Know your privacy rights with the COVID Alert app

This is an illustration title card for the article. An illustration of a cellphone has a notification on the lockscreen reading "COVID ALERTS UPDATE: No positive cases near you."
Illustration by Jessalyn George

The protection of one’s health data isn’t a concern people immediately consider when discussing privacy and security. However, as Ontario sees a steep increase in positive cases, it’s more important than ever to discuss the security of people’s health information.

On Nov. 3, Dr. Ann Cavoukian discussed the importance of health privacy and its relation to COVID-19 at The Future of Privacy in a COVID-19 World panel. Cavoukian is the former Ontario information and privacy commissioner. During her time as commissioner, Cavoukian helped enact Ontario’s Personal Health Information Protection Act (PHIPA). 

PHIPA works to protect the privacy and security of patients’ health records. It gives implied consent, meaning people don’t have to sign every time they get referred from one doctor to another. This means that your health information is automatically protected within your healthcare providers. PHIPA was created to make sure people’s health needs were the first priority instead of worrying about protecting a patient’s information. 

During a pandemic, these privacy rights are more important than ever. Cavoukian urged people to understand their health information is protected and they should become knowledgeable of it in case a medical emergency does happen. 

“The concern often is you don’t know if your health information has been used in ways that are contrary to your interests. A lot of time, perhaps behind the scenes and you may not have any awareness of this. So that’s why I just urge everyone, protect your health information,” said Cavoukian. 

With COVID-19, the protection of health information has reached new heights. 

When the pandemic reached its peak in Ontario in the spring, Cavoukian was asked by the province to help develop the COVID Alert app. The app became available to download on July 31. 

The COVID Alert app notifies people if they have possibly been exposed to someone with coronavirus. 

The app creates random codes and exchanges them via Bluetooth with phone users in the area, notifying them if they have been in close proximity to someone with the virus. The notification specifically lets them know if they are near a user who tested positive within the last 14 days.

The codes are changed often and people cannot be identified through them. After 15 days, the codes are deleted and no personal information is shared at all. 

Even though the app lets people know about a potential exposure, Canadians have become wary about its data security. 

This is an image of three cellphones - they display the different visuals of the COVID alert app. The first phone shows a screen that says "No exposure detected", the second says "you have been exposed in the last 14 days", and the last shows a lock screen with a notification that reads "you've been exposed".
Image via

According to CBC, “52 per cent don’t believe the government when it says the app does not collect personal information and does not geolocate users.”

Cavoukian’s work on the app was to make sure people’s privacy rights were protected. 

“I worked together with [the Ontario government] to ensure that no personal information is collected whatsoever,” Cavoukian said. 

The federal government asked the Ontario government if they could use their plan and make the app available to all Canadians. Both the Privacy Commissioner of Canada and Ontario worked together in making the app a federal initiative. 

CBC reported that initially, the app was only linked to Ontario’s health system, but over time more provinces started joining the app. So far, the only provincial health care systems that are not linked to the app are Alberta and British Columbia. The three territories have yet to join as well. 

Although this is the case, anyone in the country can download the app. They would only be notified if they are within the vicinity of someone from one of the provinces that have joined the app. 

Cavoukian states that COVID Alert was built to protect the privacy and data of people even when the pandemic is over. It was important for her to ensure everyone’s personal and health information will not be shared with anyone through the app. 

“This is one of the biggest concerns, is what happens with all of the records associated with contact tracing and individuals personal information and whether they were positive or not […] If that information just lives forever, it can cause such havoc,” Cavoukian said. 

The Government of Canada website guarantees that everyone’s privacy is protected on the app and it cannot track people’s private identities. The app is meant to limit the spread of the virus. People are encouraged to install it to protect themselves and others, but they are not forced to do so. 

Cavoukian wants the public to know that they are in control of their own privacy and people should double check every time if their information is secure. 

“It’s not up to the state to determine what information they should have access to and how it should be used […] It’s about personal control […] You should be in the driver’s seat,” she said.