As contact tracing apps raise ethical questions, a York University online course aims to make privacy more palatable to the public
Leaving your name and contact info at the door of a nightclub or restaurant. Questionnaires and temperature checks for employees. Mobile phone alerts that let you know you are standing next to someone with COVID-19.
As countries ease public health measures, governments are using a variety of methods to track and contain the spread of COVID-19 while restarting their economies. This has led to debates around the trade-off between data privacy and public health. Should the public be expected to give up personal information to governments and private tech companies to curb spread?
A survey by KPMG released on May 14 found that 55 per cent of Canadians feel digital contact tracing is “too invasive” and should be voluntary, citing privacy concerns and potential civil liberties abuses. Most – 92 per cent – feel contact tracing apps must balance privacy with public safety. At the same time, 60 per cent say they would sacrifice privacy if that would stop COVID-19.
“Privacy really isn’t about privacy – it’s about trust,” explains Peter Kosmala, a Rhode Island-based data privacy expert who is teaching a new continuing studies course in information privacy at York University starting in September. “If you don’t trust the other party or the context of an information request or what’s being done with your personal data, you’re not dealing with that organization anymore. You’re possibly never coming back.”
The “accelerated” six-month, part-time online program covers the principles, methods, best practices and technologies defining privacy and is aimed at a broad range of professionals – including marketers and human resource managers – working in areas where data privacy has become increasingly relevant since the pandemic.
With more people working from home, learning and socializing online and booking doctors appointments through telehealth platforms, Kosmala says there is a more urgent need than ever for more widespread public awareness around information privacy.
The program will also cover simple safeguards people can take, like identifying threats to privacy while working from home and managing data in personal and professional contexts.
“Specialists alone won’t solve these challenges,” he says. “To really tackle this issue effectively, we need all hands on deck. It’s not going to be solved just by government policy, regulation or strictly by placing the burden entirely on organizations like companies.”
In terms of privacy law, Kosmala says Canada is “pragmatically” positioned between the United States, which he calls the “Wild West frontier,” and the European Union, where privacy is considered a fundamental human right. Last year, Justin Trudeau’s government unveiled a plan to modernize federal laws governing digital privacy.
Kosmala, who was planning to move to Toronto prior to the Canada-U.S. border closure in the wake of the pandemic, hopes the York program reflects a characteristic “Canadianness” – or thoughtful approach to privacy that doesn’t just copy other jurisdictions.
He wants to see Canada adopt a “common sense” approach to privacy rules that reflects the country’s history and culture.
“What is a Canadian value on [privacy] and how do you articulate that into law?” he asks. “And if you do that and it ends up looking close to Europe, that’s great. But I don’t think it’s great to simply emulate another country because it’s viewed as the tougher standard.”
Ontario will soon release a new “exposure notification app” as part of contact tracing measures. Trudeau has also promised to recommend an app in early June to identify potentially infected people to ensure they take precautions to limit the spread of COVID-19.
As the province moves toward stage 2 of its reopening plan, consumer-level technology could play a bigger role in managing outbreaks until a vaccine is found. The reliance on apps to fight the virus has led to concerns of government overreach and increasingly invasive surveillance.
If people are going to buy in to government-recommended apps, Kosmala says the province needs to make clear things like how long the data will be used and by whom.
When Alberta launched the contact tracing app ABTraceTogether in early May, details of how data would be managed were not spelled out in the rush to market, causing alarm among privacy experts.
The KPMG survey suggests Canadians are willing to make accommodations in order to curb virus spread. But there will be limits to that willingness depending on how the app rolls out, Kosmala cautions.
He says that if “surveilling the public and tracking movements to serve a health benefit is forced upon the public, it’s not going to be productive.” Similarly, “If it’s made optional but the public does not feel sufficiently informed, they’re not going to opt-in.”
Personal health information is regulated by the provinces and some provincial regulators have issued privacy guidelines around consent, access, transparency and accountability for governments and organizations to follow. The Office of the Privacy Commissioner of Canada has also issued COVID-19 guidance.
“There’s interesting friction between the public need [for health data] and the fundamental information rights that Canadians have under law… consistent with Canadian society and cultural values, that are equally important,” says Kosmala. “It’s not really a situation where one wins over the other entirely, but rather we need an appropriate balance so a collective determination can be achieved.”