Contact Tracing App in Canada: To Download or Not

To download or not to download?   That is the question for Canadian residents since the August long weekend, when the exposure notification app COVID Alert launched, using Canada’s most populous province, Ontario, as ground zero.  This app is backed by Canada’s federal government – one of 40+ national apps being used around the world by different countries.

Generally speaking, automated contact tracing apps are designed to automatically tell users or public health officials whether somebody has potentially been exposed to covid-19.  Like when a fellow dog walking neighbour alert others that their poodle has kennel cough.  A contact tracing alert doesn’t mean that one’s puppy is infected; only that they’ve been in contact with another that is infected.

Here’s the advice from the Canadian Civil Liberties Association:  because it’s voluntary to download the app, the federal government has apparently mollified our constitutional concerns respecting our privacy and freedom.  The feds are promoting the app, but they’re not using their legal powers to mandate its usage.  This is unquestionably the right way to go.  Leave it up to the people to decide whether to use it or lose it.

As for the app COVID Alert, technically, it’s pretty good for what it is. Developers have clearly prioritized privacy.  The design succeeds in minimizing information collection.  It also puts individuals in charge of downloading it, running it, choosing whether to follow up on notifications with public health, and, in the event of a positive test,  choosing whether to ever acquire and upload a code that will trigger notification of others about their potential exposure.  That said, there are important technical and practical questions about whether it will work as advertised.  Time will tell.

The fact that privacy has been in the spotlight means one key hurdle for trust has been passed. But this focus on privacy has left other barriers smack in the middle of the track.

Launching this new tech tool into the deep end of Ontario’s public health system is going to make waves, impacts that will ripple out and affect lives. Who will notifications impact the most?  Who will be left out?  What kind of social supports are there—paid sick days for COVID testing, job protection, access to technology that will run the app for those who want it and can’t afford it?  No answers have yet been provided by the feds on this front.  One reason CCLA’s Privacy Director is participating in the National Advisory Council for the app is to bring these kinds of questions forward.

Will the app actually improve public health, or just stress out workers caught between what the app tells them to do and the reality of rent, groceries and precarious employment?  That there are no legal penalties for opting against usage of this app, as we’ve said, is an important pre-condition of its constitutionality.  But nor are there any incentives for participating in this large national experiment.  That means that for some Canadians, the uncertainty of what participation will mean to their lives may make it too risky.

We don’t think that there is an obvious answer as to whether one ought to download it.  In fact, amongst CCLA staff, some are, some aren’t.   Michael Bryant, CCLA’s Executive Director, is going to download the app. Noa Mendelsohn Aviv CCLA’s Equality Director is still considering the implications. In the interest of contributing to a discussion, and maybe to help lay out the pros and cons, here’s why.

NOA MENDELSOHN AVIV, CCLA’S EQUALITY DIRECTOR

The new COVID exposure app gives people with privilege yet one more way to try to protect themselves from a terrible and terrifying virus. On its face, there is nothing wrong with this. The problems lie in what the app does and does not do for people who are disadvantaged in our society. These individuals are already most at risk of being exposed to COVID, getting sick, and suffering the more severe COVID outcomes. And these same individuals will be least able to access this new app that only works on relatively new smartphones, far less able to take self-protective measures based on data from the app, and most vulnerable to pernicious uses of the app.  After all, there is no protection in law preventing anyone from demanding a clean app check as a condition for coming to work or accessing a basic service. But there should be.

The individuals and communities who have been hardest hit by COVID include people experiencing homelessness, and individuals from racially diverse and lower-income neighbourhoods, some of which have a higher concentration of recent immigrants. These groups have not only faced greater COVID exposure and infection rates, they have also suffered the most severe COVID outcomes including hospitalizations, ICU admissions and deaths. This is a tragic situation for communities who already face pre-existing inequities in income, education, food security, and housing – all of which are well known to have a detrimental effect on health.

The kinds of self-protective measures that are needed during the COVID pandemic have been far less available to individuals in these groups. It is difficult if not impossible to physically distance when one’s family or household members live in unsuitable, cramped housing or homeless shelters. And staying home is not an option for many low-income individuals who work in various front-line positions, including underpaid health positions, manufacturing, and long-term care facilities where COVID rates have been particularly bad.

And then along comes a new measure, the COVID exposure app, which is only available on fairly new smartphones.  It is hard to conceive how much utility it will have in households where not every member has such a device. (And it is still not known whether the app will really work. Whether Bluetooth beacons can accurately record proximity in uncontrolled conditions and keep the false positives and negatives to a minimum is still unclear). But if the app does prove even somewhat effective, many disadvantaged individuals and groups will be excluded from this protection.  According to a June report by the Ryerson Cybersecure Policy Exchange, there are significant gaps in smart phone ownership between high income families (97%) and low income families (74%). Those aged 60+ were also less likely to have a smartphone than those who were younger. Given what we know about the ravages of COVID-19 in lower-income areas, and among the elderly, this means the app simply leaves out many vulnerable people who may need it most.

Even if a household has one or more smartphones, and even if the app works perfectly, its effects and benefits within disadvantaged communities are still highly questionable. The people who are going to get the most notifications will likely be front-line workers, many of whom are women and youth, often racialized, many of whom have no paid sick days or job protection. For the app to genuinely protect their health and well-being, if the app sends them a positive notification about a contact, they need to know that they can get tested quickly, can stay home—with pay—while awaiting their own results, and if it turns out they have COVID, that they can quarantine without worrying that their job will be gone when they are recovered. Legal protections of this kind are long overdue.

Worse still, the app could be weaponized by others, but has been introduced without critically necessary restrictions on its use by employers, landlords, or service providers. There is no law or regulation protecting individual privacy and freedom by prohibiting anyone from demanding their workers, customers or clients use the app; and there is nothing to stop any person from demanding to see a “clean” app on one’s phone.

Use of the app is supposed to be voluntary, which is important. That voluntariness needs legal protection so that no one can be told they must use the app in order to access a service. Worse still, what happens if employers demand “Don’t come to work unless I can see you have no positive notifications on the COVID Alert app”? The individuals who might receive the most positive notifications due to their work or their communities, may be those least able to stay home due to insecure work conditions or a heightened need for stable income.

This horrific scenario may not come to pass if only some people download the app. Store owners and bosses may not feel emboldened to make such demands if most people do not yet have it on their phones. Clearly the answer is for lawmakers to prohibit these abuses without further delay. In the meantime it is not clear how effective the app can be if only a small group is using it.  But once a critical mass has downloaded it, the app may be ripe for abuse against the most disadvantaged members of our society – the very people most in need of supports during this pandemic.

MICHAEL BRYANT, CCLA’S EXECUTIVE DIRECTOR

For myself, there are no economic disincentives, no centralized control of my private info by third parties, no privacy concerns for me, and no negative impact on others, at least caused by my downloading the app, as of this writing.  I agree with the concerns expressed by my colleagues Noa and Brenda.  For myself, however, there are no negatives to this download, and the positive is that I may aid public health efforts to prevent overspread of a disease.  Allow me to elaborate.

Privacy.  I give away plenty of personal information about myself already, as a semi-public figure who blathers on about myself through mainstream and social media.  I don’t consider myself a private person.  More importantly, to me, the app takes all Canadians’ privacy seriously.

On top of that, I take comfort that the app itself gives me enough control at every stage in its operation.  I’m not boxed in by merely downloading and using it.  I control when the app is running and I decide whether to follow up on notifications with public health, and, if I test positive, I get to decide whether to ever acquire and upload a code that will trigger notification of others about their potential exposure to COVID through me.  Unlike a weird flashlight app or a Facebook app, when I download and open the COVID Alert app, I do not lose control over what happens to my personal information.  I have full control throughout.

Nor is there a socioeconomic downside, for me.  Thanks to good fortune and privilege, my employment is unaffected if I have to self-isolate.  So there are no economic or social disincentives to me self-quarantining, in the event an app suggests that I do so.  As the economists would put it, my self-interest is aligned with the public health goals of the app.  As we have said, this is not the case for many Canadians, and no incentives are on offer from a Canadian government to offset the economic penalty of self-quarantine without pay, for those who download the app but lack socioeconomic supports.

I am constitutionally free to decide whether my worldview is more Calvin than Hobbes.  I respect people who prioritize self-preservation.  I choose to participate in something that may scale Canada’s ability to alert others as to potential contact with a COVID carrier.  I do not expect that the app will make much of a difference overall, because the high number of users needed to fulfill the app’s potential likely will not be reached without a social safety net to support those whose economic self-interest is not aligned with the app’s goals.  But I’m not opposed to trying it.  I’m an impulsive agitator most of the time, so the opportunity to say “yes” to something is a welcome departure for me.   Sure – I’ll download and use it.

BRENDA MCPHAIL, CCLA’S PRIVACY, SURVEILLANCE, AND TECHNOLOGY DIRECTOR

Last week, CCLA’s ED tweeted out that one of us was going to download the new COVID Alert exposure notification app and one wasn’t. I was the one who was going to say no—and a month ago when we discussed it and co-wrote a blog explaining our reasons, thinking the app was going to launch July 2^nd, I would have bet you money I wouldn’t change my mind. But much to my own surprise, I have.

I’m still skeptical about the ultimate efficacy. Such apps haven’t been game changers elsewhere in the world, and there are questions about the accuracy of the Bluetooth tech out in the wild, and about whether Canada can achieve the level of uptake needed to make a real difference that are going to be really important to answer.

But what I’ve seen in the last month from the people at both the federal and Ontario governments working on the app is a willingness to engage with the tough questions—even if they’re not answering them all just yet. For example, the federal government has committed to doing a Q4 app audit, with the OPC, that will include an efficacy assessment. That strikes me as a reasonable step that allows the technology to be tried, while acknowledging that the effects must be measured, in a fairly short time period, to let members of the public see whether the tool they’ve volunteered to use is working and if their participation is genuinely making a difference.

Even at the time of the first launch announcement I was reasonably impressed by the attention to technical privacy protections built into the app; it was clear that privacy was being taken seriously in the design process, to an unusual degree. But back in June, there remained a red flag, and CCLA joined civil society colleagues in asking why Privacy Commissioners weren’t being involved in an analysis of the app before launch. The month delay allowed that to happen, and both the Privacy Commissioner of Canada and the Information and Privacy Commissioner of Ontario had time to engage in detailed reviews, issuing their findings the same day as the app was released.

That means that what I’m left with are more general concerns, similar to Noa’s, about the impacts of putting this new technology into a world where it’s going to have social impacts, well beyond its privacy impact, that are outside of the ability of the app design to mitigate. A well-designed app may or may not have its intended effect if the policy framework that supports it isn’t up to the job, and more consideration needs to go into that framework. For example, right now what is preventing third parties—like landlords or employers—from essentially changing the voluntary app to a de facto mandatory one by demanding its use by tenants or employees is a statement by governments that it’s not supposed to be used that way. Other places, like Australia for example, have provided legal protection against such co-opting of their app, and we should be looking at that here.

But in the end, in true, measured, Canadian form, this app is being pitched as not the latest and greatest solution, but one piece of a public health effort. I might be a skeptic, but no one who works in a civil society organization stays sane without also being, to at least some degree, optimistic that we, as a society, might get something right someday. And it’s that little optimistic piece of me that has decided to hold out hope that Canada will be the country that finds a way to make exposure notification work within a larger framework of complementary public health measures. I’ll be keeping a very close watch to assess whether the promises that have encouraged me to change my mind and give the app a chance—for audits, for transparency, and for listening to emerging public concerns in each province and territory that chooses to participate—are honoured. That said, I’ve downloaded the app.

For the authors’ bio’s, please visit our Team page.