Privacy commissioners urge respect for privacy rights in using contact-tracing apps

• Consent and trust: Governments should ensure that the use of these apps is voluntary.
• Legal authority: Governments should implement measures containing a clear legal basis and providing for meaningful consent.
• Necessity and proportionality: The proposed measures should follow the principles of necessity, proportionality, effectiveness and minimal intrusiveness to be legally justifiable.
• Purpose limitation: Governments should only use personal information for the intended public purpose.
• De-identification: Unless the defined purpose cannot be reached, governments should use de-identified or aggregate data.
• Time limitation: Governments should destroy the collected personal information once the public health crisis ends.
• Transparency: Governments should clearly state the basis and terms for the proposed exceptional measures. They should state what information they intend to collect, who can access the information, where they will store it, how they will use and securely retain it and when they will destroy it.
• Accountability: Governments should release an ongoing monitoring and evaluation plan and an evaluation report.
• Safeguards: Governments should adopt appropriate legal and technical security safeguards and warn the public about potential threats and risks.

“The choices that our governments make today about how to achieve both public health protection and respect for our fundamental Canadian values, including the right to privacy, will shape the future of our country,” the joint statement said.