Since late 2019, the world has been fighting the coronavirus disease (COVID-19). In response to the pandemic, governments around the world have been using data and technology in their efforts to contain the spread of the virus. In March, Access Now put forward privacy and data protection recommendations for governments to fight COVID-19 in a rights-respecting manner.
Building on these recommendations, we are now publishing a list of dos and don’ts for privacy-friendly COVID-19 contact tracing apps.
What is contact tracing?
Contact tracing is the process of identifying, assessing, and managing people who have been exposed to a disease to prevent onward transmission. Through this process, governments and health workers aim to help limit the spread of a virus, interrupt ongoing transmission, and learn about the pandemic.
Contact tracing has historically been conducted mostly manually by individuals but a large number of apps are currently being developed or are already in use to track the spread of COVID-19.
Is digital contact tracing necessary?
Tracing and tracking inherently lead to some interference with human rights, especially the right to privacy. Any interference with human rights should respect the legal standard of necessity and proportionality, and this applies as well to the development of a contact tracing app.
The Ada Lovelace Institute recently released a report showing there is no clear indication that contact tracing apps will help curb the spread of the virus, based on the evidence available today. There are several issues that make the COVID-19 virus particularly difficult to track and that put in question the efficacy of contact tracing apps for this purpose.
First, the fact that the virus is highly contagious and many people are asymptomatic and therefore do not know they are infected makes it inherently difficult to track, whether or not you use digital technology. But there are also issues specific to the technology that is being used. One of the inventors of the Bluetooth technology that contact tracing apps leverage recently said that the technology is “not very accurate” at judging distance, as it was not built to be used for that purpose. It may actually produce a false “positive” or “negative” indication of contact, since physical proximity as detected over Bluetooth does not mean contact. For instance, you could be living in a building with a very thin wall and the Bluetooth signal of your phone might indicate that you interacted with one of your neighbors, even if you have not been in contact.
Another consideration for evaluating the efficacy of these apps is that many people classified as “high risk” for contracting the virus or experiencing severe health consequences as a result, such as the elderly, people with pre-existing conditions, those with disabilities, or people living in minority and low-income communities, may not own a smartphone or be able to use the application as few of them have been developed with accessibility in mind. That means the data from these apps may exclude information about some of the most important members of the population to track.
Experts from the World Health Organization have further explained that to date, we have only “anecdotal evidence” of the efficacy of contact-tracing apps, which cannot in any case replace manual contact tracing and other traditional public health measures. At best, contact tracing apps can be complementary tools, but given what we know, they should never substitute for the methods of public health experts that allow for guidance by doctors and health care workers for patients and those potentially infected by COVID-19.
Countries that already use app-based contact tracing have not necessarily seen better COVID-19 outcomes. For instance, governments around the world have been praising the work of Singapore in “flattening the curve” of the curve due to the use of the Tracetogether app, neglecting any other measure that the country may have taken. But despite the implementation of the app, last week the country had to extend its lockdown after a surge of new cases.
Even if using a contact tracing app proves beneficial as part of a public health response in one country, it may not work as well in another. The efficacy of such an app will depend on other factors, such as the health measures that a country has already put in place. That includes the number of tests that have been made available or are being conducted. Jason Bay, the product lead for Singapore’s TraceTogether app, recently said “[i]f you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No.”
There is still much we don’t know about this virus and the pandemic is first and foremost a public health issue. While the concept of a “magic” technological solution may be appealing, there is real danger in techno-solutionism that may erode the public’s fragile trust in an evidence-based response to the COVID-19 crisis — and beyond.
As privacy advocates, our aim is to help governments and companies that are considering, developing, or implementing technology for fighting COVID-19, such as contact tracing apps, to do so in a way that will protect people’s rights — now and in the future. Otherwise, we risk this public health crisis becoming a human rights crisis. While we acknowledge that many governments have already decided to use contact tracing apps, we encourage lawmakers across the world to hold public debates as a first step in decision-making, to determine whether the use of such apps is in fact necessary as part of their response.
While it is not clear whether digital contact tracing is effective in fighting COVID-19, what should governments and companies consider if they are developing or deploying apps and APIs?
The list of recommendations below aims to guide decision-makers, developers, and auditors in their evaluation of contact tracing apps. The goal is to ensure that any apps developed or used are as privacy-friendly as possible.