Alberta: OIPC releases report on PIA submitted for Alberta's contact tracing app with concerns and recommendations
The Office of the Information and Privacy Commissioner of Alberta ('OIPC') released, on 9 July 2020, a report ('the Report') on its review of the Privacy Impact Assessment ('PIA') submitted by Alberta Health for the Government of Alberta's contact tracing application, ABTraceTogether ('the App'). In particular, the Report highlights that the OIPC acknowledged that the App's purpose was to supplement already established contact tracing processing and Alberta Health's consent-based approach, and to limit collection of health or personal information when registering to use the App, among other things. The OIPC noted, however, that it had concerns related to the App's functionality on Apple devices which required the App to run in the foreground with the device remaining unlocked, which increases the risk in the event of theft or loss. In addition, the Report outlines that the risk on Apple devices increases for employers who provide employees with devices in sectors with obligations to reasonably safeguard health or personal information, where the risk for running the App contravenes with their existing obligations under the Freedom of Information and Protection of Privacy Act, Alberta’s Health Information Act, and Personal Information Protection Act.
Furthermore, the OIPC stated that it has accepted the App's PIA with recommendations outlined in the Report, acknowledging that Alberta Health has taken reasonable steps to protect privacy.