Protect our privacy during COVID-19

Governments around the world have turned to cell phone based tracking to help contain the COVID-19 outbreak. This includes gathering location data, records of who you’ve been near, and enforcing quarantine via cell phone location. 

In Canada, Trudeau has stated that “all options are on the table to do what is necessary”,1 and several provinces are moving forward with phone tracking plans2

Clear boundaries are needed to limit the potential harm of such plans to our rights. Sign the petition telling our government to commit to key privacy principles for any tracking measures put in place.

Patty Hajdu, Minister of Health
Bill Blair, Minister of Public Safety and Emergency
David Lametti, Minister of Justice and Attorney General of Canada
Justin Trudeau, Prime Minister of Canada

Please commit to respecting these seven privacy principles should any kind of cell phone data gathering or tracking be implemented in the fight against COVID-19.  While emergencies can call for special measures, we should not unnecessarily compromise our privacy or rights. 

The government of Canada should follow these seven principles when considering any kind of enhanced digital surveillance or data collection:

1. Prioritize approaches which do not require any surveillance or data gathering to encourage people to stay at home

Make full use of public education, financial assistance, and other options and support which will allow people in Canada to practice social distancing, and avoid infection, as well as testing at scale to identify people who have been infected. Any surveillance-based measures must only be relied on where demonstrably necessary and as a last resort.

2. Due process for adopting any new powers

Any new powers must be adopted through a legislative process, following transparent and open public debate. Invasive measures must be referred to the courts and the privacy commissioner for an assessment of their legality, effectiveness and proportionality. As the federal Privacy Act remains an inadequate and outdated instrument, data gathering must be accompanied by binding rules to ensure data minimization, strict necessity and proportionality. Such measures must be temporary, with a defined end date and review periods regularly scheduled. Ongoing reviews must be public and transparent, and must consider the impact and effectiveness of any new measures as well as their continued necessity. 

3. Favour consent in any data sharing initiatives

In any government use of mass data technologies to address the pandemic, options that allow people the choice to volunteer their data must be strongly preferred to non-voluntary data collection. Voluntary measures must be truly voluntary, and free from coercion of any kind. Neither leaving location services on nor an agreement signed with their mobile provider on registration can be understood as providing this voluntary consent. Any voluntarily provided data must be subject to the same limitations and considerations of proportionality and use as all other data, and subject to ‘ongoing’ consent - ie, subject to withdrawal by the provider at a later date. 

4. Put strict limits on data collection and retention

Any adopted measure must ensure that data collection is minimized, limited to collecting data that is strictly necessary for established public health considerations directly relating to the declared emergency, and proportionate, keeping in mind the sensitivity of the data being collected. Any data collected must be fully and promptly deleted as soon as it is no longer necessary to contain the pandemic. 

5. Put strict limits on use and disclosure

The intended use of any collected data must be specifically and clearly defined, and that data should only be used for its intended purpose. All data must be de-identified and anonymized. Any data gathered must only be used for the public health purposes that justified its collection, and may only be disclosed to public health bodies. No data gathered through these measures can be used to achieve law enforcement or immigration objectives, or for commercial purposes, including in de-identified format.

6. Oversight, transparency and accountability

Any new rules or technology adopted during this period must have independent oversight, must be transparent to the public, and must provide options for recourse with regards to breaches, misuse, or other violations of rights. This independent oversight must be additionally empowered to remedy any inaccuracy or bias in any adopted measures, as many digital surveillance and analytic tools have been found to be deeply biased, particularly against marginalized groups.

7. Any surveillance efforts related to COVID-19 must not fall under the domain of security, law enforcement or intelligence agencies

The current pandemic situation is a public health crisis, not a matter of national security. Security, law enforcement and intelligence agencies must not be involved in any form of public health surveillance or data collection. Moreover, the line between the data held by Canada’s health and security establishments must be maintained throughout.

This campaign is hosted by OpenMedia. We will protect your privacy, and keep you informed about this campaign and others. Find OpenMedia's privacy policy here.

In many places around the world, governments are using or considering digital tracking to monitor and contain the COVID-19 outbreak. 

In some European countries like Italy and Germany, mobile carriers are sharing aggregated location data with government to help them monitor whether people are complying with curbs on movement, and identify potential hot spots where people are gathering.3

The government of Poland is requiring quarantined people to use an app to take and submit regular selfies to prove that they’re at home, and send police to the homes of people who do not comply. And in Taiwan, infected individuals are “geo-fenced” at home - location data on their phones alert authorities of movement outside of a permitted area.4,5 Multiple governments around the world, as well as Google and Apple, are working on contact tracing capabilities and apps. 

Contact tracing uses Bluetooth signals to detect other phones nearby. If a person tests positive for the virus, the data can in theory be used to find other people that person may have been in contact with - though there are serious concerns about whether Bluetooth contact is a reasonable approximation of the physical contact that spreads the virus.6

Privacy experts are  already sounding the alarm about the risks of adopting tracking technologies without careful limitation of their capabilities and scope. Location data, if gathered, can reveal sensitive, private information about peoples’ lives. Even supposedly anonymized data can sometimes reveal individual identities - and data leaks and hacks of supposedly secure databases are unfortunately common.7
 
Many people also worry that surveillance tools or powers brought in to address the pandemic will become permanent, as was seen with supposedly short-term powers brought in in the U.S. following the 9/11 attacks. 

The principles that OpenMedia and other civil rights groups have jointly developed would bring in sensible protections to limit the potential for harm, like limiting who information can be shared with and how long records are kept, and putting in time limits on any special measures. Most importantly they underline that non-surveillance-based and consensual methods can be more effective and should be implemented first. 

 

  1. Trudeau leaves door open to using smartphone data to track Canadians' compliance with pandemic rules: CBC
  2. Alberta to roll out contact-tracing app in battle against COVID-19: CBC
  3. European mobile operators share data for coronavirus fight: Reuters
  4. Poland made an app that forces coronavirus patients to take regular selfies to prove they're indoors or face a police visit: Business Insider
  5. Taiwan collars coronavirus quarantine scofflaws with smartphone geo-fences. So, which nation will be next?: The Register
  6. How Apple and Google coronavirus contact tracing will work: ZNet
  7. Five ways a COVID-19 contact-tracing app could make things worse: Policy Options

Press: Laura Tribe | Phone: +1 (888) 441-2640 ext. 0  | laura@openmedia.org