Privacy commissioners urge respect for privacy rights in using contact-tracing apps

Federal, provincial and territorial privacy commissioners have issued a joint statement calling on governments across Canada to respect certain principles when using contract-tracing applications to reduce the spread of the COVID-19 virus.

Governments and public health authorities have been searching for ways to learn more about the virus and to limit its spread by utilizing these contract-tracing apps, which inform users they have been in close proximity with a confirmed or likely carrier of the virus, and other similar smartphone apps. Some jurisdictions in Canada are already implementing these apps.

In their statement, however, the privacy commissioners stressed that the use of such apps may have consequences on privacy rights and other fundamental rights in Canada, and urged governments to keep the following principles in mind:

• Consent and trust: Governments should ensure that the use of these apps is voluntary.
• Legal authority: Governments should implement measures containing a clear legal basis and providing for meaningful consent.
• Necessity and proportionality: The proposed measures should follow the principles of necessity, proportionality, effectiveness and minimal intrusiveness to be legally justifiable.
• Purpose limitation: Governments should only use personal information for the intended public purpose.
• De-identification: Unless the defined purpose cannot be reached, governments should use de-identified or aggregate data.
• Time limitation: Governments should destroy the collected personal information once the public health crisis ends.
• Transparency: Governments should clearly state the basis and terms for the proposed exceptional measures. They should state what information they intend to collect, who can access the information, where they will store it, how they will use and securely retain it and when they will destroy it.
• Accountability: Governments should release an ongoing monitoring and evaluation plan and an evaluation report.
• Safeguards: Governments should adopt appropriate legal and technical security safeguards and warn the public about potential threats and risks.

“The choices that our governments make today about how to achieve both public health protection and respect for our fundamental Canadian values, including the right to privacy, will shape the future of our country,” the joint statement said.