Should establishments be responsible for collecting people’s personal information for contact tracing?

An illustration depicting contract tracing
Illustration by Jessalyn George.

With Ontario public health regions varying in COVID-19 levels, according to the provincial government’s COVID-19 response framework, the province continues to adapt to enforcing effective methods of contact tracing. However, some critics say that restaurants in particular should not be responsible for collecting their patrons’ personal information. 

The city of Toronto ordered a regulation in August that instructed bars, restaurants and tour boat operators to “record the name and contact information of every patron who enters an indoor or outdoor dining area in the establishment,” CTV News previously reported. 

The information must also be available upon request from a health official in the case of an outbreak at the restaurant, at which point, Health Canada will contact patrons who may have been exposed to the coronavirus. 

These establishments in particular had a challenging task ahead of them. They had to ensure their customers were safe in an environment that required people to remove their masks to eat and drink. The establishments also had to ensure that they were able to properly trace and notify customers in the event of an outbreak.

However, Ann Cavoukian, former information and privacy commissioner for Ontario and current executive director for Global Privacy and Security by Design Centre, said that restaurants conducting their own contact tracing can be counterproductive.

Do you think that they’re getting accurate information? No. So many people have told me that they’ve falsified their name, or they give the wrong phone number, change a digit or whatever – it’s not of any value,” she said. “They’re making up information. You’re not going to get anything of value and you’re subjecting people to this privacy-invasive practice.” 

Generally, restaurants approach contact tracing either manually by paper or with the use of technology–  such as using tablets – to input people’s contact information. Many restaurants opt to take customer information on a piece of paper and file them by date and time. However, some restaurants have recognized the advantages of receiving this information digitally, and are not only creating a more efficient experience for their customers, but are also storing information more accurately, and far safer. 

Ryan Rodricks, a second year Laurier University computer science student, said that he visited restaurants over the summer when cases were lower. He said that although the restaurants he went to have done a good job at maintaining COVID-19 safety precautions, he was still concerned about their method of contact tracing. 

“I believe that the restaurants should have taken down information digitally as I’m not sure how often they cleaned the writing utensils we were given. The safety concern was primarily regarding the sanitization,” said Rodricks.  

He said that he’s mostly worried that the restaurant was not sanitizing the pen and clipboard they had passed around to all the other customers. To curb this, Rodricks said that “they could have used an electronic method of taking our information to limit physical contact.”

Another disadvantage of paper-based contact tracing is that anyone can view the sheet of paper and record people’s names and contact information if left unmonitored. 

Teresa Scassa, Canada Research Chair in Information Law and Policy at the University of Ottawa told CBC that “you can’t just scribble the names down and leave the sheet of paper sitting at the front entrance way. You have to securely store the information.”

She also said that establishments must train their employees on disposing the written record of people’s contact information immediately once they’ve been transferred to a digital database.

“You don’t toss lists in the garbage. If they’re handwritten lists, you shred them, or if they’re on a computer, you make sure the file is property deleted.” 

Digital contact tracing can be a safer method, but Cavoukian suggests that establishments should instead encourage their patrons to install the COVID Alert app so they can be notified if they were ever exposed within two metres of someone who tested positive for COVID-19.. 

Ryerson Folio previously reported that the app creates random codes and exchanges them via Bluetooth with phone users in the area. The codes are regularly changed and people cannot be identified through them. After 15 days, the codes are deleted and no personal information is shared at all.

How the COVID Alert app works via Youtube

“A much, much better response … is the COVID Alert app that was created in Ontario and then picked up across the country … They call it exposure notification because they want to make it clear that you’re not going to be traced or surveilled by using this,” Cavoukian said. 

The app also does not store any of the user’s information, including their name, physical location, places they’ve visited, and their health information. 

Cavoukian said that she worked closely with Apple and Google to inspect every single line of code to ensure that these promises are delivered. “There is no privacy invasive anything. It doesn’t collect any personal information, no personal identifiers are collected, no geolocation data–it is all entirely under your control as an individual and privacy is all about privacy control.” 

The advantages of encouraging customers to download the app can benefit both the establishment and their patrons. Establishments can limit the amount of direct contact by avoiding passing around a clipboard and pen to a number of people a day; their patrons can enjoy a private dinner without disclosing any of their personal information. 

Customers get to make the decision to download the app and have full control on their following actions if they were ever notified of an exposure. Cavoukian said, “You can go to your family doctor, you can go to a public health authority, you can do nothing – it is entirely your choice.” 

She also said that with the development of the COVID Alert app, the Canadian government is going to great lengths to secure people’s data that they don’t want to be exposed to anything.

“Privacy forms the foundation of our freedom. It’s absolutely critical that if you want a free, open society [that you] set a solid foundation of privacy.”