We're kind of beyond the point of hypotheticals. The Prime Minister has said that the government is looking at contact-tracing apps as a way to deal with reopening the economy, so I kind of reject your assertion. If you're saying it's hypothetical and your department hasn't gotten on this yet, I don't really think that you are taking privacy seriously.
I guess I'll ask again: Given that this is something that your department should have been seized with, given the Prime Minister's comments, what part of PIPEDA would apply to an app that is developed pro bono?