Contact tracing and privacy: we need both to restart the economy and get employees back to work

By: Jordan Prokopy and John B. Simcoe

As governments across the country begin to reopen their economies, companies are considering a myriad of measures to keep employees and customers safe. App-based contact tracing may be the key to effectively managing the pandemic and minimizing risk of infections, but companies are uncertain about using or mandating it for employees and customers. A coordinated government strategy and clarity on how privacy laws apply in current circumstances is needed.

Without clear guidance we may be faced with unwanted situations. Either we continue to have forced closures with big consequences to our economy or we have a patchwork of approaches that could range anywhere from forcing employees back to an environment where they do not feel safe to employers across Canada using a multitude of contact tracing apps that do not communicate with one another - leading to ineffective tracing and uncertainty over how each one protects your personal data.

Neither scenario is wanted — so how do we enhance our public health measures across the country in all settings without sacrificing privacy, and vice-versa?

Privacy cannot be a barrier to enhancing public health measures and keeping Canadians safe, but it has to go hand in hand with effective testing and a practical privacy protective framework for personal data use designed for today’s unprecedented situation.

Thus far, tracing across Canada has been deployed in a manual fashion. Any success will depend ultimately on the availability of public resources to expand the program on a mass scale. It also assumes that a statistically significant percentage of Canadians are willing to participate in the program and voluntarily provide the personal information necessary to facilitate it.  

Technology-enabled contact tracing — in combination with a reliable, readily available testing program — offers a more viable solution to optimizing public health resources and reopening the economy safely, as long as they offer strong privacy features.

For example, GPS-enabled applications that use location information to track individuals’ movements may be considered ‘creepy’, but a bluetooth-based app that uses anonymous encrypted data could have more appeal. Nonetheless, GPS-enabled data could be provided by the telecommunications companies and put to effective use by public health authorities in the fight against COVID-19.

Privacy laws still apply during this public health crisis, but they cannot be a barrier to appropriate information sharing. In fact, privacy can enable governments to advance the reopening of the economy, and empower individuals, organizations and their employees to adapt to a new normal.

To achieve this, governments should focus on three key steps going forward.

  1. All levels of government must increase collaboration to common measures to speed up economic recovery efforts. In their absence, businesses need to consider adopting contact tracing on their own as a key component of reopening and employee and customer safety. For instance, a grey area legally that organizations are considering is mandating tracing apps to ensure the safety of all workers. Tracing apps need a 60 per cent or more adoption rate to be effective, but voluntary programs typically achieve 5 to 10 per cent.
  2. Employees and consumers are more likely to adopt and trust tracing apps if they are government endorsed. With Alberta having launched its own app and other provinces looking to follow suit, a federated model is needed. This would enable apps to communicate with one another and anyone traveling across provinces or interacting with others who use a different app can still be protected. A cohesive approach will build trust with Canadians. If individuals do not trust the tracing measures put in place, they will not adopt them.
  3. The current privacy regime offers many privacy protections to individuals, but additional considerations are needed in the technology era. Recently, measures are touted by federal and provincial privacy commissioners: make apps voluntary, provide high levels of transparency and accountability, minimize data collection and limit storage time. Data must be de-identified or aggregated to reduce risk of re-identification.

Canada has already initiated steps to enhance its privacy framework. The Digital Charter is the government’s roadmap to reforming Canada’s private sector privacy law and focuses on enhancing Canadians’ privacy rights while supporting the digital economy.

Now more than ever, organizations need to realize data and digital benefits. To successfully address the challenges that come with the current pandemic, over reliance on a voluntary, consent model for using citizen data for purposes that benefit society and our people needs to be reconsidered.

Privacy law reforms need to balance consent with an accountability framework - where organizations can demonstrate their responsible use of data to support activities that benefit society like our health and economic recovery, accompanied by sound regulatory oversight. This is key to gaining Canadians’ trust. It may also be the solution to increasing contact tracing app adoption rates in the absence of a mandated model.

In taking the next steps in our country’s response to the pandemic, contact tracing apps can be an important part of the solution, but not without effective testing measures, a comprehensive national approach and a privacy friendly framework that builds data and digital trust. Our economic recovery depends on it.

Contact us

​Jordan  Prokopy

​Jordan Prokopy

National Privacy Practice Leader, PwC Canada

Tel: +1 416 869 2384

John Simcoe

John Simcoe

National Media & Telecom Lead, Assurance Partner, PwC Canada

Tel: +1 416 815 5231

Follow PwC Canada