Alberta’s privacy commissioner has noted “ongoing concerns” when it comes to the protections on people’s personal data when using the ABTraceTogether app, but has accepted the province’s efforts to preserve privacy with some recommendations.
Intended to be used to track contacts of those who test positive for COVID-19, the app was submitted for review by Alberta Health. Under the province’s Health Information Act, programs like this require that a review be conducted by the commissioner and a Privacy Impact Assessment (PIA) be completed.
“While I am not in a position to endorse a particular technology solution, we found Alberta Health was mindful of privacy and security in deploying the app,” Information and Privacy Commissioner Jill Clayton said.
In the report, AH is noted for doing an “excellent job” when it comes to privacy and security in the deployment of the app.
“The app’s clear purpose, guided by principles of consent and individual
control, is commendable,” the document reads.
However, Clayton remains concerned when it comes to its use on iPhones.
“Despite the positive aspects, I have ongoing concerns related to the functionality of ABTraceTogether on Apple devices. We recognize the challenges AH has faced in this regard, since the safeguards required are out of its control.”
Chief among the reasons is the apps need to run in the foreground of Apple phones, creating a security risk.
“Running the app on Apple devices requires a device to remain unlocked, which significantly increases risk in case of theft or loss,” said Clayton.
Employers in the healthcare industry also face a risk if the phone is used for work and connected to an email or cloud portal, potentially exposing private information about patients. This represents a “potential contravention for failure to safeguard under Alberta’s privacy laws,” according to the release.
Among the recommendations is the ongoing need for transparency on data relating to effectiveness and use throughout the province.
The app is entirely voluntary and uses Bluetooth to determine if a user has come in close contact with someone who has tested positive for coronavirus. Alongside the app, contact tracing is done by contacting all people who a coronavirus patient remembers being in close proximity to.
It was during the app’s rollout, that it does not track anyone’s geographic location.
Since its launch, the app has seen over 142,000 downloads.