CRTC clarifies privacy rules for COVID tracing apps, declines to establish new regulations

The CRTC has clarified the rules around the collection and sharing of data from mobile wireless devices in the context of the contact tracing apps that were a major feature of public health policy in the early months of the pandemic. In a Tuesday decision, the regulator clarified that IP addresses and unlisted wireless telephone numbers are to be considered confidential customer information (CCI). Further, the commission determined that the current rules around CCI prohibit telecommunication service providers (TSPs) from disclosing a customer's name, address and listed telephone number if the TSP is approached with CCI relating to that customer such as an IP address or telephone number. While allowing that the consent given by users in the sign-up processes for both the federal COVID Alert app and Alberta's provincial ABTraceTogether app does not appear to give adequate consent for the disclosure of subscriber information linked to IP addresses or mobile wireless phone numbers, the CRTC declined establish a specific regulatory test for such disclosure. That regulatory test had been a specific request of the Public Interest Advocacy Centre, when it filed its Part 1 application in September of 2020 at the start of the second wave of the COVID-19 pandemic. The federal privacy watchdog intervened in the proceeding, supporting PIAC's call for a clarification of the rules around the disclosure of information. PIAC made the request six months after the CRTC had declined to launch a full inquiry into the data collection done by contact tracing apps. The apps, PAIC pointed out, need an IP address to function. “PIAC contends that the IP addresses and mobile telephone numbers, are indeed ‘personal information’, as they can lead, after a second step of requesting subscriber information from a , to identify at the least the account holder of the Internet connection implicated in the COVID Alert and ABTraceTogether processes,” the Part 1 application argued. In Tuesday's decision, the CRTC ultimately agreed with PIAC's assessment about this triangulation of data, writing that it "acknowledges that an IP address or a mobile wireless telephone number, on its own, cannot be used to identify an individual. However, when connected with other information, it can be used for that purpose." "Accordingly," the CRTC added, "any IP address or unlisted mobile wireless telephone number associated with a customer is to be considered CCI." The rules surrounding CCI prohibit a TSP from "releasing any customer information as part of a disclosure request, including the customer’s name, address, or listed telephone number, where it could be used in conjunction with any CCI to individually identify a customer, unless one of the disclosure exceptions applies." The rules are strong enough, the commission concluded, that it did not have to intervene beyond its confirmation of existing rules around disclosure of CCI, and thus declined to establish any new procedures or regulations for TSPs over data collected by the contact tracing apps. The CRTC wrote that "the record of this proceeding does not provide compelling evidence as to why compliance with constitutionally compliant legislation raises concerns that need to be addressed by the Commission." "It would not be appropriate for the Commission to adopt measures that would have the effect of preventing or hindering an entity from complying with legislation duly enacted by the relevant legislature in pursuit of public interest objectives or with statutory instruments adopted pursuant to such legislation," the regulator wrote, referencing the creation and functioning of the apps. — Reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Paul Park at ppark@thewirereport.ca

CRTC clarifies privacy rules for COVID tracing apps, declines to establish new regulations

News | September 6, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

CRTC clarifies privacy rules for COVID tracing apps, declines to establish new regulations

News | September 6, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Telus’ arguments for incumbent access to wholesale regime not supported by competitors

CRTC finalizes terms of Uvagut TV distribution

Bell won’t participate in subsidized broadband projects if wholesale access for Big Three continues, signs agreement with CNOC

CRTC announces changes to Broadband Fund

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us