Health officials across Canada are using data from Uber to beef up their contact-tracing efforts in a bid to slow the spread of COVID-19, The Logic has learned.

Ten Canadian public health units have made a total of 145 requests for data from Uber since the ride-hailing giant launched a tool that lets health officials quickly access personal information on riders and drivers who may have come in contact with someone infected.

Uber’s tool, which it launched last week, is available everywhere the company operates. So far, public health units across 29 countries have made 563 total requests for COVID-19-related data. The firm typically processes requests within two hours “if properly filed,” said Mike Sullivan, director of Uber’s global law enforcement unit, which developed the tool. Reuters first reported on the existence of the tool on Monday.

Uber would not confirm with which Canadian public health units it is working. The Logic reached out to public health authorities in its nine biggest Canadian markets, but none responded to the request for comment by publication time. 

The service is an extension of Uber’s law enforcement and public safety portal, which provides law enforcement officials with user data when Uber is legally compelled to, or when its team of internal and external law enforcement experts determines it’s in the interest of the public safety to do so. 

The portal’s new features allow public health officials to request information on a driver or rider they know or suspect has tested positive for COVID-19, or who they suspect has come in contact with someone with the virus. Uber may provide the health official with names and contact information of other Uber users whom a COVID-19-positive driver or rider may have encountered. The official can also advise Uber on how to manage a user who is thought to have come in contact with the virus by, for example, locking their app for 14 days.

Uber will disclose information if it “has a good-faith belief that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of information relating to the emergency,” it stated in a disclosure notice on its website. “It is Uber’s position that outbreaks of infectious disease where public health officials have declared a public health emergency under applicable law qualify as emergencies.” The company said it may also share data voluntarily with public officials if it is related to a public health emergency, even in the absence of a government-declared state of emergency.  

The company has developed the tool as governments worldwide turn to technology to bolster their efforts to track and stymie the spread of COVID-19. In Canada, the federal government is working on a Bluetooth-based exposure-notification app in partnership with the province of Ontario, using Google and Apple’s decentralized API and code developed by a team of engineers from Shopify and BlackBerry. The app, announced with much fanfare in June, was meant to launch on July 2, but has been delayed as its developers resolve several bugs, Health Minister Patty Hajdu told CBC News. Other provinces have entertained the idea of using cellphone data to monitor people’s movements and warn them of potential contact with the virus.

Government partnerships with tech firms have invited criticism around possible privacy violations. However, Ann Cavoukian, a former privacy commissioner of Ontario, told The Logic that Uber’s involvement in contact tracing is particularly concerning from a privacy perspective. 

“I think it is completely unacceptable that the judgment for these kinds of calls on disclosure of sensitive personal health information is going to be made by [Uber],” said Cavoukian. 

Google and Apple, by comparison, do not have access to users’ identities when they download an app based on the tech firms’ framework; those apps also rely on self-reported data and let users decide themselves whom they want to notify if they’ve come in contact with the virus. And Uber is not getting users’ explicit consent to share their data with health officials, said Cavoukian, which she said should happen every time someone uses the app. “I’m betting that’s never going to happen. I think if the public was fully aware of this Uber would lose a lot of business,” she said, adding that the company’s disclosure on its website isn’t sufficient. “People aren’t going to read whatever’s on their website.”

Sullivan said the service complies with Canada’s privacy laws. “We don’t provide data unless we are requested for that information. The information is commonly requested either by a lawful order—court order, search warrant—or health order or emergency request from a public health authority,” said Sullivan. “Should we receive a health order or emergency request that is specific and narrowly tailored, then we are going to support public health, provided we can verify it is a public health authority and we can validate the user who’s requesting the data.”