Privacy COVID-19 Contact Tracing

Thursday, 7 May 2020 17:28

The Yukon Information and Privacy Commissioner, Diane McLeod-McKay, has joined with her colleagues across the country to issue a statement on government plans for COVID-19 contact tracing.

One of the measures currently being contemplated or already being used in some jurisdictions in Canada and around the world is the launch of smart phone apps to help prevent spread of the novel coronavirus. Many of the apps are aimed at locating people who have been near someone who is, or may be, a carrier of COVID-19, as well as to notify those people.

The safety and security of Canadians is of grave concern in the current COVID-19 health crisis. The urgency of limiting the spread of the virus is a significant challenge for government and public health authorities, who are looking for ways to leverage personal information to contain and gain insights about the novel virus and the global threat it presents.

In this context, we may see more extraordinary measures being contemplated. Some of these measures will have significant implications for privacy and other fundamental rights. Amongst other things, the statement also recommends that appropriate security safeguards are put in place.

Commissioners decided to issue a common statement to Canadians because these apps raise important privacy risks. The statement includes the following recommendations for consideration:

Consent and trust: The use of apps must be voluntary.
Legal authority: The proposed measures must have a clear legal basis and consent must be meaningful.
Necessity and Proportionality: Measures must be necessary and proportionate as well as be science-based
Purpose Limitation: Personal information must be used for its intended public health purpose, and for no other purpose.
De-identification: De-identified or aggregate data should be used whenever possible, unless it will not achieve the defined purpose.
Time-Limitation: Exceptional measures should be time-limited
Transparency: Government should be clear about the basis and the terms applicable to exceptional measures.
Accountability: Governments should develop and make public an ongoing monitoring and evaluation plan concerning the effectiveness of these initiatives
Safeguards: Appropriate legal and technical security safeguards, including strong contractual measures with developers, must be put in place to ensure that any non-authorized parties do not access data and not to be used for any purpose other than its intended public health purpose.