Can City Hall ‘Deploy’ Contact Tracing App on Its Phones?

September 25, 2020

By Michael Bryant, Executive Director, Canadian Civil Liberties Association

Ahead of a second wave of the coronavirus in Canada, Toronto’s Deputy Mayor Stephen Holiday is asking City Council (on September 30th) whether it’s time for the City to leverage its power as an employer, by “deploying” the country’s exposure notification app, COVID Alert, on all its City-owned mobile phones used by thousands of employees.  Can a municipality decide what apps go on its mobile phones, if the phones then are surveilling City workers in some fashion? 

Slow down, we’d say.  Keep in mind that Canada made a very carefully considered and privacy-centered approach to contact tracing technology.  Use of the COVID alert app is explicitly voluntary.  All the privacy analysis done assumed that individuals would have a choice to meaningfully consent to its use.  So Council should realize that it may be messing with that underlying presumption.  It may be messing with the public trust that the national public health effort requires to be effective.  Council ought to at least hear from their workers, and public health officials federally and provincially, before a too-clever idea goes any further.    

Leaving aside that jumbo risk, there is the question of worker rights.  An employer may own their workers’ phones, but not their workers’ dignity, liberty, or privacy.  The courts have recognized that workers with employer-owned phones have a reasonable expectation of privacy, albeit it’s diminished, to permit employer access to their property.  Sometimes that access is addressed during the collective bargaining process, but most labour agreements didn’t see the pandemic coming. 

Nor can ‘deployment’ of the app be justified simply by blowing the COVID whistle.  Taking rights seriously means achieving proportionality between means and ends.  The nature of the privacy interest in this case is very serious:  tracking with whom I’ve come into contact is the stuff of police surveillance requiring warrants.  On the other hand, the privacy impact is low, thanks to privacy protections built in, and control that’s given by the app to the user.  But the public health utility is also low, at present.  It’s low because not enough people are using it and that won’t change no matter what Toronto does.   

So if both upside and downside are low, can an employer unilaterally do this?  Canadian labour law offers a test easily asked but not easily answered:  whether it’s reasonable in the totality of circumstances.  The answer turns on what exactly the Deputy Mayor means by “deploying” the app on all City mobiles.  I’d say that the City can’t do more than download the app on its phones, if at all.  The COVID Alert app allows users to control their private information at every stage of its functionality.  The City cannot and should not interfere with that user-control.   

Does ‘deployment’ interfere with that control?  It does on one front:  instead of getting to control whether the user opts in, ‘deployment’ could mean that workers have to opt out.  I’m not saying they can track their employees’ whereabouts for public health purposes – that’s not how the app works.  But could Council push the (opt in) COVID Alert app onto their workers, whose info potentially would be shared with other app users and potentially public health officials?    

For the City to nudge their workers towards using the app, they could start by encouraging as much by various means of communication and advocacy.   Better yet, offer incentives.  If Council insisted on going a step further, the only way would be installation of the COVID Alert app, without more.  That way the user has to actively opt-into the COVID Alert app’s functionality, albeit that presumes worker knowledge and worker empowerment.   

 If the employer presumes the employees’ choices, and enters that information for the employee, then that would be unreasonable, and therefore unlawful.  The City, of all employers, ought to be taking workers’ rights seriously, and that means respecting their dignity, autonomy and privacy to make their own choices about sharing their contacts, and ultimately their health status, with others.  The bigger risk arises with Canada’s largest City moving too quickly, causing an avalanche of unreasonable employer demands on a vulnerable workforce, and ruining the trust needed for high tech public health solutions to fulfill their potential in Canada.