Can digital contact tracing be done without creeping surveillance? Privacy commissioner is hopeful

If every move you make and every interaction you had with a person was logged in a database, there would be an extreme potential for abuse in that system. But what if it could be done without the database?

Newfoundland and Labrador's provincial government is looking to join places like Singapore and South Korea with a digital contact tracing system that would use people's cellphones to monitor their movements and let them know if they've been in contact with a COVID-19 positive patient.

There's a debate ongoing around the world right now about two types of digital contact tracing — one that collects all the information in one database, and one that doesn't.

"If we can provide that contact tracing without anyone actually keeping track of you and where you've been, then this is a privacy-sensitive way to achieve this goal," said Michael Harvey, Newfoundland and Labrador privacy commissioner.

A decentralized system would store a person's data on their own phone. A centralized system would see it all compiled in one place.

Jurisdictions differ on best approach

Countries like Singapore, Switzerland and Australia have backed these programs, which are also being championed by Apple and Google.

The United Kingdom and France, meanwhile, are backing a centralized database with promises that the data will only be used during the COVID-19 pandemic.

Germany had intended to follow the U.K. and France, but had a change of heart, stating it would only work if people trusted the app enough to download it.

Speaking with The St. John's Morning Show on Tuesday, Haggie indicated the province is more interested in a decentralized version.

The program would track people's interaction using a personal identification number for each person signed up.

"It wouldn't identify people and it wouldn't identify you," Haggie said.

It would be driven by informed consent on an opt-in basis. For it to be effective, approximately 60 per cent of people in the province would have to sign up for it.

All of a sudden the surveillance creeps and creeps and creeps until we can't keep track of who is watching us anymore.- Michael Harvey

Haggie said the features that would make the app function are already being used by many apps commonly downloaded on devices already. 

When asked how he would pitch it to people, he said there are a few reasons people should take part in digital contact tracing.

"One is for the greater good of yourself and your neighbour," he said.

Haggie said 90 per cent of the contact tracing that's happened already in the province has been done by old-school means — knocking on doors or reaching someone by telephone.

A digital system could speed up that process and cut down on transmission as the province begins loosening restrictions related to COVID-19.

Spread of surveillance

Under normal times, the privacy commissioner would have many concerns with an app that tracks people's movements and records interactions, and is controlled by the provincial government.

The question of what happens to it after COVID-19 still lingers.

"My concern about an app like this would be if the foot was put in the door for even greater surveillance, to use the pandemic as an excuse to surveil us even more," Harvey said. "Before we know it this information is being used for other purposes."

A centralized database would be of definite interest to law enforcement, if it could place a person near a crime scene at a specific time. Harvey said people could argue that's a good thing, but it could snowball from there, and lead to the tracking of people who have not committed any crimes.

That possibility — paired with other apps that use location services function on cellphones — could lead to a level of surveillance never before seen.

"All of a sudden the surveillance creeps and creeps and creeps until we can't keep track of who is watching us anymore," Harvey said.

Under the Access to Information and Protection of Privacy Act, there are two key considerations when looking at exploiting private information.

One is necessity — how necessary is it to gather this information?

The other is proportionality — how will you ensure you are only taking as much information as is absolutely necessary?

During a pandemic, with a second wave of infections a possibility as the provincial government loosens regulations, Harvey said he can understand why an app like this would be necessary.

But only, he said, if it is done right.

"I'm willing to listen to the public health imperative, for sure, but I will only recommend to the public an app that I feel achieves the principles of necessity and proportionality that are based in our legislation."

Read more from CBC Newfoundland and Labrador