The Office of the Information and Privacy Commissioner of Alberta (OIPC) said the province's COVID-19 tracing application smartphone app could be a security risk if used on Apple devices.
According to Commissioner Jill Clayton, as reported by Global News, while Alberta Health considered privacy and security in developing the ABTraceTogether app and applied measures to protect privacy, she has concerns about the app's functionality on Apple devices.
Clayton said the app poses security risks because Apple devices need to remain unlocked to make it work. Thus, risks are significantly heightened risk in case of loss or theft.
screenshot of the ABTraceTogether App Store preview
The Alberta government and its Health Services office launched the voluntary smartphone application on May 1 to control the spread of coronavirus. The app uses Bluetooth and can be downloaded for free.
Three weeks after its launch, Ministry Spokesperson Tom McMillan said on May 22 that Alberta Health is coordinating with Apple and Google to enhance ABTraceTogether's efficacy and functionality. The spokesperson also noted that enhancements will be released later.
McMillan earlier said Apple's iOS 13.5 update on May 20 already included the "exposure notification framework," which allows running the app even when the device is not being used or locked.
Nearly two months after, Alberta Health said Apple has not yet issued a fix allowing the app to run in the background, but the office is working with the tech giant to make it happen soon.
Meanwhile, health officials earlier said the app already worked on Android devices.
Privacy may be breached
Meanwhile, the OIPC report said Alberta's privacy laws may be breached by employees who store health or personal information on provided devices or their own and running the app.
Can the app pose privacy and security risks?
Clayton noted that both the AH and AHS have legal responsibilities to protect the personal and health information in their custody or control.
She also recommended Alberta Health to publish the potential privacy risks as her office does not regulate the actions of those who download the app. Also, OIPC advised to have regular updates on the app's effectiveness or make plans on dismantling the app in the future.
Meanwhile, the Alberta government said the app continues to play a key role in controlling COVID-19 and ultimately saves thousands of lives. Yet, Alberta Health vowed to review the OIPC report and make necessary changes.
While the ABTraceTogether app has initial popularity with 140,000 downloads three days after its launch, fewer people have been getting it. As of June 19, only 210,093 or about 5% of the population have downloaded it.
According to Heather Baxter, a family physician and university lecturer in Calgary, not enough Albertans have been using the app.
Health officials said at least 20% of the population should have downloaded the app to deem it as effective. The actual numbers though is far from the ideal.
How does the app work?
ABTraceTogether app uses Bluetooth to create a record of smartphones it has been in contact with within two meters for at least 15 minutes. The encrypted data is held on the phone for 21 days.
If users have tested positive for COVID-19, they can agree on uploading their phone records to AHS, so human contact tracers can reach out to phone numbers other users have registered the app with.
