Statement from the Office of the Information and Privacy Commissioner of Saskatchewan on Contact Tracing and Privacy
I read an interesting article in The Atlantic by Derek Thompson. I was aware that South Korea and Singapore and other Asian countries were applying technology to the issue of contact tracing. What is contact tracing? As I understand it, when someone is diagnosed with having COVID-19, they are asked who they had been in contact with in the last while. Then those individuals are contacted. The old way was to do that by interviews. The existence of smartphones and apps allows contact tracing to take place by using Global Position System (GPS) and Bluetooth technology. For example, in South Korea, GPS is enabling authorities to know where patients have been using information from CCTV footage, credit card records and GPS data from the patient’s smartphone. Singapore has taken a different approach by using a government developed app called “TraceTogether” that uses signals between mobile phones to record who you may have had close contact with.
Also, Asian countries are using technology to enforce quarantine. For example, Taiwan uses GPS to create an “electronic fence” for those who should be in quarantine. In Hong Kong, those who must quarantine themselves are given a wristband. They are to activate the wristband using a smartphone app.
Finally, technology is being used to enable movement in China as restrictions are being lifted.
European countries, including Germany and Italy, are also following Asia’s lead and are developing and using apps to assist with combating the spread of COVID-19.
It would appear that Asia has been successful in reducing infections and deaths because of their approach to contact tracing along with other measures taken. We in North America are interested in when self-isolation could end and when our economy might get going again but are worried about a second wave. I can see that authorities here in North America will look to the digital methods used in Asia for ways to start the economy and reduce the risk of a second wave. As they consider these issues, alternatives will be presented and no doubt, smartphones will be raised as an option. In fact, Google recently announced on its blog that it is partnering with Apple to use Bluetooth technology to assist governments and health agencies conduct contact-tracing to help reduce the spread of COVID-19.
Technology can help us combat the spread of COVID-19 but it also increases the surveillance citizens are put under. The Electronic Frontier Foundation (EFF) asserts that surveillance invades privacy, deters free speech, and unfairly burdens vulnerable groups.
As North America adjusts its strategies to combat this pandemic, we must consider the impact such initiatives have on our privacy and our democracy. Can these technologies be used in a way that maximizes its potential in combatting the spread of the virus while minimizing the impact it has on our privacy? I am sure they can. I recommend that authorities be transparent in the technology they use. They should consider technology that doesn’t collect and retain information unnecessarily. For example, it is being reported that Singapore’s “TraceTogether” app uses Bluetooth technology so that information is stored only on the users’ mobile phone for 21 days (the incubation period for COVID-19). If a person tests positive, it is only then that authorities will access the information on the patient’s phone so that authorities know who the patient has been in close contact with.
Another way for authorities to be transparent is letting the public know what information they are collecting, the purpose for the collection, and how the information will be used and/or disclosed. Individuals should have access to the information that is collected about them by authorities.
Furthermore, I recommend that authorities also consider how they can collect, use, and/or disclose the information that is necessary for the purpose of combating the spread of COVID-19 and to have processes in place to ensure such information is not used for other purposes, now or in the future. This includes setting a limit on how long information should be retained.
In Alberta, the provincial government has rolled out a contact-tracing app called “ABTraceTogether”. It has completed a privacy impact assessment (PIA) and submitted the PIA to Alberta’s Information and Privacy Commissioner. Once Alberta’s Information and Privacy Commissioner reviews and accepts the PIA, the provincial government will make a summary of the PIA available. I recommend that if any similar initiative is undertaken in Saskatchewan, that a PIA be completed and submitted to my office.
The information and privacy commissioner has issued a news release. In that news release the information and privacy commissioner stated:
Ensuring this app is voluntary, collects minimal information, uses decentralized storage of de-identified Bluetooth contact logs, and allows individuals to control their use of the app are positive components.
Alberta Health has issued a privacy statement that pertains to ABTraceTogether.
Whatever solutions are posed, my office is here to consult on the privacy implications in advance of any roll-out in Saskatchewan.
Ronald J. Kruzeniski
Information and Privacy Commissioner
Media contact:
Kim Mignon-Stark
Kmignon-stark@oipc.sk.ca