Canadian privacy watchdogs support “COVID Alert” app
The app faces criticism over accessibility, as it requires users to have Apple or Android phones made in the last five years, and a relatively new operating system.
Federal and Ontario privacy commissioners have concluded their review of the country’s new COVID-19 exposure notification app and say they support its use following initial privacy and security concerns.
Experts and lawmakers have been assessing privacy concerns associated with contact tracing apps in an effort to curb the spread of the virus, and commissioners say that the federally developed app has met all of their recommendations.
COVID Alert was launched in Ontario on Friday, and already has more than a million downloads.
“Canadians can opt to use this technology knowing it includes very significant privacy protections,” says Daniel Therrien, Privacy Commissioner of Canada in a statement released Friday. “I will use it.”
The app is designed to notify users when they’ve been in close contact with someone who has tested positive for COVID-19.
However, it does not track a user’s location itself, or use GPS.
Instead, the app produces random codes, and uses Bluetooth to ping other users’ phones and exchange these codes whenever two people who have the app are physically near one another.
“They kind of handshake electronically,” Carmi Levy, a technology analyst, explained to CTV News Channel on Monday.
This means that if a person with the app reports that they have COVID-19, the app can send a notification to anyone who came close enough to that person to receive the specific code within the last 14 days.
“It gives you awareness of when you’ve crossed paths with someone when it’s problematic,” Levy said, which can let a person know that they “might want to head for the testing centre.”
According to the Government of Canada’s website page on the app, “nobody will get any information about you or the time you were near them.”
For months, privacy watchdogs have been sounding alarms regarding potential security risks associated with contact tracing apps, as other nations look for ways to curb new infections.
Privacy commissioners across Canada issued a joint statement in May advising their respective governments of key privacy principles needed to protect the identity of users and their data.
The use of the app is voluntary and commissioners say it has been developed with robust safeguards; however, they also noted the risk of third parties who may seek to compel the app’s users to disclose information.
The federal government has agreed to involve the Office of the Privacy Commissioner of Canada (OPC) in an audit of the app after it is up and running, though no official details have been announced. The audit will include an ongoing evaluation of the app’s effectiveness and security measures.
In the meantime, several Twitter users have pointed out that the app asks for far less access to a users’ phone and private data than apps such as Facebook and TikTok.
Michael Geist, a law professor at the University of Ottawa and the Canada Research Chair in Internet and E-commerce Law, wrote a blog post on Sunday explaining why he was in favour of the app — and why he himself had already downloaded it.
“The Canadian COVID Alert app is ultimately as notable for what it doesn’t do as for what it does,” Geist wrote. “The voluntary app does not collect personal information nor provide the government (or anyone else) with location information. The app merely runs in the background on an Apple or Android phone using bluetooth technology to identify other devices that come within 2 metres for a period of 15 minutes or more.”
He added that, “from a privacy perspective, this is very low risk.”
Although experts are saying the app doesn’t raise privacy concerns itself, discussions between the OPC and federal government have pointed out broader issues related to the adequacy of Canada’s privacy laws.
A statement from the OPC asserts that given the app does not collect personal information, it is in the government’s view that the federal Privacy Act does not apply to the initiative.
