Canada’s COVID Alert App: What Businesses and Individuals Need to Know
Posted on August 10, 2020
By: RBS
On July 31, 2020, the federal government released the COVID Alert app. The COVID Alert app has been approved by the Privacy Commissioner of Canada as a reasonable and necessary tool to reduce the spread of COVID-19 while minimizing the privacy impact on individuals.
From a privacy perspective, it is important to note that the COVID Alert app addresses “exposure notification” and does not trace contacts or a user’s location. Unlike the concepts discussed early in the pandemic which raised concerns among the privacy commissioners across Canada, the COVID Alert app is entirely voluntary and collects very little information.
This newsletter provides more information about the COVID Alert app and how it works, and answers some frequent questions.
What data does it collect and how does it work?
The COVID Alert app does not collect any personal information from you, other than to ask which province you live in.
The app does not track your location or any health information about you. It does not know your name or address. It is not a “contact tracing app” that keeps a record of every phone you have been in contact with and provides that information to the government.
Instead, it generates random codes, which change every five to 20 minutes. These codes do not contain any information about you.
The smartphone on which the app is installed then both sends out its code and “listens” for codes from other smartphones nearby. It stores the codes that it “hears”.
If a person who uses the app tests positive for COVID-19, provincial health authorities will give that person a new code and instructions on how to enter it into the app. If the person does so and consents, the app sends certain random codes to a server. The server then sends notifications to other smartphones that have “heard” codes with the diagnosed person’s smartphone within the last 14 days.
The users of the other smartphones then receive a notification from the COVID Alert app that they may have been exposed.
For a more technical explanation about how the COVID Alert app works, see the Government of Canada’s Privacy Impact Assessment or this blog written by the Government of Canada employees who worked on the app.
I am a business owner. Can I require my employees or customers to use it?
The short answer is no.
A primary reason the Privacy Commissioner of Canada has approved the COVID Alert app is that it is based on consent. That is, users have to indicate their consent to download it, use it, receive notifications from it, and enter the code to notify others if they have tested positive.
Generally, businesses cannot require their employees or customers to consent to the collection, use or disclosure of any personal information beyond what is necessary to employ them or provide them with a service.
Businesses are already required to collect the names and contact information of customers to provide to public health officials if there is an exposure at their business for contact tracing. That means there is already a procedure in place to notify people who have been exposed to COVID-19 at that business. Since the COVID Alert app also notifies people, it duplicates this same process and so it is not necessary as set out in the privacy legislation.
Can the government or other people identify me through the COVID Alert app?
The short answer is that it is not completely impossible for you to be identified through the COVID Alert app, but it is highly unlikely except in certain circumstances.
No level or part of government can identify you. The app does not collect, store or send out any personal information about you to the government or anyone else. Because of that, no level of government obtains any information about you from the app at all.
There is a small possibility of being identified by other people. If you have interacted with only a very small number of people over the previous 14 days and you receive a notification that you have been in contact with someone who has tested positive, you may be able to identify that person. Similarly, if you test positive, the small number of people who have been in contact with you may be able to identify you.
As the Privacy Commissioner of Canada has noted, there are only very limited circumstances where this is possible, and so it is very unlikely.
Do I have to download it?
No, you do not have to download it.
The COVID Alert app is based on the concept of consent. Using it is completely voluntary. As explained above, businesses and employers cannot require you to download and use it.
Where can I get the COVID Alert app?
If you choose to download the COVID Alert app, you can find it in the Apple App Store or the Google Play Store.
For more information on COVID-19 and privacy, read these previously published articles: