New COVID Alert app complies with key privacy principles: federal and Ontario privacy commissioners

The Office of the Privacy Commissioner of Canada and the Office of the Information and Privacy Commissioner of Ontario have indicated their support for the use of the new COVID Alert exposure notification application.

The app is a national initiative, with the federal government spearheading its development. The federal and Ontario privacy commissioners conducted a review of the app, offered the federal and Ontario governments their recommendations and concluded that the privacy principles of consent and trust, legal authority, necessity and proportionality, purpose limitation, de-identification, time limitation, transparency, accountability and safeguards had all been met.

The federal and Ontario privacy commissioners approved of the voluntary nature of the app and of the safeguards that were in place to protect the users’ identities. They also said that the app, while untested, would probably be effective in helping to limit the spread of the COVID-19 virus, alongside other government measures such as manual contact tracing.

The commissioners also identified potential risks and suggested possible solutions. Due to the uncertainty surrounding the app’s effectiveness, the commissioners recommended that the app be monitored closely and decommissioned if found to be ineffective or no longer effective in meeting its intended purpose.

There is also a risk of third parties trying to compel users of the app to disclose information regarding their use of the app, said the commissioners. While the governments have made public announcements that the use of the app is voluntary and that app users are not required to reveal information about their use of the app, the commissioners said that such announcements only mitigate but do not remove the risk.

The commissioners urged the federal and Ontario governments to monitor the implementation and the effectiveness of the app so that they can comply with the principles of necessity and proportionality. The commissioners also emphasized the importance of independent oversight in building public trust.

“I support the use of exposure notification technology to help control the spread of COVID-19, provided it is used in the way it’s been designed to respect the privacy of Ontarians,” said Patricia Kosseim, Ontario’s information and privacy commissioner.

“Canadians can opt to use this technology knowing it includes very significant privacy protections,” says Daniel Therrien, federal privacy commissioner. “I will use it.”