The social contract in action: using personal data for COVID-19 contact tracing

International and national laws recognize that, in extraordinary circumstances, certain fundamental rights, including the right to data protection, may be restricted, with the following conditions: basic democratic principles and safeguards are ensured, and the restriction is legitimate, time limited, and not arbitrary.¹

Following the World Health Organization’s declaration of a global pandemic in mid-March 2020,² governments around the world have adopted contact tracing strategies to track down any individual who might have come into contact with an infected person, so that they may be quarantined to prevent further spread of the disease.³ Such contact tracing has historically been carried out manually by public health authorities.⁴ However, it can be undertaken much more efficiently on a massive scale using digital technologies such as mobile applications, which can simultaneously deliver public health advice.

Despite these benefits, contact tracing raises several concerns. First, tools relying on location tracing may be construed as unwarranted surveillance and a threat to privacy, especially in jurisdictions with inadequate data protection frameworks⁵ and given that location data are hard to anonymize fully. Second, personal data collected in contact tracing currently flow beyond trusted parties and organizations, reaching more third parties than accounted for in current governance models. Third, there is evidence that using geographic location in contact tracing may be inaccurate and inefficient because it does not provide all of the relevant facts. An empirical study of the Ebola outbreak found that those data are meaningful only when reidentified, touching on the “purpose limitation” used in good-practice data protection laws.

While countries around the world have been developing contact tracing apps, two approaches have emerged: centralized and decentralized. Both approaches use Bluetooth signals to log when smartphone owners are in proximity to one another, sending alerts to users who may have been infected when someone develops COVID-19 symptoms.

Under the centralized model originally pursued by the UK government, anonymized data are gathered and uploaded to a remote server, where matches are made with other contacts when a person starts to experience COVID-19 symptoms.⁶ The United Kingdom’s proposed approach contains a persistent identifier that is shared with the National Health Service, allowing public authorities to receive infection data automatically. The central server then alerts other app users who have had significant contact with the infected person. Despite the public health merits of the centralized approach, the application was abandoned in mid-June 2020 in favor of a decentralized approach, due to low rates of phone recognition during its testing phase on the Isle of Wight.

In contrast, the decentralized model, promoted jointly by Apple and Google, aims to support contact tracing by health agencies, while integrating privacy and security into the design.⁷ Users have more control over their information because it is stored in a decentralized manner on their phones, preventing the siphoning of data into central government servers. In this model, “The protocol excludes processing of any location data—unless the user opts in—applies ‘Rolling Proximity Identifiers’ that prevent identification of the user, processes proximity identifiers obtained from other devices exclusively on the device, [and] permits only users to decide whether to contribute to contact tracing by sharing Diagnosis Keys with the ‘Diagnosis Server’ if diagnosed with COVID-19, resulting in the alert to other users.”⁸

A multistakeholder consortium, the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) community, is developing contact tracing technologies that adhere to strong European privacy and data protection laws and principles.⁹ The PEPP-PT technical mechanisms and standards fully protect privacy, while taking advantage of the possibilities of digital technology to maximize the speed and real-time capability of national pandemic responses. Initiatives under the umbrella of PEPP-PT aim to develop an open protocol for COVID- 19 proximity tracing using Bluetooth Low Energy on mobile devices and an architecture to ensure that personal data stay entirely on an individual’s phone.