Insights Header image
Insights Header image
Insights Header image

The Road to a “New Normal”: Contact Tracing and Privacy Considerations in Canada

May 28, 2020 Privacy and Data Protection Bulletin 4 minute read

Provinces across Canada are starting to lift COVID-19 restrictions and resume some economic and other activities. As we pave our way into a “new normal”, governments are considering the implementation of certain measures to avoid a surge of new infections. Countries at more advanced stages of reopening their economies such as Taiwan, South Korea and Singapore have adopted contact tracing mobile applications as one of the measures to contain the virus until a vaccine is available.

This bulletin reviews privacy concerns relating to the public implementation of contact tracing apps and guidance from Federal and Provincial Privacy Commissioners on how such concerns may be resolved.

Contact tracing, explained

Contact tracing is a process of identifying individuals who may have come into contact with, or have been in close proximity to, an infected person. Contact tracing apps have the ability to identify and notify individuals who have had recent contact with an infected person an anonymized basis. It is possible to operate contact tracing apps on either a centralized or a decentralized basis. The centralized apps work by uploading the anonymized data to a central system, which is typically controlled by a government institution. The decentralized apps keep the data on the user’s phone, which gives the user more control over the data.

Many consider contact tracing an essential tool for public health officials and local communities to fight the spread of COVID-19 and has been identified as a key element for reopening economies across different provinces in Canada. The Province of Ontario’s guidelines for reopening its economy published in April 2020 stipulate that one of the key principles that will guide this process is the capacity to trace and isolate the virus. As of the date of this writing, however, Alberta is the only Province that has implemented a contact tracing app.

Resolving privacy concerns with contact tracing

Contact tracing apps raise privacy concerns because they involve collection, use, and disclosure of sensitive personal data, including health information and geo-location data points.

The Office of the Privacy Commissioner of Canada (the “OPC”) published an assessment framework to guide government institutions implementing privacy impactful measures – such as contact tracing apps – to respond to the COVID-19 pandemic. The assessment framework sets out key guiding privacy principles that government institutions should consider when adopting potentially intrusive measures without decreasing usefulness to public health.

The following have been identified as the key privacy principles for government institutions implementing contact tracing apps to consider:

1. Legal authority

There must be a clear legal basis to collect, use, and disclose personal information and any consent obtained for the collection must be meaningful. In this regard, consent must be obtained for all specific public health purposes.

2. Contact tracing must be necessary and proportionate

The OPC is aware that the pandemic requires government institutions to take extraordinary measures. However, in doing so, it is important to protect Canadians’ right to privacy. Government institutions adopting contact tracing apps as a measure to contain COVID-19 have to ensure that this is implemented in a proportionate and minimally intrusive manner and that there is scientific backing for the measures being undertaken.

3. Purpose of contact tracing must be limited to strictly protecting public health

Contact tracing apps should not collect, use and disclose sensitive personal information other than for the intended specific public health purpose.

4. Contact tracing measures should use de-identified or aggregate data whenever possible

Personal information should be de-identified, if possible. Because contact tracing apps have the ability to collect, use and disclose location data points including precise location data in real-time, there is a high risk of re-identification. The risk of re-identification should be considered and mitigated to the extent possible.

5. Vulnerable populations

The collection, use and disclosure of sensitive personal information such as health information and location data may have a detrimental impact on vulnerable populations. It is imperative that vulnerable populations are identified and measures are built into contact tracing apps to protect these populations without compromising their ability to benefit from the apps during the crisis.

6. Openness and Transparency

Openness and transparency are the cornerstone of Canadian privacy laws. These principles are emphasized when extraordinary measures are being considered to address the COVID-19 crisis. Government institutions adopting contact tracing apps should ensure that they provide the public with detailed information about these apps on an ongoing basis.

7. Time Limitation

Personal information collected by contact tracing apps should be destroyed when it is no longer required for the intended public health purposes.

A joint statement by Canada’s the Federal, Provincial and Territorial Privacy Commissioners urges governments seeking to implement contact tracing through mobile apps to respect the following privacy principles in addition to those mentioned above:

1. Consent and Trust

The use of contact tracing apps must be voluntary and governments must demonstrate transparency and accountability in order to preserve public trust and confidence.

2. Safeguards

Governments must use appropriate legal and technical safeguards to protect the information collected using contact tracing apps. Safeguards must include contractual measures with developers and service providers to preclude unauthorized access and that data is used only for its intended public health purpose.

Key Takeaways

As governments begin to reopen economies across Canada, it is anticipated that they will install safeguards to help reduce the risk of subsequent waves of infection. Certain safeguards, such as contact tracing, have the potential to impede on the privacy rights of Canadians. While securing public health and safety is paramount, Privacy Commissioners across the country urge that governments have regard to key privacy principles when doing so.

Government institutions, companies and organizations who are involved in the design, implementation or support of contact tracing apps should consider the key privacy principles outlined above and all other applicable obligations pursuant to Canadian privacy laws. McMillan’s team of privacy lawyers are available to respond to questions and provide advice as Canada’s Federal and Provincial governments set the foundation for the “new normal”.

by Chiedza Museredza, Mitch Koczerginski

a cautionary note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2020

Insights (5 Posts)View More

Featured Insight

Investor Relations Activities Require Clear and Conspicuous Disclosure

BC Notice 51-703 emphasizes that investor relations activities must be “clearly and conspicuously” disclosed pursuant to Section 52(2) of the Securities Act.

Read More
May 22, 2024
Featured Insight

Unpacking Ontario’s Proposed Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024

Unpacking Ontario's Bill 194: Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024. Key changes & compliance strategies detailed.

Read More
May 17, 2024
Featured Insight

Navigating International Student Worker Restrictions: Post-Expiry Guidelines for Employers

On April 30, 2024, Canada’s temporary waiver allowing international students to exceed 20 hours of work per week expired.

Read More
May 14, 2024
Featured Insight

Understanding the Consumer-Driven Banking Framework: Key Insights from the Budget Implementation Act, 2024, No.1

On April 30, the federal government introduced the Budget Implementation Act, 2024, No. 1, which provides the legislative framework for open banking in Canada.

Read More
May 13, 2024
Featured Insight

Legal Risk Assessments – An Essential Risk Management Tool

The best way to address the legal issues that arise in any business is to focus on their identification and resolution before they become legal problems.

Read More
May 9, 2024