Canada may be getting closer to the widespread use of digital contact tracing to fight the COVID-19 pandemic. Last month, Alberta became the first province to release a contact tracing app, and the federal government has touted a national effort. The Industry, Science, and Technology committee has been discussing it.

Digital contact tracing apps use cell phone data to alert people if they’ve come in contact with someone who is infected. They’re mostly unproven so far, and it’s certainly not a forgone conclusion that they will ever operate nationally in Canada. But if they’re used by enough people, they hold out some promise for becoming a powerful tool for slamming the door on new outbreaks.

That power is a worry, too. Canadians would be asked to surrender some privacy, and trust that governments and private actors will protect their personal data and use it judiciously. Different communities will be affected differently by the quasi-surveillance. Though given how COVID-19 has tormented some communities and left others relatively untouched, equity is also a first-order concern with choosing not to adopt tools to combat the virus. Millions need to opt in, or be compelled to use it, or a digital contact tracing app won’t help.

More than a coding problem

There’s been much debate about how to design apps that can protect public health while limiting privacy and other risks. But threading that needle isn’t just or mostly a coding problem. It’s a problem for democratic governance.

Over 25 countries have introduced digital contact tracing apps or are ready to do so, and those apps are proving to be among the trickiest interventions in both political and policy terms. They steer into some public opinion headwinds, arriving just as the digital rights movement has finally broken through to the mainstream. But they also arrive in the context of already vast and blunt rights infringements—like limits on our movement—which are broadly tolerated in the name of public health.

If Canada decides to go this route, our leaders should put good governance at the heart of execution. Good governance, including healthy democratic scrutiny, can keep digital contact tracing inside the lanes drawn for it. It can provide ongoing expert input. And it can build public trust, resulting in more participation and bigger impact.

But to this point, the governance of digital contact tracing has been almost totally neglected, or an afterthought. And the negative consequences have already been realized in some countries, where governments have had to abandon plans or rapidly change tack. This is an area where Canada can actually lead.

Pulling up a stool

First, digital contact tracing needs a legislative basis. Law, debated and passed by Parliament, should give the app and broader project a mandate, and impose hard limits. It should establish design principles concerning issues like data governance, create penalties for misuse of data, and be subject to sunset clauses, to ensure that—like other emergency measures—contact tracing will expire with the data destroyed, if it isn’t renewed by Parliament. Australia passed such a law, but it came weeks after the app went live on millions of phones, and was incomplete. The Swiss government had to scrap its plans to release an app and hurriedly draft legislation after its Parliament rebelled. The French Parliament struggled with its Government, finally winning an opportunity to debate and vote on the project. The UK Government is now facing pressure to introduce a bill, after trying to skip that step. But the Canadian Government can get ahead of all this, and keep the governance horse in front of the cart. Pass the legislation quickly, but do it first and do it well.

Second, that legislation should set out a robust system for review and scrutiny. We should take some loose inspiration from the debate on governance of national security, another policy area where governments have to walk the line between rights and public safety. Leading scholars have called for a “three-legged stool” of democratic oversight over national security. The same concept roughly applies to digital contact tracing.

1. Expert review council

The first leg is an expert review council. It would include tech, privacy, cybersecurity, and public health experts, appointed by the Government. The council could keep ongoing track—from the inside—of whether the program has efficacy (it works) and propriety (it follows the rules).

2. Professional oversight

The second leg is professional oversight from a watchdog or monitor. The federal and provincial privacy commissioners could provide that oversight publicly, by hearing complaints and examining compliance with the contact tracing legislation and other privacy law, from the outside. However, they would likely have to be specially empowered in the authorizing legislation, to ensure they have the scope and access they need, and aren’t hindered by limitations in existing privacy law.

3. Parliamentary oversight

The third leg is parliamentary oversight. A committee or sub-committee could be tasked with comprehensively reviewing the contact tracing regime, with access to information and government officials. The goal is to guarantee high-quality, cross-partisan scrutiny and participation on this highly sensitive, high stakes issue. This project cannot work without a measure of responsible cooperation between the parties—mixed with a constructive level of partisan competition. A similar rationale has already led to a federal parliamentary committee being assigned the job of reviewing the Canada Emergency Response Benefit.

Conclusion

There’s often a tendency to look for shiny new transparency approaches when governments confront new technology. But because institutions and intermediaries are passed over, this often strengthens the hand of the Executive. We get a version of “open government” which is whatever the Government decides it is. Yes, we should demand that code be publicly available, and we should marshal the civic tech community for scrutiny from society. But Parliament, equipped with time and information, is still best at imposing transparency and accountability on governments.

No country has reached this level of democratic governance of contact tracing. But there’s little downside to oversight overkill. This project could become a model for the public governance of technology—or, if governments are deferred to, and governments in turn defer to private tech firms, an accelerated loss of public control. We also still have a virus to beat. And if Canadian governments can give strong concrete assurances about privacy, equity, and performance, they can ask more of citizens—and we can finally get ready to tread this thin ice through the pandemic year.

‍

Copyright © The Samara Centre for Democracy 2020
PUBLICATION DATE: 10 June 2020
CITATION: Michael Morden 2020. “Digital Contact Tracing: A problem for democratic governance.” Toronto: The Samara Centre for Democracy.
EDITOR: José Ramón Martí

This is the fifth edition of the Samara Centre’s Democracy Monitor, an ongoing research series exploring the state of democracy in a state of emergency.