mobile-phone app called COVID Alert, a federally backed project that was unveiled by Doug Ford, the premier of Ontario, where it will be piloted.

Much of the debate around these solutions has focused on the issue of privacy and government surveillance. Such contact-tracing apps can help public-health workers act decisively to slow the spread of COVID-19, but they can also give authorities uncomfortable amounts of information about individual and community behaviors. While this debate is worthy and warranted, not every approach being proposed under the broad umbrella of “contact-tracing apps” has these issues; in fact, some carry virtually no risk of surveillance. Because these apps have huge potential in the fight against COVID-19, widespread confusion about privacy issues threatens to lead us to broadly reject reasonable solutions – which include COVID Alert. This must not happen.

First, Canadians must understand that there are two very different kinds of apps that are referred to in this overbroad definition: true contact-tracing apps and exposure-notification apps. While both aim to stop the spread of COVID-19, they work in different ways, and therefore also differ on how they protect privacy and protect public health.

Apps that can be correctly called contact-tracing tend to favour rapid public-health response over privacy. Information shared from individuals’ phones is stored on a central server in such a way that, should an individual be diagnosed with COVID-19, public-health workers can identify and contact individuals with phones that have been in close proximity to the newly diagnosed person. This approach allows public-health workers to evaluate the risk posed by individual infections and make calculated assessments of whether a particular train station, bus line or store should be disinfected or closed. However, the shared phone data can be used to identify individuals, map their social networks and study their movements. The government and public-health workers have no foreseeable need to delve into this other information, which could potentially be used or misused for other purposes.

The other kind of contact-tracing tool being considered is better called an exposure-notification app. It allows individuals diagnosed with COVID-19 to voluntarily notify anyone who may have been exposed through close physical contact without revealing that person’s identity to others. Like the true contact-tracing apps, this notification is done using phone data stored on a central server, with “closeness” being measured by the proximity of people’s cellphones. However, unlike with true contact-tracing apps, little information is stored or shared with the government or companies, so identifying, tracking or studying people through exposure-notification app data is pretty much impossible. This puts public-health workers in the uncomfortable position of having no knowledge of how a particular exposure affected the broader public, but it does give exposed individuals the knowledge they need in order to make decisions about whether they should self-quarantine. It also puts all responsibility for response squarely on our individual shoulders.

This latter kind of app is what COVID Alert would be, which means that, if developed properly, it poses no risk to Canadians’ privacy. This is the right choice for one crucial reason: Multiple studies have shown that for either kind of app to be effective, more than 60 per cent of the population needs to adopt it. Removing every possible privacy concern is the best way to achieve this level of adoption, even if we sacrifice some level of public-health visibility in the process.

The COVID Alert app will be released in a few weeks. When this happens, each of us will be presented with the decision to participate or not – to install it or not. That’s a personal decision, but one that carries significance for the health and well-being of those around us. The Canadian government is giving us a promising tool in our shared struggle against COVID-19. It’s now up to us to use it.

Read the op-ed on the Globe and Mail website (audio version also available).

Share