ABTraceTogether: Contact Tracing App in the Workplace

The Alberta government recently released its mobile contact tracing app (“ABTraceTogether”) which is intended to assist with determining whether a user has been exposed to COVID-19 and with locating others who have been exposed to a user who contracts COVID-19. The app uses a smartphone’s Bluetooth to keep an anonymous log of other app users with whom the infected individual has been in close contact (defined as within approximately 2 meters). If a user contracts COVID-19, that user will be asked to volunteer their log to Alberta Health Services (“AHS”) for the purposes of contacting individuals who may have been in close contact with the infected user and advising them about their risks.

Not surprisingly, concerns have been raised with respect to the collection, use and disclosure of personal information related to these apps. Upon registration of the app, the only piece of information an individual is required to provide is a mobile phone number. However, when the app is used, a temporary anonymized ID is assigned to the app (the ID changes from time to time when the app is connected to the internet) and it is these temporary IDs which are exchanged between users’ apps. The app then stores proximity information on the user’s smartphone about others who are using the app (using the anonymous ID), and the apps of others store similar information about the user. The app website advises that the collected data is only stored for 21 days, and that the information stored in the app will only be shared with AHS with the permission of the user. Of course, once the data stored in the app is uploaded to AHS, AHS will be able to connect the temporary IDs to the mobile phone numbers associated with the apps so that contact can be made with the appropriate users.

The Federal, Provincial and Territorial Privacy Commissioners recently released a joint statement about the use of contact tracing apps by governments. The statement expresses concern with respect to the privacy risks associated with the apps and encourages governments to respect a variety of principles including the recommendation that the use of the apps must be voluntary.

The Alberta Privacy Commissioner issued a statement specific to the ABTraceTogether app and was complementary with respect to the minimally privacy intrusive approach taken by the Alberta government. The statement is clear that the voluntary nature of the app was viewed as one of the positive components of the app.  

We have received a number of inquiries from clients about the possibility of mandating the use of ABTraceTogether for their employees. In the face of the clear message from Privacy Commissioners, the use of the app should be voluntary. We suspect that there is some risk to employers that they will not be able to reasonably justify requiring employees to use the app, especially outside of work. It must be noted that the app is minimally intrusive from a privacy perspective and would greatly improve the ability of an employer to trace workplace infection in the event of a positive diagnosis of an employee. The question of whether an employer will be able to implement mandatory use of the app will likely have to be assessed on a case-by-case basis. Employers need to consider a number of factors, including:

• ownership of the phone. It is more likely going to be a justifiable request if the phones are employer-owned
• the extent to which the employer is requiring people to work in a shared environment increasing the risk of prolonged contact amongst employees
• the nature of the work being performed
• whether other effective methods to trace infection in the event of a workplace case of COVID-19 can be utilized.

There is no direct value to an employer from the use of this app by which to justify its use by employees – the employer does not have any access to the data collected by the app. However, for employers who encourage employees to use the app, potential indirect advantages include:

• the possibility that an employee at risk of contracting COVID-19 is notified early, can self-isolate and perhaps protect other employees in the workplace
• the possibility that AHS can more readily identify and contact the employer’s employees who have been in close contact with an employee diagnosed with COVID-19 and allow them to take the necessary steps more quickly (again, perhaps protecting other employees in the workplace)
• in the event of a COVID-19 infection at work, the employer will learn some information about how well social distancing measures in the workplace are working or being complied with.

Of course, any indirect value to an employer will be more limited in workplaces where employees are not allowed to carry their phones while at work.

If employers are considering encouraging the use of the app by employees, they should be prepared to answer questions about the app including what information is collected, how it is used, and by whom. Implementing the app in the workplace raises no concerns if employees consent to its use. As such, employers who are interested in this approach should at minimum consider providing information about the app to its employees and encourage them to use it.