Does the IPC have privacy concerns with the COVID Alert app? Is my personal information secure?
The IPC, together with the Office of the Privacy Commissioner of Canada, reviewed the COVID Alert app before its launch. Based on our review of the app at that time, we were satisfied there were strong measures built into the app’s design to protect individual privacy.
The app does not collect, use, or disclose identifiable information — it uses Bluetooth signals to detect potential exposure based on the proximity of the app user’s cell phone. We supported the use of the COVID Alert app by individuals based on the following conditions:
- Use of the app will remain voluntary as it relates to the federal and Ontario governments.
- Information will only be used for its intended public health purpose, and no other purpose.
- Only de-identified or aggregate data will be used and ongoing consideration will be given to the risk of re-identification.
- The use of the app will be time-limited: any personal information collected during this period would be destroyed when the pandemic ends, and the app will be decommissioned.
- The government will be clear about the terms of use so that Canadians would be fully informed about what information was collected, how it was used, who had access to it, where it would be stored, how it would be securely retained, and when it would be destroyed.
Our support of the app was also conditional on ongoing monitoring and evaluation, and that the evaluation would be made public. If the effectiveness of the application could not be demonstrated, it would be decommissioned, and any personal information collected would be destroyed.
We also required that appropriate legal and technical security safeguards, including strong contractual measures with developers, partners, and third-party service providers, would be in place to ensure that any non-authorized parties did not access or use the data.
