TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Perspectives | Turn contact tracing apps on by default — Europeans shouldn’t need to opt in Related reading: Sharing COVID-19 data with government authorities: Guidance from DPAs

rss_feed

As European governments start easing lockdown restrictions, developing an effective contact tracing strategy has become a top priority to prevent a new surge of COVID-19 outbreaks. A key part of this strategy will almost certainly involve mobile contact tracing apps that automatically notify users who have encountered someone diagnosed with COVID-19. Unfortunately, the European Commission’s guidance issued in April recommends that, in line with the EU General Data Protection Regulation, users “should be able to give their consent to each functionality of an app separately” and that proximity data should “only be shared with the user's consent.” Leaving it up to individual users to choose to opt in to such an app would be a mistake — the only way this type of mobile app will reach a critical mass is if it is enabled by default.

Mobile contact tracing is emerging as a priority because public health agencies do not have the capacity to do this work manually. Moreover, manual methods rely on fallible human memories — many people are not going to remember everywhere they went in the past week — not to mention they simply will not know everyone they may have encountered at a grocery store or on a subway car. Mobile contact tracing would supplement manual methods by automating the process of notifying individuals who may be at risk of infection.

There are two main ways this might work. One method uses an app to track the location of users’ smartphones throughout the day. When individuals test positive for COVID-19, then public health officials use their location history to alert other people who were at the same locations at the same time. Countries including Cyprus, Czech Republic, Iceland, Israel and Norway have all released apps that use location data. Another method uses Bluetooth technology to continuously broadcast anonymous identifiers from users’ smartphones and record the identifiers of other nearby devices. When people test positive for COVID-19, public health authorities would then share a list of these people’s anonymous identifiers, automatically alerting people who may have encountered one of these infected individuals on the next steps they should take. This is the approach Apple and Google are using to create a common-platform that public health authorities around the world can use to build contact tracing apps.

Whether mobile contact tracing is effective remains to be seen. There will likely be a lot of false positives, and location-based tracking will only be as good as the location data. While some newer phones may use Wi-Fi signals to calculate users’ locations to one to three meters, GPS-enabled phones are only accurate to about four meters, and accuracy rates can decline substantially indoors. Similarly, Bluetooth tracking is imperfect — for example, it is not easy to distinguish between two people sitting together versus two people separated by a wall, yet tech companies are working hard to solve these problems.

The biggest issue for mobile contact tracing applications is likely to be reaching the adoption levels needed to be most effective. A study from Oxford University found that nearly 60%  of the population should use a contact tracing app to suppress an outbreak, yet getting to this threshold across European countries will be a challenge. Preliminary results in countries that have deployed an app suggest the uptake will be low — in Austria, for instance, only 400,000 people (4.5% of the population) had downloaded it by the end of April. Even where these apps have gained more traction, such as in Norway or Iceland, countries do not expect the impact to be game-changing. Even then, the GDPR’s provisions on data minimization would still apply, limiting the efficiency of those apps that relies on critical mass. In addition, while young adults aged 18 to 34 years old widely use smartphones, in many European countries large shares of adults aged 50 years or more (a population at risk) did not own one in 2018 — 64% in Germany, 53% in France, 60% in Spain, 48% in Italy, and as little as 35% in Poland. Second, many users do not enable Bluetooth, often because they are concerned about preserving battery life. Third, surveys of European populations, such as in France or Belgium, suggest divided opinions over whether they would use a mobile contact tracing app, in part because of privacy concerns. Apple and Google’s protocol, decentralized and designed to save battery power, could address at least the latter two problems — unfortunately, some EU member states remain opposed to adopting their solution.

Any contact tracing app will need to handle questions about privacy. Indeed, one of the reasons that the Bluetooth method has gained traction is that it does not rely on centrally tracking or storing information about where people go or other personal details. But while any contact tracing app should be designed to be as minimally intrusive as possible and only be used for public health purposes, policymakers recommended that the use of mobile contact tracing apps be voluntary and “based on explicit consent of the user.” Doing otherwise would prompt cries from privacy activists. Unfortunately, requiring users to affirmatively opt in for using these apps would mean significantly lower uptake, risking European lives. Instead, the European Commission should have encouraged member states to invoke and use the GDPR’s exceptions to consent requirement in case of an emergency and for reasons of substantial public interest.

Mandating that Europeans use an app would raise legal objections, but there is no reason not to enable them by default like so many other critical mobile phone updates. Tipping the scales in favor of participation would help such tools reach a critical mass. European governments have had to take unprecedented actions during the pandemic — issuing stay-at-home and social distancing orders and mandating that people wear masks — and while mobile contact tracing is not a silver bullet, it is a reasonable option to lower the odds of another outbreak of hotspots from emerging. It could also lead to a faster return of free movement across EU borders, fast-track coordination of measures between member states, and ease the pain for many businesses and sectors such as tourism.

The EU’s data protection law makes it hard but not impossible to do mobile contact tracing. The European Commission should clarify the GDPR’s provisions that allow data processing without consent and recommend EU countries use those, rather than advise them against accommodating the flexibility needed to enable solutions that could help save lives now and in the future.

Photo by Rob Hampson on Unsplash


Approved
CIPM, CIPP/A, CIPP/C, CIPP/E, CIPP/G, CIPP/US, CIPT
Credits: 1

Submit for CPEs

3 Comments

If you want to comment on this post, you need to login.

  • comment Rod Gliven • May 27, 2020
    The article by Daniel & Eline contains some interesting statistics and analysis on the technologies being promoted; governments interest & uptake; and, the opportunities to assist in kick-starting the economy, particularly in tourism, and in countries which rely on it as their primary source of income.
    
    Regrettably, it supports breaching one of the fundamental edicts of EU-GDPR, that of affording the individual on 'informed consent'.
    
    Whilst it could be argued as being for the 'greater good', the key premise is to enable an individual, the protection in law, to consent to their personal information being processed for: (a) a specific purpose.
    (b) for a limited period of time.
    (c) with the individual's full knowledge & approval.
    
    Without Governments being able to guarantee these elements, offer legal redress for non-compliance, why would individuals place any amount of trust in parting with their personal information. Further, why would individual place any amount of trust in solutions being offered by Apple or Google, given their previous failings in the privacy arena.
  • comment Marco Ermini • Jun 4, 2020
    I am afraid, but no.  I wholeheartedly disagree with both the article's premises and content.
    First of all, I have yet to see any evidence that contact tracing applications (or for what matters, location-based ones) do bring any benefits by themselves, if not integrated into a general policy of public awareness, enforcement of hygienic measures, selected services' lockdown and management of "social distancing".
    Second, GDPR does not make it hard at all to enable contact tracing, if required.  There are specific provisions in the law exactly for that kind of needs.
    Third, technical requirements make utility of that kind of apps very limited.  It won't work on devices who cannot upgrade to Apple iOS 13 or don't have access to Google Play Store (like all banned Chinese manufacturers).
    Finally, there is no European-wide contact tracing possibility.  Citizens of one country travelling to another won't be traced, because of the very nature of how those apps are implemented.
    Making those apps compulsory is no panacea - quite the contrary, and as of myself, I am all against forcing the population to swallow something which is redundant and worthless by design.  Remember the "data minimisation" principle?
    Germany, for instance, is doing great work reducing disease's spreading by very low-tech tracking and investigations.  There is no reason why everyone should not do the same.
    Let's keep being Privacy Professionals!
  • comment Daniel Castro • Jun 10, 2020
    Marco, I agree that we don't yet know if these contact tracing apps work. We say as much in the article. If they don't, we shouldn't use them. And as long as the EU still supports free movement of people, it is ridiculous to take a country-by-country approach to mobile contact tracing in Europe, rather than creating a pan-European solution. (The U.S. is even worse, with each of the 50 states taking its own approach to contact tracing.) 
    
    But the real question is what should we do if these apps work? If we can work out the bugs and mobile contact tracing apps are effective, are we going to sacrifice a viable solution to adhere to privacy ideas that weren't developed with a pandemic in mind? 
    
    Last time I checked, the GDPR was not carved in stone or handed down by some infallible diety. We should not be afraid to change them to meet the practical realities on the ground, especially if doing so can save lives.