Digital contact tracing for restaurant patrons raises questions about privacy

A contact tracing program developed in Nova Scotia that has made logging restaurant patrons' information during the pandemic as easy as sending a text is raising questions about how that data is being stored and what people can do to protect their privacy.

For the past several months, Dartmouth marketing company SimplyCast has been working with the Restaurant Association of Nova Scotia (RANS) and the province's health authority on a contactless check-in program.

"It's more efficient, it takes less time," said Gordon Stewart, executive director of RANS.

Instead of having staff members manually jot down the names of customers as they enter the business, the SimplyCast program asks patrons to text a unique passphrase created by the restaurant to 11011 to confirm their attendance.

If the customer doesn't have a cellphone, they are asked to fill out a digital form with their name and phone number for contact tracing purposes. 

Contact tracing is used to identify and manage people who've been exposed to COVID-19 to prevent further spread.

Although the new system might make things easier for Public Health officials and restaurants, a Halifax-based data consulting and analysis firm said users should ask about what's happening to their information once it's been provided.

Kevin D'Aguiar, owner of Matters of Data, said SimplyCast has the capability and tools already in place to collect the data and use it for marketing.

He said he was unable to find reassurance on SimplyCast's website that the information collected through the program won't be shared or sold. 

"I recommend that they [SimplyCast] state really clearly that the data will not be used for anything other than contact tracing because at the end of the day, if you're being forced to share data that will end up being used in a non-transparent way by a company to increase their revenue, there could be a real issue there," he said.

SimplyCast's founder and CEO, Saeed El-Darahali, said he understands the concerns people might have when it comes to protecting their private information, but in this case it's a non-issue.

He said there are three levels of protection for the information that's collected. 

Firstly, El-Darahali said only one employee at SimplyCast has access to the data. Otherwise, only Public Health officials are able to access the database where the information is stored. Additionally, every time the data is accessed, a log is created with the time and date of access.

The second level of protection involves actually encrypting the data, meaning converting the information so that it's unreadable. 

"God forbid an outbreak or some form of a leak was to happen, anyone gathering that information or even recording it would not be able to decipher that into a phone number or a name," said El-Darahali.

He said the final step to protecting the data is ensuring only Public Health officials are given the code to decipher the encrypted data. The information is stored for 41 days before it is deleted.

Stewart said there was never any intention of using the SimplyCast program for marketing.

David Fraser, a privacy lawyer in Halifax, said this kind of contact tracing — compared to the pen and paper version — lessens the chances that someone's personal information will be lost or misused. 

However, he said people should always be careful when giving out their personal information considering the slew of scams happening during the pandemic.

He recommends ignoring unexpected or unsolicited texts and emails that ask for personal information because they are more than likely a scam.

"I've even heard about people [outside Canada] getting text messages being told to sign up for their COVID vaccination appointment and are then prompted to enter their full name, date of birth and social insurance number, and that's exactly what an identity thief needs to compromise your identity," said Fraser.

El-Darahali said the check-in program is still evolving. The program was born in 2013 as a way to help transit users find out when the next bus was coming. 

He said the company is always open to receiving feedback from the public when it comes to increasing its transparency. He said they plan on updating the check-in program and their website to reflect that.

"At the end of the day, we didn't think of a pandemic 10 years ago when we created this solution, so all we're trying to do is help the public and help our government ensure that we stay safe," he said.