Nothing good ever comes for free: Contact tracing apps and COVID-19 | Kay Wu

By Kay Wu

Law360 Canada (June 22, 2020, 11:53 AM EDT) --
Kay Wu
It goes without saying — the COVID-19 pandemic has transformed every aspect of society as we know it. Businesses, employers, markets and schools are struggling to adapt in light of social distancing measures. People have been forced to find new alternatives to carry out their daily operations amidst these unprecedented times. However, our modern methods for dealing with this age-old problem may pose certain privacy issues.

Big data is the new resource that will transform the way our world is run. By leveraging big data, public and private institutions alike are now able to make smarter decisions informed by data-driven insights. Experts have long recognized the potential and scalability of big data and the industry is estimated to grow by US$103 billion by 2027. Our extensive use of mobile tech reveals unimaginable amounts of intimate information on our individual lives: where we go, what we buy, when we buy it, how we finance it and what our personal interests are. This type of data is invaluable to governments and marketers alike.

The use of big data has also provided us with new methods to stay safer as contact tracing apps have proven to be helpful in the face of public health emergencies. Nowadays, with the plethora of information that is being bounced between smartphones, we can use these large amounts of data to notify people who have been exposed to someone with the COVID-19 virus. Many Asian countries have already adopted the widespread use of contact tracing apps and are successfully mitigating risk of COVID-19 outbreaks with the help of geolocation and data gathered from phones to pinpoint high-risk locations.

Provinces in Canada have begun using similar contact tracing apps and the government of Canada has just announced plans to launch a nationwide app in early July.

Of course, there is always a caveat. There are risks involved with using data for contact tracing purposes. Technology and security issues have already been raised in regard to contact tracing apps, slowing their adoption. Privacy commissioners have cited concerns over the amount and type of information gathered from contact tracing apps that are undisclosed, leaving people unaware of what information is gathered on them. If contact tracing apps are not built with the robust infrastructure necessary to protect privacy, governments may be able to trace and identify people without their knowledge.

One thing is evident by now: convenience does not come for free. The cost of convenience is the sharing of personal data and the use of big data analytics is a double-edged sword. In the event of a data breach, software with weak privacy infrastructure would make it all too easy for confidential information to be leaked. Data is subject to privacy laws, but even legislation may have limited efficacy.

In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) exists to govern the collection, use and disclosure of information in private sectors. Similarly, the Privacy Act governs the collection, use and disclosure of information in the public sector. Both pieces of legislation are put in place to ensure that information is obtained with an individual’s consent subject to certain exceptions. Provinces also have their own comprehensive health privacy legislation governing the collection, use and disclosure of medical information.

In March, the Office of the Privacy Commissioner said, “During a public health crisis, privacy laws still apply but they are not a barrier to appropriate information sharing.” Since then, every province in Canada has announced that there is a public health crisis and declared a state of emergency, in one form or another. Where a state of emergency is declared, the government’s powers to use, collect and disclose information can be very broad. In efforts to mitigate the effects of the pandemic, the government will inevitably take actions that infringe on privacy to a greater degree.

It seems natural that when a country is faced with issues of serious national concern, the legislative approach taken to expand powers is justified to mitigate societal risk. However, that does not mean there is unanimous consent on where to draw the line.

To what extent should third parties be able to use our data without our knowledge? If public sectors are given more power over people’s personal data, does this necessarily equate to more benefits? After the pandemic is over, how much can we control what will happen to our data? How much of our privacy should we cede in exchange for safety and societal good? Perhaps these are all prudent questions we should be asking ourselves.

It is clear that there is a delicate balance between individual privacy rights and the welfare of society to be struck. Just like anything else, it seems reasonable that too much of anything is bound to have negative consequences.

Although issues regarding digital privacy have been present since the very start of the Internet age, the pandemic has undoubtedly pushed the fast forward button on these privacy concerns. In an age where data is being created and analyzed on an exponential level, the impact of the legislative response on privacy rights is important because it sets forth the framework for how we respond to a public crisis in the future.

Our legislative approach for responding to public health emergencies will have lasting effects that impact our lives in the most intimate manner, for better or for worse.

Kay Wu is a rising 2L studying at the Faculty of Law, University of Windsor.

Are you a law student or articling student interested in writing for us? To learn more about how you can add your voice to The Lawyer’s Daily, contact Publisher and Editor-in-Chief John Carson at john.carson@lexisnexis.ca or call 905-415-5889.