By Denis Carmel
GATINEAU – Back in May, the Public Interest Advocacy Centre (PIAC) had filed an application with the CRTC stating contact tracing applications which were then mostly only on the drawing boards were worrisome and asked the Commission to investigate the wireless carriers’ involvement to ensure there would be no violation of the Telecom Act.
On 17 August, CRTC staff wrote back saying they thought the public interest would not be well served by a public inquiry. However, PIAC is trying again, now that the federal government’s app has launched and has been downloaded by many Canadians (including, fwiw, Cartt.ca editor and publisher Greg O’Brien).
“This new Part 1 Application is now brought, due to revelation of the details of, and the launch of, in particular, the ‘Covid Alert’ app, so that we now are aware of its operation and flaws, and the roles of the TSPs in privacy violations. In short, this Application is specific in reciting the activities and actions of TSPs in contact tracing measures and further, lays bare the lack of existing protections under other existing privacy frameworks and their inability, in any meaningful manner, to control the creation and deployment of DCTTs,” the PIAC application reads.
The so-called Covid Alert App was released on July 30th and is available on Apple Store and Google Play. On the same day, privacy analyses of the app by, separately, Health Canada (Government of Canada) and the Office of the Privacy Commissioner of Canada were also released. Both recommended Canadians download the app.
According to PIAC: “Health Canada, in its privacy analysis, stated that it was of the opinion (one which we do not share) that the information created, exchanged and uploaded by Covid Alert is not personal information and therefore, the federal Privacy Act did not apply to the app at all. While expressing exasperation at this conclusion, the federal Privacy Commissioner’s office did not contradict this assessment, but rather simply pointed to it as ironic.”
“However, what these two analyses clearly demonstrated was that personal information, that is, IP addresses or mobile telephone numbers (for ABTraceTogether), are associated with certain information (positive diagnosis code) sent over the Internet by the apps. These IP addresses (or mobile telephone number) then can be linked to more personal information in the hands of telecommunications service providers (TSPs) with a simple request for TSP subscriber information associated with the IP address or mobile number,” PIAC contends.
For the application used by the government of Alberta, “it appears that when the user of the ABTraceTogether app takes the step of informing Alberta via the app of his or her positive status, that their mobile number is immediately used by Alberta Health to begin the process of contact-tracing, without again requesting consent. More importantly, this now provides Alberta Health with the mobile number of a ‘positive’ user and Alberta Health is now potentially able to approach TSPs to request other confidential customer information from the TSP in relation to the mobile telephone number (for example, name, service address, billing address, and calling records),” continued PIAC’s application.
Yet government communications repeatedly state no personal information is collected by the app.
What PIAC is proposing is “a request of a TSP to the CRTC to permit disclosure of a subscriber’s customer confidential information, other subscriber information or any other personal information in the possession of the TSP (…) based on information created by a ‘Covid app’ provided by a Canadian government or public health authority (…) and proffered as part of a request for related subscriber information, is only valid, and may only be granted,” if it meets a “Covid-app disclosure request” test.
Finally, PIAC proposes the Commission begin looking into contact tracing applications in a more generic way for future implications that go beyond Covid-19.
Basically. PIAC is not proposing a roadblock but perhaps speed bump, to ensure the sharing of personal information requires a little more work.
The May application from PIAC was dismissed summarily by a staff letter, we will see if this one goes any further.
