As reports emerge of countries around the world using cellphone location data to help map out the spread of COVID-19, experts say there are a number of ways in which provinces or the federal government could do the same.

There is nothing standing in the way of telecoms or tech companies handing over bulk data, as long as it’s anonymized. But personally identifiable information, such as the movements or location of individuals, would be subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), meaning it can only be provided to authorities if they obtained a warrant — or if there was an order issued under emergency legislation.

As the virus has spread around the world, countries like Italy, Germany and Austria are using anonymized data from telecom companies, while Israel, China and South Korea are employing location information to trace individuals.

Halifax-based privacy lawyer and advocate David Fraser said in a phone interview that in Canada “anything that’s personal level — that says David was here and is now there — has to be legally compelled,” he said.

There are two main ways to do this: going through the courts to obtain a production order or warrant, or through emergency legislation. 

Office of the Privacy Commissioner spokesperson Valerie Lawton said in a statement that in general, organizations subject to PIPEDA — which includes telecom and big tech companies — “could potentially be authorized to release personal information during a health crisis under section 7(3) of the Act combined with an order made under provincial or federal emergency legislation.

Lawton noted: “That being said, it is likely such collection and disclosure of personal information would be challenged under the Charter of Rights and Freedoms and would have to be justified as a reasonable limit to these rights.”

Speaking earlier this week, Ontario premier Doug Ford indicated he was interested in the idea of using cellphone data to track the virus. His office did not respond to follow-up questions.

A federal government source speaking on background said such measures were not currently under consideration. The office of Public Safety Minister Bill Blair didn’t respond to a request for comment, including the question of whether it is something that the government would be open to in the future, even if it wasn’t looking at it right now.

Leah West, a lecturer who specializes in national security law at the Norman Paterson School of International Affairs at Carleton University, said in a phone interview that there is no “production order that allows for the bulk collection of information for bulk tracking. It all requires an individualized suspicion of some sort of crime.”

West also agreed with the OPC that such an order made under emergency legislation could be challenged under the Charter, especially if it was for a broad swathe of information. 

“It would depend on how narrowly-tailored the collection was, what the purpose of the collection was, and then how they were handling the data. There would be all kinds of things you’d want to consider as to whether or not the collection was lawful and whether the use of the data was collected was also lawful under section 8 of the charter,” she said.

Another factor would be how companies would react to such a move. Lawton noted that the OPC is “currently working on guidance to help organizations subject to federal privacy legislation address privacy issues related to the COVID-19 outbreak.”

West said that “if new legislation were to be passed in an emergency situation asking for this type of data, but the companies wanted to challenge the constitutionality of it because they weren’t satisfied or they weren’t willing to share that information, they could do that.”

Rogers Communications Inc. and Telus Corp. did not respond to questions asking how much location data they normally retain and whether they would be willing to provide this information to governments.

BCE Inc. spokesman Marc Choma said Bell does not track or store mobile device GPS location data, with the exception of real-time 911 calls. “Those kinds of measures require lawful authority or a court order and are not something that we have offered to governments as part of their COVID-19 response plans,” he said in an email.

Choma clarified that Bell does “have access to previous cell tower location data. At an individual level, this information would only be provided with the consent of the customer or through lawful access.”

In a scenario where the authorities went through the courts to obtain a warrant or production order, such requests wouldn’t be visible unless the government or companies involved chose to publicize them. 

Frasier said that if they were trying to get a production order — which would only apply in a criminal case, for example if someone were intentionally spreading the virus — that process would be ex-parte, with the affidavit to obtain the order sealed “and the fact that it has been produced would not be made public.” The request would not appear on a docket.

West also said warrants and production orders wouldn’t show up in court files, “unless it was subsequently used in some sort of case.”

Former Ontario privacy commissioner Ann Cavoukian said in a phone interview that if authorities do end up requesting a warrant, they should endeavour to be as open as possible.

“Be transparent. Say, ‘look, we’re trying to really nail down these sources of the COVID-19, and what parts of town they’re [in], or whatever, and that’s why we went to the court and we got a warrant to gain access to this information. We’re only going to use it for this purpose intended,” she said. “You can go a long way by speaking to the public that way, as opposed to not disclosing it and then somebody finds out about it and then the government looks terrible, like they’re hiding something.”

Another factor is how useful the location data would even be in following the spread of the virus.

“Telecommunications companies aren’t in the business of tracking people to any particular precision, other than the default of knowing who connected to what cellphone tower at what particular time,” Fraser said.

That information has been used by law enforcement, who use tower dumps — in which police request records about activity involving certain towers over a specified period of time — to narrow down potential suspects. Fraser gave the example of a case in which Peel Regional Police were looking for a suspect in connection with multiple robberies.

“They asked the telecommunications companies to provide customer information related to who would have been connected to, or who was connected to particular cell towers near the locations of these robberies, and that query … produced 60,000+ people,” he said. 

Fraser added another indication of how imprecise cellphone location data can be is when individuals call 911 from cellphones. Their location “can be off by hundreds of metres, if not even farther if you’re doing it from a rural area, and it can be confused if you’re doing it in an urban area because of the way that… cellular signals echo off shiny glass buildings.”

That means cellphone location information isn’t going to be a way to determine whether individuals kept at a safe distance from each other, but could be for identifying, for example, how many people were in a specific foreign country last week and are now in Canada.

West noted that “usually you need multiple sources of GPS to really pinpoint where a person is.”

She added that there are scenarios where it could be useful.

“If you thought someone was a superspreader, and you were trying to figure out who that superspreader was, then you get a bunch of tower dumps from the location of where outbreaks have occurred, and you look for the cellphone number that was in each of those locations,” West explained.

“But to actually trace down to like, where did this person go minute by minute? You’re not going to get that.”

Of course, telecoms aren’t the only ones to have access to location data — such information is also collected by a myriad of tech and social media companies. That’s where U.S. president Donald Trump is looking, with the Washington Post reporting earlier this week that the U.S. government was interested in anonymized location data from the likes of Facebook Inc. and Alphabet Inc.’s Google.

Fraser said tech companies that operate on an opt-in model — such as those who have mapping apps — have more detailed location information. They are mostly based in the United States, but still can’t hand over that information to Canadian authorities in a personally identifiable form without a U.S. court order.

The OPC’s Lawton said PIPEDA applies to “both telcos in Canada as well as foreign-based companies that have a ‘real and substantial’ connection to Canada,” such as Facebook or Apple Inc. 

Like the telecoms, the tech companies could share that information in anonymized form; Fraser and West agreed such anonymous data wouldn’t raise privacy issues.

“It might be useful for understanding aggregate movements, which for epidemiological purposes might be very useful, but that sort of thing doesn’t concern me at all because they’re not talking about personal-level information,” Frasier said.

That kind of data would be useful if a health authority wanted to know, for example, whether travel between provinces had slowed down following directives to Canadians to socially distance themselves.

West agreed that “if it’s truly de-anonymized or just bulk numbers, then that’s the type of information that could be shared, but I think that’s the kind of information we all would be rather comfortable with having shared.”

Companies could provide that anonymized data without legal restrictions if they were asked, Fraser said.

“And frankly, should they? Yes, I think so, if it would be helpful,” Fraser said.

— With reporting by Anja Karadeglija at akarad@thewirereport.ca and editing by Adam Langenberg at alangenberg@thewirereport.ca