TORONTO -- Federal and Ontario privacy commissioners have concluded their review of the country鈥檚 new COVID-19 exposure notification app and say they support its use following initial privacy and security concerns.
Experts and lawmakers have been assessing privacy concerns associated with contact tracing apps in an effort to curb the spread of the virus, and commissioners say that the federally developed app has met all of their recommendations.
COVID Alert was launched in Ontario on Friday, and already
鈥淐anadians can opt to use this technology knowing it includes very significant privacy protections,鈥 says Daniel Therrien, Privacy Commissioner of Canada in 鈥淚 will use it.鈥
The app is designed to notify users when they鈥檝e been in close contact with someone who has tested positive for COVID-19.
However, it does not track a user鈥檚 location itself, or use GPS.
Instead, the app produces random codes, and uses Bluetooth to ping other users鈥 phones and exchange these codes whenever two people who have the app are physically near one another.
鈥淭hey kind of handshake electronically,鈥 Carmi Levy, a technology analyst, explained to 麻豆影视 Channel on Monday.
This means that if a person with the app reports that they have COVID-19, the app can send a notification to anyone who came close enough to that person to receive the specific code within the last 14 days.
鈥淚t gives you awareness of when you鈥檝e crossed paths with someone when it鈥檚 problematic,鈥 Levy said, which can let a person know that they 鈥渕ight want to head for the testing centre.鈥
According to the Government of Canada鈥檚, 鈥渘obody will get any information about you or the time you were near them.鈥
For months, privacy watchdogs have been sounding alarms regarding potential security risks associated with contact tracing apps, as other nations look for ways to curb new infections.
Privacy commissioners across Canada advising their respective governments of key privacy principles needed to protect the identity of users and their data.
The use of the app is voluntary and commissioners say it has been developed with robust safeguards; however, they also noted the risk of third parties who may seek to compel the app鈥檚 users to disclose information.
The federal government has agreed to involve the Office of the Privacy Commissioner of Canada (OPC) in an audit of the app after it is up and running, though no official details have been announced. The audit will include an ongoing evaluation of the app鈥檚 effectiveness and security measures.
In the meantime, several Twitter users have pointed out that the app asks for to a users鈥 phone and private data than apps such as Facebook and TikTok.
Michael Geist, a law professor at the University of Ottawa and the Canada Research Chair in Internet and E-commerce Law, explaining why he was in favour of the app -- and why he himself had already downloaded it.
鈥淭he Canadian COVID Alert app is ultimately as notable for what it doesn鈥檛 do as for what it does,鈥 Geist wrote. 鈥淭he voluntary app does not collect personal information nor provide the government (or anyone else) with location information. The app merely runs in the background on an Apple or Android phone using bluetooth technology to identify other devices that come within 2 metres for a period of 15 minutes or more.鈥
He added that, 鈥渇rom a privacy perspective, this is very low risk.鈥
He said that he was persuaded to download the app onto his own phone by the privacy safeguards in combination with the public health benefits of having the app.
鈥淭he relative ineffectiveness of contact tracing apps elsewhere surely influenced the decision to adopt an exposure notification app which raises fewer privacy concerns and is more effective for its limited goal of notification rather than tracing,鈥 he wrote.
Contact tracing apps in other countries have largely had a rocky reception. An app used in Norway called 鈥淪mittestopp鈥 was pulled after a wave of criticism over its use of GPS data and real-time tracking of its users. The company behind that app also developed apps in use in Bahrain and Kuwait. Amnesty International鈥檚 Security Lab has urged those countries to cease using those apps.
Although experts are saying the app doesn鈥檛 raise privacy concerns itself, discussions between the OPC and federal government have pointed out broader issues related to the adequacy of Canada鈥檚 privacy laws.
A statement from the OPC asserts that given the app does not collect personal information, it is in the government鈥檚 view that the federal Privacy Act does not apply to the initiative.
鈥(I)t bears noting that an app, described worldwide as extremely privacy sensitive and the subject of reasoned concern for the future of democratic values, is defended by the Government of Canada as not subject to its privacy laws,鈥 the OPC鈥檚 review report notes.
鈥淭his is again cause for modernizing our laws so that they effectively protect Canadian citizens.鈥
