Evaluation Questions to Assess a Digital Contact Tracing / Exposure Notification Application

Executive Summary

This briefing provides a framework for evaluating proposals for Bluetooth exposure notification (EN) and contact tracing (CT) applications, organized around two key themes: privacy and security, and adoptability and implementation. The proposed questions serve as a framework for assessing the effectiveness, feasibility, and potential limitations and harms of a given CT/EN proposal, and are meant to ensure that the use of such applications does not infringe upon Canadian citizens' fundamental rights and freedoms, and that the technology in question is secure, transparent, verifiable, and used only to address public health purposes in slowing the rate of transmission of COVID-19 and advancing public health and safety during the pandemic.

In applying this framework to a specific proposal, policymakers should demand thorough and transparent implementation details rather than vague assurances or technological promises. For example, a satisfactory answer to the question of how an app can be customized to suit provincial and regional needs would explain, in detail, how the developer would work with provinces to modify the application, which aspects would be modified, how often, and by whom.

Contact tracing and/or exposure notification proposals, and applications already implemented, should be reconsidered under evolving conditions of their use, especially if an app is deemed ineffective at slowing transmission rates or accurately informing users; is demonstrably vulnerable to data misuse, security breaches, and/or malicious attacks; or is shown to cause undue harm and discrimination and/or infringe upon users' fundamental rights and freedoms.