PIAC requests privacy review of contact tracing apps

Six months after the CRTC declined its request to hold an inquiry into contact tracing technologies and negotiations around them between telecom companies and governments, the Public Interest Advocacy Centre has filed a fresh request for an inquiry to the regulator in the wake of the launch of both federal and Alberta-specific apps. Now that both apps are out and in use, PIAC argues there should be a review into the way the apps could be used to collect personal data. Whereas PIAC's first request for a hearing focused on what discussions telecom companies were having with governments around the creation of the apps, this new Part 1 focuses on how telecom companies are dealing with the apps now that they've launched. In a Part 1 application filed Sept. 9 and posted to the CRTC website Wednesday, PIAC asked the regulator to lay out a set of rules telecom providers must follow in handling information passing through the COVID-19 contact tracing apps launched over the summer. That's because, the Part 1 application points out, the apps necessarily need a user's IP address to function. The transmission of the positive diagnosis key used by the apps is by necessity accompanied by an IP address. "PIAC contends that the IP addresses and mobile telephone numbers, are indeed 'personal information', as they can lead, after a second step of requesting subscriber information from a , to identify at the least the account holder of the Internet connection implicated in the COVID Alert and ABTraceTogether processes," the Part 1 application argues. PIAC also wants the CRTC to set out a test to determine whether or not a hypothetical request from federal or provincial governments to inquire into an IP address "to link to or reveal subscriber information associated with that IP address" for a particular contact tracing app is permitted without explicit subscriber consent. If such a request or linking is permitted, PIAC wants the regulator to determine "what test is required to be met to make such a disclosure and what limits, if any, that test might place on disclosure of such information," according to its filing. And once a test is established, PIAC goes on, the CRTC should "encourage compliance with, and enforcement of, the privacy rule determined by the Commission." PIAC argued that the regulator is permitted to do so under its jurisdiction "to contribute to the protection of the privacy of persons" as enumerated in the Telecommunications Act. In a phone interview, PIAC general counsel John Lawford acknowledged that there is no evidence any such requests for IP addresses have been made by governments, but said that the rules that govern requests for IP addresses in other situations should be extended to the contact tracing apps. PIAC also argues in its Part 1 that the federal COVID Alert and the ABTraceTogether app's ability to collect IP addresses was incorrectly assessed not to be personal information by Health Canada. "Shamefully, in our view, Health Canada, in its privacy analysis, stated that it was of the opinion (one which we do not share) that the information created, exchanged and uploaded (see below) by COVID Alert is not personal information and therefore, the federal Privacy Act did not apply to the app at all," PIAC wrote in its Part 1. The structure of the apps means, PIAC continued, that the role played by Telecommunications Service Providers (TSPs) is central to the functioning of the apps. "Without the transmission or uploading and downloading of positive diagnosis codes (which, to be sent over the Internet must originate on an IP address and thus can be associated with that IP address), COVID Alert would not work," PIAC wrote. Because the positive diagnoses keycodes the app uses to alert users of close contact are associated with IP addresses, and these IP addresses are stored for three months, IP addresses can be easily matched with positive diagnoses of COVID-19. "This means the government can obtain, with a simple request, and with reasonable certainty, the identity of every Canadian testing positive for COVID-19 who has used the app and reported this positive status," PIAC points out. In letters to the CRTC posted to the regulator's website Wednesday, both Rogers Communications Inc. and the industry group Canadian Wireless Telecommunications Association (CWTA) asked for PIAC's request to be thrown out. "Despite the allegations contained in PIAC’s current Application that TSPs are active participants in contact tracing measures and the role of TSPs in privacy violations," Rogers wrote to the commission in a Sep. 11 letter, "the Application gives no real evidence to support these assertions, which Rogers categorically denies in any event." Similarly, the CWTA wrote on Sep. 17 that "CWTA TSP members categorically deny that they are active participants in government contact tracing measures or have engaged in privacy violations in connection with same." In a Wednesday letter to PIAC, the CRTC wrote that it would be opening a proceeding because "the application raises certain policy concerns pertaining to TSPs’ role with regard to customers’ privacy that merit further consideration." However, the CRTC added, PIAC's application "requests regulatory measures that, if granted, would have implications beyond the specific context within which the application was filed." "In addition, the Commission is concerned that a number of other aspects of PIAC’s application appear to go beyond matters directly related to TSPs’ actions, which are not matters subject to the Commission’s regulatory purview under the Act," the CRTC wrote in the letter. As such, the CRTC has decided it will restrict the scope of the procedure to questions dealing with the role of TSPs in the handling of confidential customer information, the question of what information should qualify as confidential customer information, and potential regulations of the "collection, use, or disclosure" of that information. "The Commission will not entertain issues nor consider interventions related to the merits of exposure notification applications nor of the handling of confidential customer information by parties other than TSPs." In May the CRTC received, and rejected, an early request from PIAC to force telecom providers to disclose their contact tracing activities and discussions. In his spring application to the CRTC, PIAC general counsel John Lawford said any contract tracing system must occur in the “fairest, most open and transparent manner, non-coercively and only for the intended purpose(s).” In declining to hold an inquiry, CRTC chief of consumer, research and communications, Scott Hutton wrote in a letter to PIAC that there appeared to be "no evidence that current privacy frameworks are not sufficient to address recent efforts or that initiating a public proceeding would be beneficial to Canadians at this time.” But now, following the launch of both the federal COVID Alert and ABTraceTogether contact tracing apps, PIAC says that its initial application would have helped the app roll out process. "We continue to believe that certain aspects of the previous application remain potentially helpful to the public, to telecommunications providers, to other regulators and to the government (including the Commission)," PIAC wrote, "and that it would have been helpful for the Commission to have considered our initial Application in a timely and thorough matter at that time." "This may have provided a baseline of rules for consideration by the federal and provincial governments in developing their applications and for the telecommunications industry in responding to such apps and systems." There had been some initial confusion about whether or not the Office of the Privacy Commissioner endorsed the federal government's app when it was launched in July. In August, privacy commissioner Daniel Therrien clarified in a letter to opposition MPs that his office did indeed endorse the app, but there remained issues with federal privacy law. “While proper design choices have largely been made in the case of the COVID Alert application,” Therrien wrote in the Aug. 20 letter, “the fact remains that our existing legislative framework for privacy is outdated and does not sufficiently deal with the digital environment to ensure appropriate regulation of new technologies.” Parties have until Nov. 27 to submit responses. — Reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

PIAC requests privacy review of contact tracing apps

News | October 29, 2020

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

PIAC requests privacy review of contact tracing apps

News | October 29, 2020

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Wireless data essential tool for study of urban recovery from pandemic

CRTC rejects Stingray COVID relief request, orders broadcaster to pay $9M in tangible benefits

Government, Telefilm, extend support for uninsured Canadian productions

CRTC sides with creative sector in broadcasters’ CanCon relief proposal

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us