by Amy Chen

On July 29, 2020, Lisa Austin, Andrea Slane, Vincent Chiao, and David Lie joined Director Cheryl Milne of the Asper Centre to discuss their collaborative research paper: Test, Trace, and Isolate: COVID-19 and the Canadian Constitution. The paper (also co-authored with Beth Coleman, Martha Shaffer, and François Tanguay-Renaud) reviews the benefits, limitations, and constitutional implications of contact tracing apps. The webinar can be viewed online here.

What are Contact Tracing Apps?

Dr. Lie began the panel by giving an overview of the different types of contact tracing apps. Contact tracing is a method for controlling infectious disease outbreaks by identifying, notifying, and monitoring individuals who have been exposed to the disease. In response to the COVID-19 pandemic, countries have been utilizing smartphone apps to conduct digital contact tracing in conjunction with manual human contact tracing. These apps fall into two categories – apps that are centralized and integrated with manual human contact tracing, and apps that are decentralized and work parallel to manual tracing. Dr. Slane noted that different liberal democracies have tried different frameworks. Australia and Singapore have adopted the centralized approach; Germany, Austria, and Switzerland have adopted the decentralized approach; some countries (i.e. Bahrain, Kuwait) have tried more privacy-intrusive apps that collect GPS data.

Ontario will be using the decentralized model through an API developed and supported by Apple and Google. The app, which is currently in its beta testing phase, uses Bluetooth to communicate with other phones that have the app installed. This allows the app to track and record the names of those who have come into close contact. If an individual tests positive for COVID-19, they can voluntarily upload the list of recorded names onto the app’s server. If other users have been in contact with the same individuals, they will be notified through the app. The app may also show a “risk score” and recommend high-risk individuals to get tested.

Pros and Cons of the Decentralized Framework

There are two upsides to this decentralized framework: 1) it is technologically supported by Apple/Google and 2) it is more privacy-protective. However, the panelists stressed that this also means that there are many downsides. First, Professor Austin noted that Apple and Google’s role has not been sufficiently scrutinized. The app will be governed by the technical decisions of these large technological companies rather than the decisions of our democratically elected governments. While Australia has experienced some technical difficulties with their centralized app, their government has been able to pass legislation regarding data control and usage.

Second, a privacy-protective app means that the data is limited in its accuracy and effectiveness. Dr. Lie pointed out all the ways in which the data could be distorted. The app relies entirely on individuals to voluntarily report their positive diagnoses, which means that many positive cases could be missed. Users could put fake names on their phones or repeatedly change their names, which makes it harder to track infected individuals. Proximity data, which is calculated based on the strength of the phones’ Bluetooth signals, could be inaccurate if the signals are disrupted. It is uncertain what percentage of the population needs to get the app for it to be effective. It is even uncertain whether digital contact tracing would supplement manual contact tracing efforts.

The most concerning aspect about the decentralized approach is that health authorities will only have limited access to the data collected by the app. Health authorities would not be able to contact infected individuals and provide them with education and health support. They would not be able to assess the effectiveness of the app, particularly its effectiveness for vulnerable communities. Dr. Slane indicated that the app will not be accessible for individuals who do not have access to smartphones, who have language barriers, who distrust technology, and who distrust state action or surveillance. Publicly accessible data is needed to develop effective targeted approaches for communities that are disproportionately affected by the pandemic.

Digital Contact Tracing and the Charter

Digital contact tracing requires a balancing between our personal privacy rights and public health outcomes. As explained by Professor Austin and Professor Chiao, the Charter is an important framework in assessing how to balance these rights in a way that is justifiable in a free and democratic society.

The Federal Privacy Commissioner has stated that data collected by the apps must be used in a way that is consistent with the principles of necessity and proportionality. What that means is hard to assess ex ante since we are in “uncharted waters”, but there are several contextual factors to keep in mind. First, we would need to know exactly what Ontario’s public health goal is in pushing out contact tracing apps. If the goal is to make manual tracing more effective, it may be harder for the government to justify why a decentralized privacy-protective app is necessary or proportional.  Second, privacy rights dictated by the Charter are traditionally assessed a criminal “state vs. individual” context. While courts may be concerned with protecting individuals from the overreach of state power in the criminal context, individual privacy rights may be given less weight in the context of a public health emergency. Finally, how the rights will be balanced will likely be determined through political decisions rather than through legal decisions.  If the app is widely perceived to be effective, courts are unlikely to disturb the government’s decision. If the app is perceived to be ineffective, the government will likely take actions without prompting from the courts.

Digital contact tracing could engage both s. 7 and s. 8 Charter interests. The apps could engage an individual’s interests in life, liberty, and security if the data was used to enforce quarantine or lift isolation measures in an unsafe manner. Whether the principles of fundamental justice would be violated would depend on a multitude of variables that cannot be determined at this time. In addition, the apps could engage our privacy interests associated with our anonymity or our biological cores. The nature and scope of the section 8 right would be context-specific. For instance, individuals may inadvertently waive or diminish their reasonable expectation of privacy by volunteering data and accepting the terms and conditions of the app. On the other hand, section 8 may protect individual privacy if data was used for purposes that were not consented to (i.e. law enforcement, immigration). Individual privacy rights may also be engaged in circumstances that are not governed by the Charter. Businesses may conduct informal voluntary screening questionnaires as a condition for accessing services, or employers may ask employees to use the digital tracing apps in the workplace. These issues would have to be dealt with through quasi-constitutional private sector data protection laws.

Ultimately, the panelists argue that digital contact tracing must be integrated alongside traditional human contact tracing for there to be effective health outcomes. Given the shifting public health landscape, the scope of the legal ramifications of contact tracing apps is still unknown. The panelists stressed that public trust in the app, our governments, and our public health authorities will be crucial in determining the effectiveness of digital contact tracing.

Amy (Jun) Chen is a 1L JD Candidate at the Faculty of Law and is the Asper Centre’s current summer Research Assistant.