The Alberta government recently launched a new, voluntary COVID-19 contact-tracing application for Albertans to download to their cell phones and mobile devices, called ABTraceTogether (the “App”). Since the App’s release, it has been downloaded by over 100,000 people.
The App was designed to assist Alberta Health Services (“AHS”) in contact-tracing Albertans who test positive for COVID-19 by using Bluetooth to track whether the App user has come into contact with someone who tested positive for COVID-19. The goal of the App, according to Alberta Chief Medical Officer of Health Dr. Deena Hinshaw, is to expedite information gathering to support the work that public health Contract Tracers for AHS are already doing.
With a goal to re-open the Albertan economy, the Province is encouraging Albertans to voluntarily download and use the App, in order to assist Contact Tracers in their ability to quickly identify and isolate positive cases of COVID-19.
HOW DOES THE APP WORK?
App users who are out in public with their mobile device or cell phone turned on and running the App will exchange Bluetooth-enabled secure encrypted tokens when another mobile device with the App installed and running is detected nearby. No other personal information is shared between the mobile devices using the App.
Currently, if an Albertan tests positive for COVID-19, a Contact Tracer who works for AHS will then contact the infected person to determine others who may have been exposed to the infected person over the previous 21 days. With the introduction of the App, if an infected person is identified and using the App, they will be asked to voluntarily upload the encrypted data from their App to AHS so that AHS Contact Tracers can contact other App users who have had close contact (defined as within 2 metres) with the infected person.
PRIVACY SAFEGUARDS
The Province has introduced specific privacy measures in order to ensure each App user’s personal information remains protected. These privacy safeguards include:
- App downloading is voluntary for all Albertans.
- The only personal information collected to download the App is the user’s mobile phone number, and information about the user’s phone model and signal strength (to measure distance between App users, since different phone models transmit at a different power).
- All information collected by the App is stored in people’s personal phones in an encrypted format, and not with the government or with AHS.
- The App will only communicate with nearby phones for a limited period of time.
- If an App user is contacted by Contact Tracers at AHS, they will ask the user to voluntarily upload data from the App to AHS.
- The App does not track the geographic location of users (this means that the information retrieved will not be able to identify where a user has been, including their city or home address). Instead, with the user’s consent, the App exchanges Bluetooth proximity data with nearby phones also running the App.
- The data exchanged by the App with users is anonymized and encrypted (using a temporary ID), and does not reveal a user’s identity. The temporary ID is refreshed at regular intervals.
- The temporary ID exchange by App users can only be decrypted by Alberta Health and AHS, and does not reveal a user’s identity to AHS or to other App users.
- Once contact tracing of COVID-19 has finished, Alberta will prompt App users to disable the App.
- Consent provided by App users may be revoked at any time by emailing HiaHelpDesk@gov.ab.ca with the mobile number used to register the App.
Currently, due to Apple’s more restrictive privacy settings, the App only works for iPhone users on iOS when their phone is unlocked with the App running in the foreground. In contrast, the App still works while running in the background on Android phones. Developers have said they hope to have an update for this by mid-May.
The privacy statement for the App can be found here. Contact tracing information is being collected by the App under sections 20(b), 22(2)(a) & 27(2)(c) of the Health Information Act1Health Information Act, RSA 2000, c H-5. and sections 33(a)&(c) & 34(1)(a)(i) of the Freedom of Information and Protection of Privacy Act2Freedom of Information and Protection of Privacy Act, RSA 2000, c F-25..
The App was also reviewed by the Alberta Information and Privacy Commissioner (“AIPC”), who stated that the App is a “less intrusive approach” to supplement contact tracing efforts in relation to COVID-19, due to the App: being voluntary, collecting minimal information, using decentralized storage of de-identified Bluetooth contact logs, and allowing individuals to control their use of the App.
More information about the App, and a link to download the App, can be found here.
Carscallen LLP’s Privacy Law Expertise
We understand that the rapid emergence of COVID-19 means that many businesses are dealing with a myriad of legal issues. Please contact us if you have any legal questions about your privacy law obligations in connection with COVID-19, or any other privacy law matters. Our lawyers routinely work remotely and will continue to do so during this time. We remain available to provide legal advice and guidance to clients for all issues that may arise during the Pandemic.
For more updates related to COVID-19, please visit our resources page and follow us on LinkedIn.
As this is an ongoing situation of a global nature, the information provided herein is current as of the publishing date of this blog.
- 1Health Information Act, RSA 2000, c H-5.
- 2Freedom of Information and Protection of Privacy Act, RSA 2000, c F-25.
