IAB Canada urges the use of Privacy Compliant COVID-19 Alert App #flattenthecurve
Last week, IAB Canada took part in a discussion with Health Canada and the business privacy community to discuss and raise awareness of the potentially lifesaving COVID-19 Alert App. The app, which was developed in partnership with several industry partners including Google, Apple, Shopify and Blackberry, has been downloaded to nearly 4.7 million phones across Canada. Used in all Canadian provinces, excluding British Columbia and Alberta, 2,052 cases of COVID-19 have been reported via the app via a one-time key received at the time of a positive test.
While that sounds somewhat impressive when you break it down, these numbers reveal that adoption is not as high as Health Canada and the medical community had hoped for. In Ontario alone, only 5% of those who have been infected with the novel coronavirus have used the app to report their case, which would then send off of a warning to other app users of potential exposure if they had been within two metres of that person for at least 15 minutes within the preceding two weeks. Adoption of the app is key to its success and we are clearly not where we need to be.
Privacy concerns may be the cause of the low adoption rate. While privacy may be top of mind for Canadians regarding their health, it has been made abundantly clear to IAB Canada, and the rest of the privacy community, that these concerns have no merit. The COVID Alert is a Government of Canada app and is designed so that health information stays within users’ provincial or territorial healthcare provider. Users’ identity and health status will not be shared with the Government of Canada. COVID Alert does not have access to personally identifiable information and cannot access users’ health information. Canadians’ privacy is protected.
COVID Alert does not use GPS or location tracking and in no way collects the following user information :
- location
- name or address
- phone’s contacts
- health information
- health information of anyone the user is near
Nothing is done without consent even if when a user tests positive:
- Nothing is shared without explicit permission.
- When permission is granted, the only information that is shared is the random codes from the subscribed phone.
- Only the app and its server will have access to the random codes.
If users are diagnosed with COVID-19
- They can choose to share their random codes from the past 14 days with a central server operated by the Government of Canada.
- If random codes are shared, nobody will get any information about the individual or the time they were near them.
- Users will also be asked for permission to share your random codes with the central server for 13 days after.
User data is deleted after just 15 days
- All random codes, whether from the user’s phone or others, are deleted after 15 days.
- The app can be deleted at any time, and the random codes on the user’s phone will be automatically deleted after 15 days. Users can also delete the Exposure Logs on their own using the phone’s settings.
- If users uploaded their random codes before deleting the app, they will be deleted from the server after 15 days.
Having cleared all doubts about the security of the COVID Alert, IAB Canada knows very well that the effectiveness of any framework whether it is there to secure the digital media supply chain or to protect the health of citizens, depends on adoption.
To help promote usage of the app please take a look at Health Canada’s extensive library of digital resources. And if you have any questions regarding the COVID Alert please send an email to Health Canada directly. Our community can help to flatten the curve!