This article is a preview of The Logic’s exclusive journalism.

Get complimentary access to award-winning reporting to navigate these unprecedented times. Sign up now.

The Canadian Civil Liberties Association is calling for governments to impose mandatory data tracking-based measures to combat COVID-19 only as a “last resort,” and to go beyond existing privacy laws to safeguard citizens’ rights in any use of technology to fight the pandemic. 

In a letter sent Monday to Prime Minister Justin Trudeau and all 13 provincial and territorial premiers, the watchdog group warned that any such program should be based on real public health needs, should seek meaningful consent from the people being monitored and should be closely overseen by privacy commissioners.

The CCLA’s recommendations are a response to increasing public calls for—and government interest in—technological fixes for the COVID-19 outbreak, said Brenda McPhail, director of the group’s privacy, technology and surveillance project. 

On Friday, Innovation Minister Navdeep Bains said Ottawa has “engaged with a world-class group of people across the country that are working on some early-stage technology projects.” While the federal government hasn’t yet decided what if anything it will deploy, he insisted that any such effort would “deal with issues with respect to privacy in a meaningful way.”

At the provincial level, Alberta Premier Jason Kenney said it may be necessary to emulate the examples of Singapore, South Korea and Taiwan, where he said technology has been used to enforce quarantine orders. And Ontario Premier Doug Ford has not ruled out the use of cellphone data for contact tracing.

Antiviral tech systems may be “nice to have, but not necessary,” while the efficacy of some approaches has not been proven, McPhail told The Logic. For example, both Bluetooth- and GPS-based contact tracing may produce false positives and negatives, showing people were in close proximity even if they weren’t, or missing other encounters. The CCLA letter, signed by McPhail and executive director Michael Bryant, says data-driven measures should only be used if they are “likely to be effective,” and where less privacy-invasive solutions don’t exist. 

“We’re very aware that our elected officials are probably getting bombarded with calls to do something,” said McPhail. “We’re particularly concerned that that ‘something’ be relevant for the purpose, which is public health.” The CCLA is calling for any government that imposes a technological system to first obtain a “data warrant” from that jurisdiction’s chief medical officer, which would lay out why personal information must be collected—including that there’s no other way to get it—and how it will be used. 

Organizations collecting personal information in Canada are already legally required to take some of the actions the CCLA letter recommends, such as getting the consent of those involved. But McPhail is concerned that “an emergency order might be passed that would attempt to circumvent some of the customary requirements under privacy law.” 

The CCLA also wants governments to analyze the effects of any system on vulnerable and marginalized populations before rolling it out. McPhail cited proposals like an AI-based app that Yoshua Bengio, scientific director of the Mila institute in Montreal, is co-developing, which traces users’ movements and provides an automated infection risk assessment. “If you follow it through to its natural conclusion, [that] would have a disproportionate effect on people who are poorer,” she said. Residents of communal housing might be classed as higher risk than those in standalone single-family homes, for example.

Any system put in place to collect personal information or use it to track people should be time-limited, lasting only as long as the government has emergency orders in place to fight COVID-19, the CCLA recommends. Privacy commissioners, or an “independent surveillance ombudsperson,” should oversee the program and act on public complaints. On Friday, the federal privacy commissioner’s office published its own framework for assessing Ottawa’s antiviral efforts, the principles of which included necessity, proportionality and time limits, as well as using “de-identified or aggregate data wherever possible.”

The CCLA also recommends that any data collected as part of efforts to combat COVID-19 be firewalled from other agencies such as the police or the Canada Border Services Agency, and destroyed once the emergency has ended. That won’t prevent provincial medical authorities from sharing important epidemiological information with each other or their federal counterparts, McPhail said. But “if your information is genuinely being collected for public health through any kind of surveillance … it [shouldn’t] end up part of criminal prosecutions.”

McPhail noted there have been early reports of “over-policing” and ambiguity about residents’ obligations under social-distancing orders. In Waterloo, regional police now have access to COVID-19 testing records, sharing that’s enabled by the provincial government’s emergency order. 

“There’s no technological silver bullet for enhanced social control,” said McPhail. “Politicians [need to] take the time to come up with solutions—if there are any—that are fit for purpose, respect privacy rights and the rights of the vulnerable, and [are] accountable to us.” 

***

Our reporting team is working tirelessly around the clock to deliver the very latest information on the COVID-19 crisis. If you like our journalism, please consider subscribing. You can get a subscription today for more than $100 off your first year.