My Take: Contact Tracing Apps in Canada
The situation with the pandemic has upended many old ideas about what is possible and how the economy and society will function.
Since I “jumped the fence” from digital marketing & analytics to privacy and the ethical use of data, the discussions about contact tracing apps have occupied a fair amount of my time. Those apps appears to be a critical part of reopening our economies and they have fuelled the debates that have been happening for many years in the world of marketing and analytics.
Today, I see a “conditioning” of the masses to accept things which would have been inconceivable just a few months ago. At the same time, we understand there’s an urgency — many rightly make a parallel with WWII — and we are willing to sacrifice some of our privacy to fight a common enemy. Call it the “new normal” if you like, but at what cost, and what are the longer-term consequences?
My take #1: We are being conditioned to accept a new, lower level of individual privacy.
A Bluetooth Shiny Object
The main method of contact tracing being discussed today is through the use of the Bluetooth protocol. Something which was never meant to be used in this way and has many drawbacks. In a nutshell, this approach isn’t based on “location” but on “proximity” — as two devices with a compatible app get close, they exchange encrypted keys which allow to trace the chain of contacts if someone is found to be infected at a later time.
But what happen if two people stand on each side of a plexiglass? What’s the difference between 5 minutes in an elevator with 2 people compared to being outside with 10 people for 30 minutes? Without context, this kind of data quickly becomes useless, let alone the many risks of hacking and abuse which were raised by media outlets and security experts¹ ².
Update 2020–05–21: In fact, Bluetooth alone can’t solve this, but if combined with GPS and the altimeter capability of the phone, you can solve this challenge in a 3D spacial environment. Plus, context can be gleaned through traditional qualitative data such as “do you work in an environment where you stand behind a plexiglas” or “does your work implies working closely with Covid-positive people?” (such as healthcare). This is the approach the COVI app is pushing for, as explained by Valérie Pisano from MILA during a webcast on May 21st. The key element, obviously, is to preserve privacy and build trust.
It seems like contact tracing has been a key part of the successful reopening of other countries around the world. Has the roll-out of this technology really worked? Is it a placebo so we accept the fact we simply don’t have control, and we won’t until a vaccine is largely available?
My take #2: The real impact and benefits of Bluetooth-based contact tracing apps remains to be demonstrated.
South Korea is often cited as an example — and maybe rightly so from an epidemiology standpoint, maybe not so much from a privacy one. We should know in 2015, South Korea had to quarantine 17,000 people because of MERS³. They learned the importance of early testing and implemented legislation which allows to aggressively trace the footsteps of citizens who test positive: security camera, credit-card records, GPS, car navigation systems, even conversations!
Singapore, with their TraceTogether app, is another example. Even before the app was deployed, they were super quick to trace back the patient’s movement and interactions in the 14 days before hospital admission⁴. Their approach was so effective that 40% of those contacted had no idea they might have been infected, and we now know about 50% of those infected are asymptomatic. Yet, only one in six people installed the app.
Iceland, with fewer than 400 000 people, has the highest usage rate, at 38%. The app uses GPS location, and yet, it is deemed ineffective compared to traditional methods⁵.
A survey revealed more than half of the American people surveyed wouldn’t want to use an app, and according to a study from Oxford, to be effective, there needs to be 56% of the population using an app to get any hope of a real impact⁶.
In most cases, the app is not mandatory, but it is strongly encouraged.
The director behind the Singapore app came out with a strong warning: those apps have shortcomings… artificial intelligence can’t compensate for nuances that human workers can do. Testing should still be the primary weapon — the TraceTogether app was designed to supplement manual tracing, not replace it⁷.
As of today, South Korea has done about 13 tests per thousand inhabitants. In Canada, it’s close to 30⁸, in Québec it’s now close to 40, Alberta does the most and is above to 45⁹.
Update 2020–05–21: According to MILA’s own research, 10% would be sufficient, and 75–80% of Canadians said they would be willing to install such an app (source unknown).
My take #3: To have any hope of being effective, a contact tracing app needs to be introduced early, be largely adopted by the population, and complement large scale tests in the general population.
Total COVID-19 tests per 1,000 people
An interactive visualization from Our World in Data.
What About the Law?
There’s a very thin red line here. Under GDPR in Europe, the law describes a number of “lawful basis for processing” data. Two of them are relevant: “vital interests” and “public task”¹⁰. Nevertheless, the unique scenario of a pandemic is creating a privacy debate¹¹. So, for example, telecom companies are sharing location data with the health authorities — no app, no Bluetooth, no GPS, no consent needed… the data is already available because cell phones constantly “ping” the closest cell towers to get the best signal. This creates a triangulation with the nearest towers and provides a very accurate location — all the time, everywhere you go, as long as your cell is open.
In Canada, the privacy commissioner¹² has offered some guidance, including that it must be voluntary and obtained through meaningful consent. Personal data collected through those apps should be de-identified and used only for the intended purpose for which the user gave consent. In fact, those principles aren’t different from what is required when any business collects personal data today¹³.
Some countries do not have such kind of privacy concerns… in South Korea, there’s a public map of where infected people are/were.
In Israel, it’s the internal security agency who is responsible… they are used to this kind of people tracing since they’ve been doing it since 2002¹⁴!
Like many areas related to healthcare, there is a crossing of jurisdictions between federal, provincial, and likely even municipal. How effective can a roll-out be if every province go their own way?
As we’ve seen for South Korea, if only about 15% of the people use the app, it won’t really achieve critical mass and be effective. Should there be a coordination at the federal level? It would be nice, but the reality is each province will decide — or has already decided. Alberta already has the ABTraceTogether app¹⁵, but a little more than 2 weeks since its launch, the adoption rate was about 4%¹⁶. Newfoundland is working on something, and to my knowledge, Ontario is considering about a dozen different solutions… obviously, only one should be selected if there is any hope of achieving a minimum adoption level.
Québec seems to be leaning toward an application developed by MILA, the artificial intelligence lab of Université de Montréal, under the supervision of Yoshua Bengio, a renowned AI researcher. But there’s a twist — although the app could leverage the PrivateKit developed jointly by Google, Apple and the MIT already available with the latest version of your phone operating system, which uses Bluetooth, the project would also use the GPS. To alleviate the justified privacy and ethics concerns, the source code will be open and an advisory committee of experts and public representatives will act as a watchdog. The data will be shared with academia and Public Health¹⁷. The app is planned to launch in early June.
My take #4: Bluetooth, alone, is no miracle cure — and I’m afraid the real solution implies dropping more privacy crumbles on our path.
COVI - Together, in motion against Covid-19
COVI empowers each individual to protect themselves, limit the spread of the virus and facilitate a smart and safe…
Montréal, Québec, Canada
My home province of Quebec is one of the hardest hit by the pandemic, but it’s also one of the first provinces to take the steps to restart its economy.
I’m not an epidemiology expert or healthcare official, but as a citizen, I think the situation is worrying, especially in Montreal. As of this writing, masks aren’t mandatory. Not even in public transport, and people are “invited” to wear them in public.
Tests were also an issue and only people with symptoms were being tested — while there seems to be consensus among the experts that massive testing of the general population is the only way to assess and control any resurgence of cases in specific areas.
Conditions for Acceptability
The Privacy Commissioner of Canada has worked to reign in and set guidelines around this technology to give consumers and citizens’ rights while also allowing them to opt-in to technologies. Earlier this month, the federal, provincial and territorial privacy commissioners, calling themselves privacy guardians, have issued a statement stating that done correctly these tracing apps can safeguard health and privacy. Those guidance points are :
- Consent and trust: it must be voluntary.
- Legal have a legal basis and consent must be given willingly (meaningful consent).
- Must be science-based and used for a specific purpose.
- Must be limited to health-related solutions, nothing else (ex. marketing!).
- De-identification or anonymization.
- Time-limited — even if for now, we have no clue how long the pandemic is going to last.
- Transparent about what data is being collected, how it will be stored and used, and who will have access, how it will be secured and eventually destroyed.
- There needs to be a clear accountability.
- And lastly, there must be appropriate technical and legal safeguards — be it encryption or strong contractual measures.
A Framework for the Government of Canada to Assess Privacy-Impactful Initiatives in Response to…
The safety and security of the public is of grave concern in the current COVID-19 health crisis. The urgency of…
The Commission de l’éthique en science et en technology du Québec has published an amazing document stating the “Conditions for Ethical Acceptability” in the context of the MILA Application.
Enjeux éthiques liés à la pandémie de COVID-19
La Commission oriente une partie de ses travaux vers les enjeux éthiques liés à la pandémie de COVID-19 et aux réponses…
My take #5: We can strike the balance between what’s best for the public interest while preserving our individual freewill and right to privacy.
What Have We Learned?
Be it GDPR in Europe, the Canada Anti-Spam Legislation (CASL), or the Personal Information Protection and Electronic Documents Act (PIPEDA) — in a nutshell, and where my interest lies, are those are codifications of what we accept as being ethically and collectively, as a cultural entity, acceptable. So, of course, laws do not always perfectly reflect the current state of the world…
In my opinion, some things are clear: in the current context, it would be unacceptable to let a corporate entity suddenly find a new vocation and decide they want to collect this kind of data for a profit. There needs to be transparency, safeguards in the form of open source or independent scrutiny, ethic boards, legal review, and the data must be used by people who have the scientific rigour, peer review and proper accountability to public health and government officials.
Putting Big Data and nice visuals together doesn’t make one an expert in epidemiology.
For example, a local marketing agency specialized in location-based mobile advertising has received a lot of press and TV coverage. They decided to use the nearly 7 billion data points gleaned through 8 million cell phones across Canada ¹⁸. Putting Big Data and nice visuals together doesn’t make one an expert in epidemiology — especially if the methodology isn’t disclosed, there is no peer review, and if the exact method of data collection isn’t declared… let alone the fact users never gave consent for such reuse of their data, even if anonymized and aggregated. The net result is a news anchor showing a graph and leaving it up to the audience to figure out what it means… this, in my opinion, is irresponsible and dangerous.
Vidéotron, a leading cable and cell provider in Quebec, announced a Bluetooth-based bracelet which employees could wear in the workplace so they get a warning when standing too close to a colleague. Of course, every one of their contacts can be traced ¹⁹. From a technological standpoint, the geek in me find this very interesting, but if I wear my privacy advocate hat, this should raise serious privacy concerns…
My take #6: Considerations of the downsides, negative, and potentially evil must always take precedence over goodwill and techno-solutionism.
My (final) Take
The United Nations chief and many world leaders have declared this pandemic to be the biggest crisis since WWII²⁰.
In the spectrum of “techno-solutionists” who believe that given the right code, algorithms, robots and technology can solve all mankind problems²¹, the “catastrophists” which state the Earth (and thus, Humanity) has largely been shaped by sudden, short-lived, violent events²², and the security or privacy radicals who will call Evil to any contact tracing apps even before it is released, I think — I hope — there is a possibility to strike the balance between public interests and the right to individual privacy.
Have you noticed how commercials are strikingly similar²³? Similar music, visuals and message. Some see it as a lack of creativity and rushed marketing initiatives — I prefer to see it in the same way ads during WWII communicated a sense of mobilization, cooperation, dedication, sacrifice, and resiliency.
Lives are being lost and the upcoming economic meltdown is likely to hit hard. I hope our privacy sacrifice will be a useful contribution. Many things will change post-covid, and hopefully, like after WWII, there will be a boom in innovation and a strong economic recovery.
Stéphane Hamel is a seasoned independent digital marketing and analytics consultant, innovator, teacher and speaker with a strong interest for user privacy and the ethical use of data.
All the world is made of faith, and trust, and privacy dust.
¹ There are many reasons why covid-19 contact-tracing apps may not work, NewScientist, 17 April 2020
² Why Bluetooth apps are bad at discovering new cases of COVID-19, The Verge, 10 April 2020
³ What we can learn from South Korea and Singapore’s efforts to stop coronavirus (besides wearing face masks), MarketWatch, 6 April 2020
⁴ Singapore’s coronavirus playbook: How it fought back against the COVID-19 pandemic, c|net, 22 March 2020
⁵ Covid-19 : En Islande, l’application de pistage du gouvernement ne porte pas ses fruits, L’usine Digitale, 13 May 2020
⁶ Am I a Jerk for Refusing to Use a Coronavirus Contact Tracing App?, Vice, 13 May 2020
⁷ Tech isn’t solution to COVID-19, says Singapore director of contact tracing app, c|net, 13 April 2020
⁸ Total COVID-19 tests per 1,000 people, Our World in Data, May 19, 2020
⁹ Données COVID-19 au Québec, INSPQ, May 19, 2020
¹⁰ Lawful basis for processing, ICO, retrieved May 19, 2020
¹¹ Guidance from the EDPB and the CNIL for GDPR‑Compliant Covid-19 Contact Tracing, HHR, April 17,2020
¹² Canada’s privacy commissioners offer guidance on COVID-19 contact-tracing apps, CBC, May 8, 2020
¹³ Canadian privacy commissioners urge caution on COVID-19 tracing apps, IT World Canada, May 7, 2020
¹⁴ Governments around the world are increasingly using location data to manage the coronavirus, The Verge, May 23, 2020
¹⁵ COVID-19 and Contact-Tracing Apps in Canada, Bennett Jones, May 12 2020
¹⁶ Une application de traçage numérique bientôt prête pour le Québec, Le Devoir, May 18, 2020
¹⁷ Application de traçage: le projet québécois prend forme, La Presse, May 19, 2020
¹⁸ Analyse de milliards de données cellulaires : la relâche québécoise a catalysé l’épidémie, Radio-Canada, May 7, 2020
¹⁹ Vidéotron lance un bracelet électronique pour favoriser la distanciation en milieu de travail, May 11, 2020
²⁰ UN chief says coronavirus biggest crisis since WWII, The Economic Times, April 1, 2020
²¹ Evgeny Morozov: ‘We are abandoning all the checks and balances’, The Guardian, March 9, 2013
²² Catastrophism, Wikipedia, retrieved May 19, 2020
²³ Every Covid-19 Commercial is Exactly the Same, YouTube, April 15, 2020