Cyber-policy group warns on mandatory contact tracing
Ryerson team wants a law to prevent abuse
Canadian employers should be able to require that staff download a contact tracing app before returning to work, about half the respondents to a new survey say. But the Cybersecure Policy Exchange ( CPE), the Ryerson University group behind the research, is calling for governments to pass legislation ensuring the use of any such technology is voluntary.
Contact- tracing apps are designed to partially digitize the process of notifying people if they’ve recently been near someone who’s tested positive for COVID-19. It’s a task traditionally undertaken by human public health employees and volunteers. Last week, however, Health Minister Patty Hajdu said the federal government continues to talk to the provinces and territories about deploying digital contact tracing, and is examining the “usefulness of an app if there is not a high take-up.”
Fifty- six per cent of survey respondents said they either strongly support or somewhat support governments requiring residents to use such apps in order to access public services like transit,and 45 per cent supported grocery stores and other retailers only allowing customers in if they’re using a contact- tracing app. “It speaks to Canadians’ level of anxiety and willingness to embrace approaches that would let them get back to work (and) society,” said Sam Andrey, director of policy and research at the Ryerson Leadership Lab, which contributes to the CPE alongside the Rogers Cyberscure Catalyst centre.
That openness doesn’t extend to all parts of daily life; a plurality of respondents strongly opposed landlords or condo associations requiring that people use a contact- tracing app as a condition of residence — the “most extreme” case, he noted.
More than an eighth of survey respondents with household incomes under $30,000 reported they don’t have a smartphone, similar to Statistics Canada’s latest data in 2017. Seniors are also less likely to own such devices. Requiring riders to download an app to use transit or shoppers to enter a store, would “exacerbate existing inequalities,” the report notes.
Employers can require staff to provide location and activity information during work hours, some employment lawyers argue. But the CPE is calling for the federal, provincial and territorial governments to pass legislation ensuring agencies and businesses can’t require residents or customers to use COVID-19 contact tracing technology. Australia has already done so, Andrey noted. Public health authorities might release an opt- in system, but “other segments of society like employers or stores ( could) create what is essentially a mandatory framework by requiring it to access their services,” he said.
The CPE also recommends any government COVID-19 proximity system use Bluetooth instead of location information data; that it be overseen and reviewed independently; that contact data be stored on devices instead of centralized servers, and be deleted after 30 days at most; and that the program be wound down after the pandemic is done.
Alberta’s Abtracetogether, the only government- sanctioned contact- tracing app in Canada so far, failed the CPE’S requirements for data centralization, minimization and retention. Alberta Health Services asks users who test positive for COVID- 19 to upload the contacts logged by their devices, then gets in touch with anyone who might have been exposed. It also hasn’t laid out a “clear sunset methodology,” Andrey said. “If this is successful, we think ( governments will be tempted) to keep it in place for future outbreaks (and) diseases.”
The federal government has held discussions with several groups working on digital contact tracing, and could soon be “able to recommend strongly to Canadians a particular app that will help us manage the spread of COVID-19,” Prime Minister Justin Trudeau said in late May. But Hajdu said some provinces believe the systems they’ve already launched are “very effective,” or prefer “the old- fashioned way ( of contact- tracing) using human beings.”
Last week, The Logic reported Ottawa had ruled out recommending an app developed by Montreal’s Mila Institute, which uses artificial intelligence and is based on protocols from the U. K.’s National Health Service ( NHS). It is instead leaning toward a system that uses the Apple and Google’s Bluetooth- based exposure notification API; Trudeau said the government has been in touch with both tech giants.
Many forthcoming government apps are being built on the Apple- Google API, which scores better on the CPE’S scorecard, said Andrey. “We’re hopeful that this picture gets better.”