Security risk found in ABTraceTogether

The Information and Privacy Commissioner of Alberta has found there is a security risk with the ABTraceTogether app but acknowledged the constraints Alberta Health has had to work with.

Jill Clayton said Alberta Health had been mindful of privacy and security in deploying the app to supplement already established contract-tracing processes. The app is to enhance quarantine enforcement.

“Despite the positive aspects, I have ongoing concerns related to the functionality of ABTraceTogether on Apple devices. We recognize the challenges AH has faced in this regard, since the safeguards required are out of its control. Nonetheless, given the need to run ABTraceTogether in the foreground on Apple devices, there is a security risk. Running the app on Apple devices requires a device to remain unlocked, which significantly increases risk in case of theft or loss,” said

Clayton.

The risk on Apple devices is more significant for employers in the public, health and private sectors that have obligations to reasonably safeguard health or personal information under Alberta’s three privacy laws, Clayton noted.

For employers that provide employees with devices or require employees to use their own for work purposes, and those devices store or otherwise make accessible health or personal information (e.g. email or cloud service portals), the risk for running the app represents a potential contravention for failing to safeguard information under Alberta’s privacy laws.

Clayton’s office has recommended Alberta Health clarify inconsistencies found between documentation provided during the review and what is made available publicly. Alberta Health, it was recommended, should to continue to report publicly on the use and effectiveness of ABTraceTogether, and on its plans to dismantle the app when the time comes.