COVID-19 Exposure Notification Apps: Challenges and Opportunities

One goal of contact tracing apps is to support and facilitate the contact tracing performed during an epidemic.

Contact tracing is used to identify and notify people who have come into contact with a person infected with a virus. Establishing a contact history for an infected person allows public health officials to track down possible vectors for the spread of the virus and notify those concerned of the risk of infection. The people who have been notified can then take steps to protect their health and the health of others: get tested, reduce their social or professional activities, isolate themselves, or simply monitor any potential change in symptoms.

Traditionally, contact tracing is done manually and involves three steps: (1) once someone tests positive, they are asked to list their most recent activities and movements to identify the people they came into contact with; (2) the public health department contacts these people to notify them of the risk of infection, ask them questions about their health status and suggest actions they should take depending on their specific situations; and (3) regular follow-up to monitor changes in the contacts’ health.

Manual contact tracing is an important tool for managing epidemics, but it is a process that has certain limitations. Identifying contacts can be time consuming and requires the help of many public health workers, and it can obviously be difficult for people to remember everything they did, everywhere they went, and everyone they came into contact with.

The primary goal of the exposure notification apps that have been developed in response to COVID-19 is to make the traditional contact tracing process easier by automating certain tasks, such as:

• Collecting information from people directly about their health status
• Following up with people’s contacts automatically
• Notifying people of the risk of virus exposure automatically and offering personalized recommendations on what measures they should adopt
• Generating aggregated data that gives public health authorities an overview of the epidemic and allows them to better understand how it is changing

There are a number of exposure notification apps that all work a little differently. However, they all generally involve three steps:

First step : Creating an individual profile

First, the app asks the user to create an individual account. In some cases, the person who has installed the app might be required to provide information about their age, gender, health status (such as the symptoms they may or may not be experiencing), their work activities or personal habits (mask or glove wearing, hand washing, etc.). The app can use this information to help it build an individual risk profile, and the user can update it regularly. If a person tests positive, this information can also be added to their individual profile.

Step two : Creating a contact history

Using a variety of technologies, the app creates a log of the people the user has come into contact with. The apps can only establish contact with people who have also installed the same app on their mobile devices.

Two main technologies can be used to create this log: Bluetooth and GPS.

• Bluetooth technology is a potential solution for allowing different devices to “talk” to each other and directly exchange certain relevant information. It has been widely used in the development of COVID-19 apps since Google and Apple announced they were teaming up to design an interface that would allow iOS and Android devices to exchange information.Bluetooth can be used to detect and send signals between different devices that are in range of one other. The devices continuously record these signals and store them on users’ phones. The signals are linked to identifier beacons that allow for determining which profiles they came from without revealing the identity of the source individual. For example, the identifier beacon could be a string of numbers, letters or symbols. The user’s phone automatically stores all the contacts with other people’s phones established using Bluetooth.

• GPS technology has been used by COVID-19 apps to geolocate people and establish a log of the different places they have visited. By comparing the geolocation data of different app users, it becomes possible to determine the contacts made between them. Some observers have labelled any app that uses GPS technology a “contact tracing app” because it traces people’s movements more precisely.

Step three: Notifying people and creating personalized recommendations

The primary goal of exposure notification apps is to inform people of their risk of COVID-19 exposure. There are two main ways the various apps work: “binary” notifications and “multi-level” notifications: 

• “Binary” apps retroactively notify people that they have been in contact with a person who has tested positive for COVID-19. For example, all people who have come into contact in the past 10 days with a person who has tested positive will be notified they have been exposed to the virus. A test can be recommended and, if positive, the notification chain will continue.

• “Multi-level” apps use variables other than just test results and try to establish an individual risk profile that can vary depending on a variety of factors: age, profession, lifestyle (e.g., wearing/not wearing a mask) or the duration and frequency of contact with someone with particular symptoms. It is a more granular approach that provides personal recommendations based on more than just contact with someone who has officially tested positive.

A distinction is often made between “centralized” and “decentralized” apps. What does this difference mean? It refers to how the information collected through the app is communicated and stored. For centralized apps, the data collected is sent from users’ devices to a central database where it is analyzed to generate the necessary notifications. Decentralized apps analyze the data directly on the user’s device and can then send the appropriate notifications to users. In the second case, personal information is not centralized in a single database; instead, it is directly on users’ devices. This distinction is especially important from an individual privacy perspective. So-called “decentralized” apps that store personal data locally on the user’s device are generally perceived as giving individuals greater control over their personal information. Conversely, the idea of centralizing all the data in one place has fuelled fears of mass surveillance.

Although the governments of Quebec and Canada seem to be considering the idea of recommending the use of a exposure notification app, they have not yet officially endorsed any. However, it seems clear that the use of an app will remain voluntary. A number of Canadian options appear ready for rollout or have already been implemented. In July 2020, the Government of Quebec also launched a public consultation in order to survey the opinion of the population regarding the voluntary use of a “mobile application that would help reduce the spread of COVID-19, by informing them, anonymously, that they have been in contact with an infected person.” According to the Government, the application would operate using Bluetooth technology and it would complement the contact tracing efforts already done by Quebec health services.

The Alberta Government, for example, is already using the ABTraceTogether app, a decentralized Bluetooth-enabled contact tracing app intended to supplement traditional contact tracing efforts. When an app user tests positive for COVID-19, a public health worker contacts them by telephone at the number they provided in their individual profile. The user can then send the data their mobile device collected anonymously to public health authorities, who can then manually contact and notify the people they have come into contact with.

The Office of the Information and Privacy Commissioner of Alberta (OIPC) of Alberta released in July 2020 a report on the ABTraceTogether app. The report reviews and accepts the privacy impact assessment submitted by Alberta Health and Alberta Health Services. The OIPC comes to the conclusion that the ABTraceTogether application generally complies with the core privacy principles and requirements, in particular with regard to defining the purposes for which the information is processed, obtaining individual consent and assuring the security of the personal information collected. However, the OIPC also highlighted some issues related to the ability to limit the collection to necessary personal information, particularly in terms of collecting proximity data obtained through Bluetooth. Similarly, the OIPC regrets that the application requires the device of certain users to remain unlocked, which creates particular issues for the protection of data stored on a stolen or lost device. However, the OIPC also points out that these considerations are specific technologies – in this case, Apple’s iOS -over which the developers of the application have no control. On this point, see also question # 11.

Mila, an artificial intelligence research institute based in Montreal, recently announced the creation of the COVI app, a “multi-level” exposure notification app. COVI uses a decentralized structure but is also meant to send explicitly authorized anonymized data to public health authorities to facilitate their efforts to contain the crisis. COVI is guided by the principles of “privacy by design,” which state that the protection of personal information must be considered at every stage of the development and design of new technologies. Mila has published a detailed report on what the app does, how it works, and what measures are in place to protect user privacy.

A group of volunteers from the company Shopify have also developed an app, COVID Shield, which operates using the Bluetooth interface developed by Google and Apple. Little information is currently available about this app, but it seems like it operates in a binary manner that allows users to anonymously communicate the results of their tests to the people they have come into contact with. The app code is available in open format and the privacy policy, while short, is also available online.

On June 18, 2020, the Government of Canada seemed to indicate a certain openness to the use of COVID Shield, while it encouraged Canadians to install and use a COVID-19 exposure notification app. The use of the application endorsed by the federal government was scheduled to begin in Ontario on July 2, 2020, but the project was subsequently postponed to an unspecified date.

There are currently dozens of contact tracing apps in use around the world, a critical review of which has been done by the MIT Technology Review.

One of the COVID-19 contact tracing apps that has really interested observers is the TraceTogether app, developed in Singapore. The app allows for the exchange of information between devices that are in range using Bluetooth, and data is stored directly on users’ devices. Users install the app voluntarily, but if a user tests positive for COVID-19 and the public health authorities contact them, they are required to send them the information the app collected.

France has been using the StopCovid app since June 2, 2020. Using the app, which is a Bluetooth-enabled binary app that records contacts between people who come within one metre of each other for more than 15 minutes, is voluntary. People who are notified of their risk of COVID-19 exposure are encouraged to schedule a telehealth visit with their doctor. The app also allows users to send their contact history to a central server.

In India, more than 114 million people have likely installed the Aarogya Setu app. This high level of adoption can undoubtedly be explained by the fact that, while use of the app is theoretically voluntary, it is mandatory for public and private sector employees. The app works using both Bluetooth and GPS. User geolocation data is continuously collected and stored on their mobile devices. However, the data is automatically uploaded to a government server if the user tests positive or is at high risk for infection.

The use of exposure notification apps raises many questions related to protecting user privacy. These apps process a lot of personal information that is of a particularly sensitive nature, such as data about a person’s health status, age, gender, and a log of their contacts or movements.

While seemingly harmless, geolocation, especially through the use of GPS data, can reveal a lot about a person’s lifestyle. Several studies have also shown the particularly sensitive nature of geolocation data. For example, knowing where a person works, lives and shops can indicate what they do for work and their standard of living. Knowing someone’s place of worship allows you to infer certain things about their religious or spiritual practices.

Crises such as epidemics are hotbeds for the spread of prejudices and stereotypes. Certain communities may be unfairly blamed for the spread of the disease, and those infected might be treated with suspicion and mistrust. The use of mobile apps that are able to directly or indirectly indicate a person’s risk of infection can increase stigma and fuel a climate of mistrust. In addition, the ability of some of these apps to geographically locate areas with more infections can lead to discrimination against the people or communities living in these neighbourhoods.

In more catastrophic scenarios, geolocation could be used to control and restrict access to certain neighbourhoods, contributing to the stigmatization of residents. The use of mobile apps in the context of the current crisis also poses a risk of exclusion and discrimination against marginalized groups that do not have access to technology. In other words, people who do not have or barely use mobile devices, such as the elderly, would have trouble taking advantage of the benefits of using those apps. In the same vein, the interface Apple and Google developed to facilitate Bluetooth interoperability between iOS and Android devices is not compatible with models older than the iPhone 6s, which would exclude around 16% of iPhone users.

The COVID-19 pandemic is a major source of stress and anxiety, which can lead to the onset of several physical and psychological symptoms. We are being bombarded with alarming news that is taking up all our attention. To tackle this problem, experts recommend practising a form of temporal distancing, meaning trying to take a step back from current events by looking into the future and imagining what the situation will be like a year from now.

We can therefore assume that the use of mobile apps that grab our attention by sending regular notifications on our risk of infection will increase the mental load and stress associated with the current crisis. Receiving a notification that warns us of a high risk of exposure and that strongly recommends that we get tested can increase our stress and anxiety levels. The stressful effect of a notification might also increase because the reasons behind the recommendation will not always seem clear or obvious.

Increased levels of stress and anxiety can not only seriously affect people’s mental health, they can also have negative consequences on their physical health. There are fears that the most worried people will increase their phone calls to telehealth lines or unnecessary visits to healthcare facilities, or that the increase in stress levels could trigger an uptick in cases of domestic violence and suicide.

In Quebec and in Canada, numerous laws protect our information privacy and regulate the collection, use and communication of our personal information. The main objective of these laws is to give citizens maximum control over their personal information. Under these laws, organizations or companies that want to process personal information must act with transparency, meaning they must, among other things, inform us about what information they want to collect, specify their intended goals, and explain the security measures they are taking to ensure confidentiality.

These details are generally found in the privacy policies of the different apps we regularly install and use, such as in the policies of Facebook and Google. These policies lay out the various provisions we agree to when we create a personal account and click “I accept.” These documents are often long, complex and hard to read, which explains why we generally do not read them. Given the situation we are currently in, and because of the particularly sensitive nature of the information that can be processed, it is important to pay special attention to these policies.

Here are six questions that can help you sort through these policies:

1. Does the privacy policy specify what personal information will be collected? If so, what is collected? Are you comfortable with sharing this information with the company or organization that owns the app?
2. Does the privacy policy specify what your personal information will be used for? If so, do these uses seem important and reasonable to you? Are they related to the apparent purpose of the app, for example helping you make the right decisions during the crisis or understand your risk of infection?
3. Does the app say that it will use your information for promotional, commercial or targeted advertising purposes? Several of the COVID-19 apps that are currently available allow the use of data for promotional purposes that are unrelated to the current pandemic. To check whether the app allows this type of secondary use, you can check whether it intends to communicate (or divulge, depending on the terminology used) personal information to third parties or partners for commercial purposes.
4. Does the app tell you where your personal information will be stored? Generally, it is best to have your information stored on Canadian servers, but information is often stored on American soil (as is the case with Facebook). The difference is not drastic, but in the context of public health, especially if the app is endorsed by public authorities in Canada, it would be better not to decide to store the data outside of Canada.
5. Can you delete the app and your individual profile at any time? If so, what happens to your personal information? Is it destroyed or deleted? Generally, your personal information can only be used with your consent. So, deleting the app and withdrawing your consent should mean that the app can no longer use your information and must therefore delete it. It is important to check what happens to your information if you decide to stop using the app.
6. Does the data usage policy specify whether the information collected will be deleted once the crisis is over? This question is related to the previous one. Clearly informing users that the app will be deleted and the data will be erased at the end of the crisis may indicate that the app does not plan to make secondary use of the data.

Although the exposure notification apps developed to deal with COVID-19 may be a concrete solution to the current crisis, they cannot solve it on their own. These apps have limitations that we must consider if we want to understand how they can be effective.

The biggest limitation of exposure notification apps is adoption. The effectiveness of these apps depends on the number of people who use them. If not enough people are using a particular app, it will be much less effective. This issue of adoption also relates to the issue of access to technology (see question 8), since people who do not have a cellphone, or who do not have a compatible model, will not be able to install or use an app. Furthermore, issues related to the protection of privacy and the risk of discrimination and stigmatization could have a significant impact on the level of adoption of the technology. For example, an Australian app has been downloaded by less than 16% of the target population due to uncertainty surrounding the protection of users’ personal information. It is worth noting, however, that it has not been proven that a 60% adoption rate is needed for exposure notification apps to be effective. In fact, the authors of the study that came up with this statistic have taken steps to correct how their research has been interpreted, stating that apps are starting to have a protective effect at adoption rates well below 60%.

Another consideration relates to how the various technologies COVID-19 apps rely on work. For example, the ABTraceTogether app used in Alberta only works on iPhones if the screen is unlocked and the app is running in the foreground. Having to continuously keep the app open with the screen unlocked requires a lot of power, which will drain the device’s battery faster.

A third consideration relates to the false sense of security a exposure notification app can provide, which could get some people to let their guard down and no longer follow health guidelines. This “automation bias” could have a negative impact on the community spread of the virus.

Finally, Bluetooth and GPS technologies can establish that two people were in close proximity to each other, but they are unable to tell whether there was a wall, window or other form of protection separating them.

It should also be noted that exposure notification apps are generally not designed to replace manual contact tracing, but to complement it. For example, in Alberta, the people who use the ABTraceTogether app can consent to having their personal information disclosed to a contact tracer if they test positive. Additionally, since apps recommend that users take certain steps, such as going to a clinic for a test or calling a telehealth line for additional information, these other resources must be available and functional for apps to serve their intended purpose.

It may be useful to present an overview of other types of apps that governments are using to fight the pandemic and look at some of the technologies that have been used by public health authorities in Quebec, Canada and elsewhere.

Risk assessment and information apps

The first important category of apps that can be used to manage an epidemic includes apps intended to allow people to assess their risk of infection themselves and access useful and relevant information quickly. Using a mobile app has the dual advantage of being fast and allowing people to interact with the healthcare system, even remotely. These apps are therefore mainly used for prevention.

In Canada, several tools are being used at both the provincial and federal levels. At the federal level, for example, the Government of Canada has developed a self-assessment tool with Thrive Health that helps users assess their risk of COVID-19 infection and recommends certain behaviours and directs them to appropriate resources based on this risk. The tool works by asking users a series of multiple-choice questions, the content of which changes according to the answers users provide. At the end of the questionnaire, users receive a series of recommendations and resources. Similar tools are also available in Alberta, British Columbia and Ontario.

In Quebec, two apps developed by the private sector are currently available. The app developed by the company Dialogue is a chatbot that helps users assess their infection risks and provides personalized information based on their needs. Next, the company Empego offers an infection risk assessment tool that also directs users to appropriate resources.

Risk assessment apps are also being used in France and the United Kingdom. In Switzerland, an artificial intelligence-based app is being used to predict the risk of COVID-19 infection by analyzing recordings of coughs that users submit. In the United States, the Mayo Clinic is offering a self-assessment tool powered by Alexa, Amazon’s personal digital assistant.

Quarantine compliance apps

The second category of apps developed in response to COVID-19 is a collection of devices that have been created to ensure compliance with lockdown measures. While no such apps are currently being used in Quebec or in Canada, it would nevertheless be useful to present a brief overview of them. Quarantine monitoring apps are used to ensure people follow isolation guidelines. Most of these apps use GPS or Bluetooth and may take the form of wristbands, while some of them rely on artificial intelligence and facial recognition.

For example, in South Korea, the government has developed an app that uses the GPS technology in phones to allow public health authorities to monitor compliance with voluntary self-isolation guidelines for people who have been in direct contact with someone who has tested positive. However, since users could easily break the self-isolation rules by leaving their phones at home, the government decided to impose the use of electronic wristbands, which use Bluetooth and notify the authorities if a person gets too far away from their phone.

In the United States, some states are considering the use of electronic wristbands to ensure compliance with lockdown or quarantine guidelines. Public authorities in Hawaii are exploring the possibility of using GPS and facial recognition technologies to monitor compliance with self-isolation rules for tourists and travellers. Hong Kong seems to have already adopted a similar strategy. In Louisville, Kentucky, a court ordered seven people who broke quarantine rules to wear a GPS ankle bracelet.

In Poland, a voluntary app uses AI and facial recognition to verify that users are staying home. The user receives a notification from the app and must then take a selfie. Facial recognition is used to confirm the person’s identity, and the image’s GPS coordinates are used to verify where it was taken. The app is presented as a less-intrusive alternative to routine visits from public health authority representatives.

Under Quebec law, employers must take measures to protect the health, safety and dignity of their employees. However, these measures must be reasonable and appropriate. Therefore, if an employer were considering making the installation of a exposure notification app mandatory, for example, to check someone’s risk of infection or the diagnoses or recommendations the app provides, this measure must be deemed “reasonable.”

Four main questions must be considered. For a measure to be deemed reasonable, it must be possible to answer “yes” to each of these questions:

1. Does the measure respond to a real and urgent need? In the current environment, it is reasonable to say that employers have a real and urgent need to take measures to ensure the safety of their employees. However, certain factors change whether the measure can be considered “necessary.” For example, does the measure target an employee of a health care facility or a residential and long-term care centre? Or is the employee someone who provides overnight parking security who is unlikely to interact with many other people?
2. Is the measure effective, in that it solves the problem? This question is more difficult. Due to the novelty of the measure, there are currently no studies that scientifically demonstrate the effectiveness of exposure notification apps. In fact, the limitations inherent in certain apps (see question 11) allow us to put their effectiveness into perspective. For example, how can you know whether an employee has their phone with them outside of business hours and that the results the app displays are therefore reliable?
3. Does the measure minimally impair individual rights and freedoms? Installing a exposure notification app may constitute an invasion of people’s privacy, especially since these apps collect a large amount of particularly sensitive information (see question 7 on this point). Employers must verify whether other less invasive measures could also meet the intended safety and protection needs. To that end, employers should ask whether wearing a mask, a different workspace layout, or the installation of handwashing stations are measures that could allow them to offer a safe working environment.
4. Is the invasion of employee privacy proportional to the benefits the measure provides? Here, employers must weigh the advantages and disadvantages. The invasion of people’s privacy is significant since it goes far beyond the context of the workplace. Employees’ expectation of privacy has to be adjusted according to the “time” and “place” of what they do. However, it could be said that installing an app has a disproportionate effect because it involves near-continuous collection (even outside of normal working hours) wherever the person goes (even when the employee is not in the workplace).

While it would be difficult to conclude that there are no situations where the mandatory installation of a exposure notification app is justified, it seems reasonable to say that situations where a measure such as this one would be considered acceptable are few and far between.Finally, note that the Commission d’accès à l’information du Québec also published on July 8, 2020 a document to answer some of the main questions raised by the use of exposure notification applications in the context of employment. .

It should be noted right off the bat that the governments of Quebec and Canada have repeatedly underscored that they do not intend to require the use of exposure notification apps. However, in Quebec and Canada, the government has several powers to protect the health of the population. These powers are all the more important during a public health emergency with a serious threat hanging over our health.

In Quebec, the Public Health Act gives the provincial government broad powers to fight epidemics: it can, for example, order compulsory vaccination of all or part of the population, order the closing of various locations, bar access to certain parts of the province or order “any other measure necessary to protect the health of the population.” Therefore, it would be possible for the government to make the use of a exposure notification app mandatory if it was convinced that this measure was necessary to protect the population.

However, since adopting such a measure would undoubtedly violate certain fundamental human rights, the government would have to be able to demonstrate that the measure is reasonable. To do so, we have to look at four questions—the same ones that we used in question 13 to assess an employer’s ability to require the use of a exposure notification app:

1. Does the measure respond to a real and urgent need? In the context of a public health emergency, it is reasonable to say that protecting public health and containing an epidemic are a real and serious need. Taking steps that allow for identifying people’s risk of exposure to the virus and notifying them of these risks respond to an important need.
2. Is the measure effective, in that it solves the problem? As discussed previously, this is a difficult question. Since there are no studies yet that scientifically demonstrate the effectiveness of exposure notification apps, it would be difficult to conclude that such a measure is effective. It could be argued, however, that it is precisely the mandatory nature of the measure that makes it effective. Since tracing apps are limited by the number of people who use them, making one mandatory could increase its effectiveness.However, we must also consider that such a coercive measure could also result in an atmosphere of mistrust and lead to deviant behaviour. People who believe the measure infringes too greatly on their rights and freedoms and who fear that the app could affect their professional or personal lives could choose to install the app but not always bring their phones with them wherever they go. By doing so, the effectiveness of the measure would be greatly reduced. In other words, the effectiveness of a measure that mandates the use of exposure notification apps would depend on how accepting society is of this technology.
3. Does the measure minimally impair individual rights and freedoms? The government would have to demonstrate that the measure is reasonable by proving that it minimally impairs the fundamental rights and individual freedoms of individuals. The government would probably need to demonstrate that other less intrusive measures had been used and did not work, or that they have little chance of success. For example, it will be important to show that social distancing, voluntary self-isolation or wearing masks in public are inadequate responses to the problem targeted by the measure.Similarly, one could expect that it would be necessary to demonstrate that simply recommending the use of the app is insufficient. The government would have to explain why traditional contact tracing operations are failing to achieve the expected results and that automation will be successful.Finally, special attention would need to be paid to the setup of the app itself. Does it operate in a way that minimally impairs the rights of individuals? For example, does it collect more information than is necessary to work correctly? Does it have adequate security measures? Is there a timeline for destroying outdated information? Does it offer safeguards against discrimination or stigma?
4. Is the infringement of rights and freedoms proportional to the benefits provided? This last question concerns the respective weight given to the protection of rights and freedoms and the pursuit of the desired objective. Are the benefits that we expect from making an app mandatory more important than the violation of people’s rights and freedoms? In this respect, we must also consider the fact that traditional contact tracing, which is already used and permitted during public health crises, has a definite impact on people’s right to privacy: people have to tell the contact tracers where they went during the past few days and identify the people they came into contact with. Therefore, the weighting exercise referred to in this step should address the additional impact the use of exposure notification apps would have on people’s privacy.

Given the world we are currently living in, it would probably be difficult for the government to demonstrate that being forced to install a exposure notification app is a reasonable measure under Quebec and Canadian law. This is probably why governments have repeatedly said that the adoption of such apps would remain voluntary.

This last question is meant to provoke discussion. We encourage you to get involved in the debate and think about this question with your friends, family or colleagues! You can then send us your responses using the form available below. We will post your responses on this page.

Here are some thoughts to guide your discussions:

1. Would recommending a exposure notification app make it more effective? Would this recommendation be useful or necessary when there are several apps available
2. Would recommending a particular app help build public trust? Or conversely, would it result in an atmosphere of mistrust or skepticism?
3. Would recommending an app better protect people’s rights and freedoms? Or would such a recommendation pose an additional risk for protecting rights and freedoms?