As European governments start easing lockdown restrictions, developing an effective contact tracing strategy has become a top priority to prevent a new surge of COVID-19 outbreaks. A key part of this strategy will almost certainly involve mobile contact tracing apps that automatically notify users who have encountered someone diagnosed with COVID-19. Unfortunately, the European Commission’s guidance issued in April recommends that, in line with the EU General Data Protection Regulation, users “should be able to give their consent to each functionality of an app separately” and that proximity data should “only be shared with the user's consent.” Leaving it up to individual users to choose to opt in to such an app would be a mistake — the only way this type of mobile app will reach a critical mass is if it is enabled by default.

Mobile contact tracing is emerging as a priority because public health agencies do not have the capacity to do this work manually. Moreover, manual methods rely on fallible human memories — many people are not going to remember everywhere they went in the past week — not to mention they simply will not know everyone they may have encountered at a grocery store or on a subway car. Mobile contact tracing would supplement manual methods by automating the process of notifying individuals who may be at risk of infection.

There are two main ways this might work. One method uses an app to track the location of users’ smartphones throughout the day. When individuals test positive for COVID-19, then public health officials use their location history to alert other people who were at the same locations at the same time. Countries including Cyprus, Czech Republic, Iceland, Israel and Norway have all released apps that use location data. Another method uses Bluetooth technology to continuously broadcast anonymous identifiers from users’ smartphones and record the identifiers of other nearby devices. When people test positive for COVID-19, public health authorities would then share a list of these people’s anonymous identifiers, automatically alerting people who may have encountered one of these infected individuals on the next steps they should take. This is the approach Apple and Google are using to create a common-platform that public health authorities around the world can use to build contact tracing apps.

Whether mobile contact tracing is effective remains to be seen. There will likely be a lot of false positives, and location-based tracking will only be as good as the location data. While some newer phones may use Wi-Fi signals to calculate users’ locations to one to three meters, GPS-enabled phones are only accurate to about four meters, and accuracy rates can decline substantially indoors. Similarly, Bluetooth tracking is imperfect — for example, it is not easy to distinguish between two people sitting together versus two people separated by a wall, yet tech companies are working hard to solve these problems.

The biggest issue for mobile contact tracing applications is likely to be reaching the adoption levels needed to be most effective. A study from Oxford University found that nearly 60%  of the population should use a contact tracing app to suppress an outbreak, yet getting to this threshold across European countries will be a challenge. Preliminary results in countries that have deployed an app suggest the uptake will be low — in Austria, for instance, only 400,000 people (4.5% of the population) had downloaded it by the end of April. Even where these apps have gained more traction, such as in Norway or Iceland, countries do not expect the impact to be game-changing. Even then, the GDPR’s provisions on data minimization would still apply, limiting the efficiency of those apps that relies on critical mass. In addition, while young adults aged 18 to 34 years old widely use smartphones, in many European countries large shares of adults aged 50 years or more (a population at risk) did not own one in 2018 — 64% in Germany, 53% in France, 60% in Spain, 48% in Italy, and as little as 35% in Poland. Second, many users do not enable Bluetooth, often because they are concerned about preserving battery life. Third, surveys of European populations, such as in France or Belgium, suggest divided opinions over whether they would use a mobile contact tracing app, in part because of privacy concerns. Apple and Google’s protocol, decentralized and designed to save battery power, could address at least the latter two problems — unfortunately, some EU member states remain opposed to adopting their solution.

Any contact tracing app will need to handle questions about privacy. Indeed, one of the reasons that the Bluetooth method has gained traction is that it does not rely on centrally tracking or storing information about where people go or other personal details. But while any contact tracing app should be designed to be as minimally intrusive as possible and only be used for public health purposes, policymakers recommended that the use of mobile contact tracing apps be voluntary and “based on explicit consent of the user.” Doing otherwise would prompt cries from privacy activists. Unfortunately, requiring users to affirmatively opt in for using these apps would mean significantly lower uptake, risking European lives. Instead, the European Commission should have encouraged member states to invoke and use the GDPR’s exceptions to consent requirement in case of an emergency and for reasons of substantial public interest.

Mandating that Europeans use an app would raise legal objections, but there is no reason not to enable them by default like so many other critical mobile phone updates. Tipping the scales in favor of participation would help such tools reach a critical mass. European governments have had to take unprecedented actions during the pandemic — issuing stay-at-home and social distancing orders and mandating that people wear masks — and while mobile contact tracing is not a silver bullet, it is a reasonable option to lower the odds of another outbreak of hotspots from emerging. It could also lead to a faster return of free movement across EU borders, fast-track coordination of measures between member states, and ease the pain for many businesses and sectors such as tourism.

The EU’s data protection law makes it hard but not impossible to do mobile contact tracing. The European Commission should clarify the GDPR’s provisions that allow data processing without consent and recommend EU countries use those, rather than advise them against accommodating the flexibility needed to enable solutions that could help save lives now and in the future.

Photo by Rob Hampson on Unsplash