Evaluation Questions to Assess a Digital Contact Tracing / Exposure Notification Application
Taylor Owen, Derek Ruths, Peter John Loewen, Stephanie Cairns, Sta Kuzviwanza, Sara Parker, Sonja Solomun
June 2020
The purpose of this briefing is to provide a framework and approach for evaluating proposals for Bluetooth exposure notification (EN) and contact tracing (CT) applications. The briefing provides guiding evaluative questions which are partitioned into two key themes: privacy and security, and adoptability and implementation. The proposed questions serve as a framework for assessing the effectiveness, feasibility, and potential limitations and harms of a given CT/EN proposal.
These guiding questions serve to ensure the use of CT/EN applications does not infringe upon Canadian citizens’ fundamental rights and freedoms; that the technology under question is secure, transparent, verifiable, and used only to address public health purposes in slowing the rate of transmission of COVID-19 and advancing public health and safety during the COVID-19 pandemic.
In employing this framework to evaluate a specific CT/EN proposal, policymakers should demand thorough and transparent implementation details rather than vague assurances or technological promises. For example, a satisfactory answer to the question, “how can the app be customized to suit provincial and regional needs?” would explain, in detail, how the developer would work with provinces to modify the application, which aspects would be modified, how often, and by whom.
Contact tracing (CT) and/or exposure notification (EN) proposals and already implemented applications should be reconsidered under evolving conditions of their use, especially if an app:
is deemed ineffective at slowing transmission rates or accurately informing users
is demonstrably vulnerable to data misuse, security breaches, and/or malicious attacks
is shown to cause undue harm and discrimination and/or infringe upon users’ fundamental rights and freedoms
