Alberta tracing app review could ‘inspire confidence’: privacy expert

In its long-awaited privacy review of ABTraceTogether, Alberta's COVID-19 contact tracing app, the provincial privacy watchdog has recommended that Alberta Health update its description of the app in online stores, further encrypt "data at rest" in the app, and consult with provincial privacy authorities around the decommissioning of the app. Those concerns are "important but not critical," according to University of Ottawa law professor Teresa Scassa. She said the report from the Office of the Information and Privacy Commissioner of Alberta, released Monday, may have a ripple effect on the uptake of such apps by the general population. "It may be that such a detailed review will help inspire confidence in how governments unroll these apps, and I would expect other jurisdictions to involve their privacy commissioners in similar reviews," Scassa wrote. She added that the privacy commissioner seems to have a level of confidence in the province's app. "The OIPC in Alberta seems to feel that it does a decent job of protecting privacy. It can clearly be improved, and there are some important issues that need to be addressed. But this report does not require the use of the app to be halted," she wrote. Among its concerns, the report acknowledges particular concerns about the collection of data using Bluetooth "handshakes." As such, the watchdog has recommended that the health authority change the description of the app in online stores to more accurately reflect the amount of data that is collected and the length of time it is stored for. "From our review of similar technologies implemented around the world, ABTraceTogether collects among the least amount of information at the time of registration. However, we noted during our review that there is a risk of over collection or disclosure regarding the Bluetooth contact logs," commissioner Jill Clayton wrote in the report. The app's description in the both Alphabet Inc.'s Google Play Store and its Apple Inc. counterpart say the app maintains Bluetooth contact logs -- in which two phones with the app installed that come into proximity of one another and generate a record of the interaction, known as a "handshake" -- for a period of 14 days. The OIPC's report said that "is inconsistent with information provided in its , and our understanding of how the app functions (i.e. contacts are logged for 21 days)" "In our view, it would not be clear to users of the app that 'all' of the 'handshakes' that occur are logged, given the app has generally been described publicly as recording encounters that are two meters or closer and a minimum of 15 minutes in duration." In fact, the app collects data on all handshakes, according to information supplied to the OIPC by Alberta Health. The agency recommends that Alberta Health "work towards limiting collection of 'handshakes' through any means available to them," and to update the agency's privacy impact assessment to reflect the nature of the app more accurately. The Alberta app is the first contact tracing app for tracking the virus launched in Canada, and the OIPC's assessment is the first in the country. Last month, Prime Minister Justin Trudeau announced that the federal government would be launching its own contact tracing app, but without any assessment conducted by the federal Office of the Privacy Commissioner. In an email to The Wire Report, Scassa noted that there are differences between the Alberta app and the upcoming federal app. "The federal solution and any apps that will be on it will be exposure notification apps rather than apps integrated with the provincial contact-tracing system. As a result, the functionality will be different, the interface with Android and Apple systems will be different, and some of the privacy/security issues will also be different," she wrote. The OIPC report says that the Alberta app has not put it place enough risk mitigation for those who may be running the app on devices issued by their employers that may contain other health or personal intervention, possibly exposing that information, contravening provincial laws governing health data. Scassa said "if people carry only one phone with them, and choose to carry a work-issued phone, then they should not have this app on that phone, and as a result will not be participating in the digital contact tracing system.” Brenda McPhail, director of the Privacy, Technology & Surveillance Project at the Canadian Civil Liberties Association (CCLA), said the OIPC's call for Alberta Health to change the description of the app's Bluetooth "handshake" function is significant. "If the description doesn’t actually convey how it works, it if glosses over the privacy risk or fudges the way the app actually works, it may reasonably undermine that trust," McPhail wrote in an email to The Wire Report. She also said that the report should help to guide the roll out of other apps across the country. "This report should be required reading for everyone involved with implementing the federally-endorsed contact tracing app—both because it highlights predictable privacy risks that should be mitigated," McPhail wrote, "and because it highlights that technical privacy protections in the app are not enough, there has to be a training process for people using the data and critically, there has to be a policy framework to supplement the protections built into the app." Last month, the CCLA was one of a cohort of organizations calling on the government in an open letter to conduct its privacy assessments before the launch of contact tracing apps. “It is concerning that a deployment date has been publicly announced before the federal Privacy Commissioner has been given the opportunity to comprehensively review the application and its privacy impacts,” the letter read. While the OPC declined to comment on the contents of the OIPC's report, or on the app itself, a spokesperson wrote in an email to The Wire Report "we follow with interest the activities of other privacy protection guardians." Elsewhere, the report acknowledges that the app has "reasonable" mechanisms to protect the data collected by the app -- including storing the data in Canada, on IBM servers in Montreal -- but recommends that the app further protect user data through a cryptographic practice known as "salting," which further obscures identifying information. The Alberta privacy watchdog has also called on the health authority to include its plans for decommissioning the app in its privacy impact assessment, while acknowledging it is satisfied with information it received during its review. "We have asked to be involved when the time comes to dismantle the app, and have recommended AH report its decommissioning plans publicly," the report reads. Back in June, Clayton said at the Privacy and COVID-19 Mini-Summit hosted by the Canadian Anonymization Network that she had concerns about the app's ability to be used for quarantine enforcement, or by law enforcement more generally. In responses to questions from the OIPC, the province's health authorities said they will not use the data for enforcement. "Alberta Health and Alberta Health Services and their respective affiliates shall not use or disclose information collected via AB TraceTogether for quarantine enforcement measures; this includes disclosures to law enforcement for the purpose of enforcing quarantine requirements," they told OIPC, according to the report. However, the OIPC says it is still unconvinced, given that the laws the app operates under authorize exactly that. "In our view, there is a risk that information collected through ABTraceTogether could be used for quarantine enforcement," the report says, but adds that the health agency's policies against such secondary uses "is an acceptable risk mitigation measure." On Monday, Alberta premier Jason Kenney accused the federal government of interfering with attempts by the province to work with Apple and Google to fix problems associated with the need to run the app with the device unlocked on Apple devices. The OIPC's report stated that the requirement posed a security risk. "Unfortunately the government of Canada has told Google and Apple not to work with the government of Alberta — or other provincial governments — on improving the TraceTogether app," Kenney said at a press conference Monday, as reported by CBC. In late May, federal privacy commissioner Daniel Therrien told the House industry committee that outdated privacy laws would hamper the level of trust in contact tracing apps. — With reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Alberta tracing app review could ‘inspire confidence’: privacy expert

News | July 14, 2020

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Alberta tracing app review could ‘inspire confidence’: privacy expert

News | July 14, 2020

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Eastlink unveils video streaming app

OPC supports PIAC call for CRTC to clarify rules for tracing apps

Privacy commissioner hasn’t approved new gov’t contact tracing app

Pump the brakes on COVID data tracking, advocacy groups warn

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us