The Office of the Privacy Commissioner has cleared up uncertainty about whether it had approved the federal government launching its contact-tracing COVID-19 app Friday, issuing a statement saying it supports the use of the app.

“The federal and Ontario regulators reviewed the app and provided recommendations to their respective governments based on key privacy principles outlined in a joint federal, provincial and territorial statement on tracing applications. In their view, all of these principles have now been met,” the OPC said in a press release.

Earlier in the morning Friday, government officials had refused to say whether Health Canada implemented recommendations from the Office of the Privacy Commissioner ahead of the launch.

An official said in a technical briefing for the media Friday morning that the government “engaged extensively” with the OPC, but declined to say what the recommendations it received were. The official also did not confirm whether those recommendations were implemented. 

The individual said “some” of the comments were addressed, but said they didn’t want to speak on behalf of the OPC, which would be putting out its own statement later.

The OPC told The Wire Report Thursday it had sent its preliminary recommendations on the federal COVID-19 contact-tracing app to Health Canada — but could not disclose what it told the government.

The comment came a day before the app COVID Alert launched. While it’s a federal app, it’s currently only available in Ontario.

Prime Minister Justin Trudeau initially announced the launch of the app in June — without the privacy commissioner’s sign off.

The COVID Alert app uses the API launched by Apple Inc. and Alphabet Inc.‘s Google. The software doesn’t track the geographic location of phones, but it does use Bluetooth to track how close one device gets to another phone, which allows users to be notified if they were in contact with someone who later tests positive, or notify others. The app is voluntary, and the information that is collected is anonymized.

However, the privacy commissioner noted in its press release that “discussions with the federal government have highlighted broader concerns” about the need to update Canada’s privacy laws.

“The government’s privacy assessment suggests that the federal Privacy Act does not apply to this initiative in light of a government assertion that the COVID Alert does not collect personal information,” the release said. The report said this is a reason to modernize laws.

Alberta, which launched a contact-tracing app on May 1, is the only province to develop its own app. ABTraceTogether also tracks the proximity of phones to each other using Bluetooth. 

The provincial privacy commissioner released its review of ABTraceTogether in mid-July, which showed a level of confidence in the app, with “important but not critical concerns,” according to University of Ottawa law professor Teresa Scassa.

But Scassa noted there are differences in the functionality and interface between the two apps, meaning that resulting privacy and security issues would also be different between Alberta’s app and the federal government’s.

When Trudeau first announced the app in June, a coalition of civil liberties and open internet advocates said the way the app was designed appeared to meet a number of privacy principles, including being opt-in, anonymized “peer to peer, with minimal extension of government surveillance powers and clear limits on how any data can be retained and used.”

But after it was reported the Office of the Privacy Commissioner hadn’t signed off, the group — comprised of the British Columbia Freedom of Information and Privacy Association, the Canadian Civil Liberties Association, the B.C. Civil Liberties Association, the Samuelson-Glushko Canadian Internet Policy & Public Interest Clinic at the University of Ottawa, the International Civil Liberties Monitoring Group, and OpenMedia — said contact tracing apps shouldn’t be launched before privacy commissioners across the country have assessed them.

Earlier this week, Conservative industry critic Michelle Rempel Garner and two other Conservative MPs issued a press release saying they had written to the OPC asking the privacy commissioner to investigate the contact-tracing app, as well as Canada Border Services Agency’s ArriveCAN app, which collects information from travellers. 

The OPC spokesperson said that “regarding the ArriveCan app, the Public Health Agency of Canada (PHAC) consulted with our office in June on border screening activities related to COVID-19, including the ArriveCAN app. We subsequently received a Privacy Compliance Evaluation from PHAC and have provided recommendations. We also requested more information and are awaiting a response.”

 

— With reporting by Anja Karadeglija at akarad@thewirereport.ca and editing by Adam Langenberg at alangenberg@thewirereport.ca