PUBLIC INTEREST ADVOCACY CENTRE LE CENTRE POUR LA DÉFENSE DE L’INTÉRÊT PUBLIC 285 McLeod Street, Suite 200, Ottawa, ON K2P 1A1 9 September 2020 Mr. Claude Doucet Secretary General Canadian Radio-television and Telecommunications Commission Ottawa, ON K1A 0N2 VIA GC KEY Dear Mr. Doucet, Re: Part 1 Application Regarding “COVID Alert” App, “ABTraceTogether” App and Related Matters The Public Interest Advocacy Centre (PIAC) hereby files a Part 1 application requesting specific Commission action (as specified in the Application) in relation the “COVID Alert” App, the “ABTraceTogether” App, and regarding Canadian telecommunications service providers’ involvement in the operation of these contact-tracing apps. In particular, this Application seeks Commission guidance on privacy rules for potential government requests to TSPs to provide subscriber information associated with the use of COVID Alert, ABTraceTogether and any potential future similar tracing technologies. This Application is PIAC’s second regarding pandemic contact-tracing, however, it is not a re-submission of the first Application but now is based on actual assessment of these deployed apps, now used by many Canadians. As such, we request that the Commission now deal substantively with the Application. Sincerely, John Lawford, Counsel to PIAC cc Named respondent TSPs Stephen Millington, CRTC Daniel Therrien, Privacy Commissioner of Canada Jill Clayton, Information and Privacy Commissioner of Alberta Patricia Kosseim, Information and Privacy Commissioner of Ontario BEFORE THE CANADIAN RADIO-TELEVISION AND TELECOMMUNICATIONS COMMISSION IN THE MATTER OF AN APPLICATION UNDER THE TELECOMMUNICATIONS ACT BY THE PUBLIC INTEREST ADVOCACY CENTRE (APPLICANT) and Bell Canada; Bell Mobility Inc.; Bragg Communications Incorporated, carrying on business as Eastlink; Canadian Communication Systems Alliance (CCSA), Cogeco Communications Inc., Canadian Wireless Telecommunications Association (CWTA); Distributel Communications Limited, Freedom Mobile Inc.; Ice Wireless Inc.; Independent Telecommunications Providers Association (ITPA), Iristel Inc., Quebecor Media Inc., on behalf of Videotron Ltd. (Videotron); Rogers Communications Inc. (Rogers); Saskatchewan Telecommunications Holding Corporation, operating as SaskTel (SaskTel); Shaw Communications Inc. (Shaw); TBaytel; Teksavvy Solutions Inc., Telus Communications Company (TELUS); Xplornet Communications Inc. (RESPONDENTS) REGARDING “COVID ALERT” APP, “ABTRACETOGETHER” APP AND RELATED MATTERS 9 September 2020 Public Interest Advocacy Centre 9 September 2020 Part 1 Application Regarding “COVID Alert” App, “ABTraceTogether” App and Related Matters Page 2 of 46 Table of Contents 1.0 Introduction ......................................................................................................................... 3 2.0 Public Health and the Purpose of this Application ............................................................. 7 3.0 The Parties .......................................................................................................................... 8 4.0 The Facts ............................................................................................................................ 9 4.1 COVID Alert App ............................................................................................................. 9 4.2 ABTraceTogether .......................................................................................................... 13 5.0 IP Addresses and Privacy................................................................................................. 14 5.1 IP Addresses and the Law ............................................................................................ 15 5.1.1 IP Addresses in Canadian Case Law ....................................................................... 15 5.1.2 IP Addresses and CRTC Decisions ......................................................................... 15 5.2 IP Addresses as Described to the Public in the COVID Alert App .............................. 17 5.2.1 IP Addresses as Described in the COVID Alert Sign-up Process ........................... 23 5.3 Phone Number collection as Described in the ABTraceTogether Sign-up .................. 26 6.0 Law: Privacy Under the Telecommunications Act ............................................................ 28 6.1 History of Customer Confidential Information, Telephone Numbers and Subscriber Information under the Telecommunications Act ....................................................................... 29 6.2 The Role of Customer Consent in the Disclosure of Customer Confidential Information 33 7.0 Public Order Exceptions to Consent under Present Telecommunications Privacy Law . 36 8.0 Public Health App Exception to Explicit Consumer Consent to Release CCI ................. 38 9.0 CONCLUSION AND REQUESTED RELIEF .................................................................... 44 10.0 APPENDIX 1: A “Privacy-First” Canadian Public Policy Approach to Digital Contact Tracing Technology (“DCTT”) Related to COVID-19 & Future Pandemics ................................. 46 Public Interest Advocacy Centre 9 September 2020 Part 1 Application Regarding “COVID Alert” App, “ABTraceTogether” App and Related Matters Page 3 of 46 1.0 INTRODUCTION 1. The Public Interest Advocacy Centre (PIAC) files this Application under the Telecommunications Act1 and pursuant to Part 1 the CRTC Rules of Practice and Procedure2 regarding digital contact tracing technologies, and in particular, the Government of Canada’s (“federal government”) pandemic contact-tracing application (“app”) for smartphone wireless devices and known and branded as “COVID Alert” (français: “Alerte COVID”) and the Government of the Province of Alberta’s app known as “ABTraceTogether” and related matters, namely, potential and actual actions by all major Canadian wireless service providers (“WSPs”) to identify Internet Protocol addresses (“IP addresses”) or mobile telephone numbers, by matching them with their subscriber data and potentially providing that matched subscriber information to the federal or any provincial government. 2. As the Commission is well aware, PIAC at an early stage of the pandemic (May 4, 2020), filed a Part 1 Application asking the Commission to inquire into the potential involvement of all Telecommunications Service Providers (“TSPs”) in pandemic app deployment. 3. On 17 August 2020, the Commission finally responded to PIAC’s initial application in a Letter Decision. The Commission found that the public interest was not best served by appointment of an Inquiry Officer or the issuance of a Notice of Consultation. It noted that: […] PIAC’s application, as filed, is broad in nature and does not identify a specific activity or action by TSPs in the development or implementation of contact tracing measures such that Commission intervention is warranted at this time. In addition, it does not demonstrate that existing privacy frameworks and protections are insufficient at this time to address the issues it has identified. 4. This new Part 1 Application is now brought, due to revelation of the details of, and the launch of, in particular, the “COVID Alert” app, so that we now are aware of its operation and flaws, and the roles of the TSPs in privacy violations. In short, this Application is specific in reciting the activities and actions of TSPs in contact tracing measures and further, lays bare the lack of existing protections under other existing privacy frameworks and their inability, in any meaningful manner, to control the creation and deployment of DCTTs. 1 S.C. 1993, c. 38. 2 SOR/2010-277, s. 22. Public Interest Advocacy Centre 9 September 2020 Part 1 Application Regarding “COVID Alert” App, “ABTraceTogether” App and Related Matters Page 4 of 46 5. We respectfully request that the Commission publicly post this new Application, which is in due and proper form, in accordance with its rules of procedure, before making any procedural or substantive rulings on our application. Should the Commission wish to combine our previous application with this new one, or that we formally withdraw the previous one, or considers the first Application dismissed, or that this one is somehow inappropriate, we signal that whatever the procedural approach, refusing to post this, our new application, is not acceptable. 6. Finally, we note that the Commission stated at the close of its Letter Decision of 17 August 2020, that it would be willing to reconsider the issue: Should the factual circumstances change or should indications arise that TSPs are participating – or contemplating participating – in contact tracing measures, the Commission may reconsider whether to inquire into these activities in order to determine what, if any, additional measures should be taken. As part of its monitoring efforts, the Commission will continue to communicate with the OPC. 7. We therefore submit that it is not appropriate to dismiss this new Application on the basis that it already has been considered, or that we are somehow abusing the Commission’s process. We reject those potential objections both on the basis of the above openness of the Commission to reconsider the issue and on the basis that we now have indeed information on TSP involvement in contact-tracing measures, as detailed below. 8. We also attach as Appendix 1, a detailed description of “Digital Contact Tracing Technology” (“DCTT”) in general and of several similar apps and systems, both those developed