OPC supports PIAC call for CRTC to clarify rules for tracing apps

While it believes the CRTC's existing definition of "customer confidential information" is broad enough to protect the use of the IP addresses and phone numbers of those using the federal COVID-19 alert app and its Alberta ABTraceTogether counterpart, the federal privacy watchdog has said it would support the CRTC explicitly stating so. The federal Office of the Privacy Commissioner made the statement in an intervention in response to a September Part 1 application from the Public Interest Advocacy Centre, in which the advocacy organization called on the CRTC to examine the privacy impacts of the two COVID tracing applications. "If there is ambiguity on this point," the OPC wrote in its intervention Friday, "we would be in favour of the CRTC clarifying that confidential customer information includes IP addresses and mobile phone numbers." "Similarly, if there is any doubt that the existing rules apply to wireless service providers we would urge the CRTC to make this clear and/or extend the rules so that they apply to all ." PIAC had requested that the CRTC lay out a set of rules telecom providers must follow in handling information passing through the COVID-19 contact tracing apps launched over the summer. In its Part 1, PIAC argued that "IP addresses and mobile telephone numbers, are indeed ‘personal information’, as they can lead, after a second step of requesting subscriber information from a , to identify at the least the account holder of the Internet connection implicated in the COVID Alert and ABTraceTogether processes." As such, PIAC continued, the structure of the app opened the door to governments or law enforcement potentially identifying individuals who had tested positive for COVID-19 based on their IP address associated with the app. "While a customer’s name and address may not be confidential on its own, linking that name and address to an IP address or mobile phone number would reveal confidential information," the OPC agreed in its Friday intervention. PIAC wants the CRTC to set out a test to determine whether or not a hypothetical request from federal or provincial governments to inquire into an IP address “to link to or reveal subscriber information associated with that IP address” for a particular contact tracing app is permitted without explicit subscriber consent. If such a request or linking is permitted, PIAC wants the regulator to determine “what test is required to be met to make such a disclosure and what limits, if any, that test might place on disclosure of such information,” according to its filing. The OPC stopped short, however, of endorsing that request. "In the absence of any identified public health need for obtaining subscriber information of exposure notification app users from a TSP without consent," the OPC wrote, "we do not see a legitimate reason for creating a new exception to the important protections afforded by the CRTC’s existing rules regarding customer confidential information." The Canadian Wireless Telecommunications Association, in its own intervention, called for PIAC's application to be dismissed entirely, calling it a "solution in search of a problem." The CWTA wrote that, to its knowledge, "none of its members have received any requests from government or law enforcement authorities for subscriber information in relation to the COVID-19 apps, nor do they expect to receive any such requests based on the government’s representations that it will not attempt to identify users of the apps." Last month, PIAC general counsel John Lawford acknowledged in a phone interview that there was no evidence any such requests for IP addresses have been made by governments, but said that the rules that govern requests for IP addresses in other situations should be extended to the contact tracing apps. Telecom service providers, the CWTA argued in its Friday intervention, "already have comprehensive lawful access policies and procedures in place to receive, assess and respond to requests for and personal information by government and law enforcement authorities in accordance with privacy laws," as well as CRTC rules. The Samuelson-Glushko Canadian Internet Policy & Public Interest Clinic at the University of Ottawa (CIPPIC) wrote that the question of what is and what is not confidential information would be better addressed in a public notice of consultation. Telecom service providers, CIPPIC wrote in an intervention, "are beginning to undertake more complex data handling practices, including the use of customer data for increasingly sophisticated analytical tasks." "The adoption of more robust transparency frameworks for disclosure of confidential customer information is also becoming increasingly standard, and there may be cause for incorporating these best practices into the Commission’s policy for handling confidential information." Last spring, the CRTC rejected PIAC's request to hold an inquiry into telecom companies' involvement in contact tracing. The request predated the launch of the two apps. There had been initial confusion about whether or not the Office of the Privacy Commissioner endorsed the federal government’s app when it was launched in July. In August, privacy commissioner Daniel Therrien clarified in a letter to opposition MPs that his office did indeed endorse the app, but there remained issues with federal privacy laws. — Reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

OPC supports PIAC call for CRTC to clarify rules for tracing apps

News | 12/01/2020 5:48 pm EST

To keep reading, get a free trial.

Already a Subscriber?

Related Stories

Alberta tracing app review could ‘inspire confidence’: privacy expert

News | 07/14/2020 6:20 pm EDT

Privacy commissioner hasn’t approved new gov’t contact tracing app

News | 06/18/2020 3:48 pm EDT

Pump the brakes on COVID data tracking, advocacy groups warn

Briefs | 04/15/2020 5:35 pm EDT

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us