Federal and Ontario privacy commissioners support use of COVID Alert application subject to ongoing monitoring of its privacy protections and effectiveness

Following productive and in-depth discussions with the federal and Ontario governments, the Office of the Privacy Commissioner of Canada (OPC) and the Office of the Information and Privacy Commissioner of Ontario (IPC) have concluded their review of the COVID Alert exposure notification application and support use of the app.

The federal government led the development of the app, which is being launched today first in Ontario. Because the app is positioned as a national initiative, the OPC and the IPC also consulted other provincial and territorial privacy commissioners.

The federal and Ontario regulators reviewed the app and provided recommendations to their respective governments based on key privacy principles outlined in a joint federal, provincial and territorial statement on tracing applications. In their view, all of these principles have now been met.

“Canadians can opt to use this technology knowing it includes very significant privacy protections,” says Daniel Therrien, Privacy Commissioner of Canada. “I will use it.”

Information and Privacy Commissioner of Ontario Patricia Kosseim agrees that the app could be an important tool, among others, to help control the spread of the virus in Ontario.

“I support the use of exposure notification technology to help control the spread of COVID-19, provided it is used in the way it’s been designed to respect the privacy of Ontarians,” says Commissioner Kosseim. “This app will only work if people trust their personal information will be protected and choose to use the technology. Based on our review of the app and acceptance of our recommendations, I am satisfied that there are strong measures built in to help protect individual privacy.”

The two commissioners support the use of the COVID Alert app by individuals on the following basis:

• The use of the app is voluntary and has been developed with robust safeguards to protect the identity of users. However, while the app is voluntary as it relates to the federal and Ontario governments, there is still a risk that third parties may seek to compel app users to disclose information as to their use of the app, including any exposure notifications. The governments have undertaken to communicate publicly that individuals should not be required to use the app or to disclose information about their use of the app. The commissioners welcome this concerted measure, recognizing, however, that such public messaging will only mitigate, but not eliminate, the risk to the voluntary nature of the app.

• The governments of Canada and Ontario have sufficiently demonstrated that the application, although new and untested, is likely to be effective in reducing the spread of COVID-19, as part of a broader set of measures that includes manual contact tracing. However, because the effectiveness is uncertain, the commissioners recommended that the implementation of the app be closely monitored and that the app be decommissioned if new evidence indicates it is not, or is no longer, effective in achieving its intended purpose.

To meet the necessity and proportionality principle, both governments must monitor the app’s implementation and effectiveness and independent oversight will be important to foster public trust.

The government of Ontario will continue to be subject to Ontario’s privacy laws and ongoing oversight by the IPC.

The federal government has agreed to involve the OPC in an audit of the app after it is up and running. The audit will including ongoing analysis of the necessity and proportionality of the app, including its effectiveness, and an assessment of respect for the federal, provincial, territorial joint statement principles in the design and implementation of the app.

Discussions with the federal government have highlighted broader concerns related to law reform.

The government’s privacy assessment suggests that the federal Privacy Act does not apply to this initiative in light of a government assertion that the COVID Alert does not collect personal information.

“(I)t bears noting that an app, described worldwide as extremely privacy sensitive and the subject of reasoned concern for the future of democratic values, is defended by the Government of Canada as not subject to its privacy laws,” the OPC’s review report notes.

“This is again cause for modernizing our laws so that they effectively protect Canadian citizens.”

Related documents:

Office of the Privacy Commissioner of Canada Review of the COVID Alert app

Office of the Information and Privacy Commissioner of Ontario Recommendations on COVID Alert

Contacts:

Office of the Privacy Commissioner of Canada
@email

Office of the Information and Privacy Commissioner of Ontario
@email