Digital contact tracing apps for COVID-19: How to gain trust

  • Applications to isolate individuals from infected parts are very effective in slowing the transmission of COVID-19.
  • Apps require governments to collect data and locate your location, leading to privacy concerns.
  • Existing regulatory guidelines could be used effectively, taking a country approach and strengthening them where necessary.

In response to COVID-19, many countries have turned to digital contact tracing (DCT) technologies to fight the deadly pandemic. Basically, these are applications used to detect, trace, and grant access permission to isolate infected people from the uninfected.

Emerging research in countries where DCTs have been implemented, such as the UK and Spain, suggests they are better than manual contact tracing at slowing COVID-19 transmissions and saving lives.

When paired with digital infrastructure, testing, social distancing and vaccines, DCTs promise to revolutionize the fight against pandemics and will be essential in getting our lives back to normal.

However, users need to shy away from a certain degree of privacy, with most contact tracing services requiring users to at least report their location data. As a result, the public is reluctant to allow governments to snoop around their privacy.

DCT: various uses, actors and types of data

Image: authors’ compilation

Contact tracing has its dangers

Successful implementation of DCTs requires a “marriage of convenience” between tech companies and governments, which has resulted in an unprecedented accumulation of private data.

In China, the government is reportedly working with Alibaba and Tencent to enforce CSDs, while in South Korea, the government is working closely with Naver and Kakao to achieve the same goals.

Likewise, in the United States and Europe, some states and countries are working with Apple, Google, and other developers to implement DCTs.

Some view the situation with caution, saying governments’ regulatory power over tech companies could weaken over time, leading to privacy concerns. These concerns have grown in light of recent cases of Apple, Google and Facebook using their powers to increase their influence over leadership and political processes in different countries.

Worse yet, these technologies have links to police and state control in some countries. In Canada and Japan, the revelation of contact tracing data has led to widespread stigma against infected citizens. Additionally, there has been recent controversy over how only half of the QR code data was destroyed in South Korea.

Big tech and governments have massive influence over private data with limited oversight beyond legal fixes and diverse guidelines.

—Danbee Back, Cornelius Kalenzi and Moonjung Yim

All of this begs the question: is the state of technology governance ready and able to implement CSDs and address public concerns about privacy? Next, how can governments build public confidence in DCTs to enable the health system to use them beyond COVID-19?

New territories: supervise the digital tracing of contacts

Due to the myriad of data privacy concerns, contact tracing requires governance in the form of regulations to build public confidence in DCTs and ensure their continued use after COVID-19.

CSDs must be designed to operate within the limits of laws and systems that respect the human right to privacy and democracy. Several forward-looking proposals on achieving DCT governance are currently under discussion, including the framework for the governance model for public-use access data authorized by the Forum, as well as more comprehensive regulatory regimes.

The reality is that overall, big tech and governments have massive influence over private data with limited oversight beyond legal fixes and diverse guidelines. What is under-explored in this evolving debate is whether existing institutions and regulatory systems can be compared to build safeguards and ensure public confidence in CSDs.

The regulatory status of contact tracing in the world

The regulatory status of contact tracing in the world

Image: author’s compilation

For now, it appears that countries mainly rely on three types of governance approaches:

Some countries, including South Korea, Singapore, Taiwan and Israel, rely on regulatory updates.

Countries like the United States use self-regulation– by placing less importance on privacy and government overbreadth.

In Europe, governments try to work with companies to ensure that CSDs comply with existing regulatory frameworks like the GDPR.

Staying with the latter, there is a set of existing regulations that would allow countries to be flexible and to compare what might work in their political and social contexts.

Ways to approach the existing guidelines

First, there is an urgent need to address issues related to social stigma and ensure that private contact tracing data remains secure. Therefore, public education programs and campaigns should be designed to limit the shame of COVID-19. In regulatory frameworks, the right to be forgotten in Europe can help. However, laws need to be updated to penalize perpetrators who disclose private data or use the internet to intimidate other people.

Through such initiatives, governments may be able to separate technologies from social stigma and build lasting trust in DCTs beyond COVID-19.

Another option is for countries to follow the lead of South Korea, Taiwan and Singapore, whose success in implementing CSDs has come from supporting existing laws on privacy and data governance with laws covering CSDs. Other countries might consider expedited reviews of existing laws in the context of CSDs, especially since CSDs operate in countries with outdated legal systems, such as the United States.

With the speed of technology adoption worldwide as sky-high as it is today, agile governance models that seek to revise and rapidly adopt legal and institutional frameworks are needed to ensure the success of CSDs.

In cases where regulations are subject to a complex government process, safeguards could be established or strengthened through existing approval and regulatory bodies such as the FDA’s Pre-Cert for Digital Health Software at United States. DCTs could benefit from a similar method of verifying safety and efficacy through continuous monitoring from the pre-market development process to further verification of post-market performance.

South Korea and Australia are proposing to delete data after a certain period of time, and this should be implemented by an independent and trustworthy watchdog.

—Cornelius Kalenzi

If the public deems these organizations to be trustworthy, CSDs may find some level of trust among users.

That said, given the scale of adoption and the amount of privacy data involved, the bodies and approval processes that are currently trusted may not be enough to ensure privacy. And that means additional binding directives may be needed.

One area of ​​interest is ensuring that contact tracing data can only trace exposure and is never shared. Some governments, including South Korea and Australia, are offering to delete data after a certain period of time, and this should be implemented by an independent and trustworthy watchdog.

Further safeguards could follow the steps of the Norwegian Data Protection Authority and the UK Center for Data Ethics and Innovation to identify how the public can fully reap the potential benefits of CSDs in the marketplace. framework of the ethical and social constraints of liberal democracy. Through reliable review processes, sanctions could be enforced without having to push for regulations “stifling innovation”, and at the same time, trust could be built in the technology.

Given the risks to privacy and the lack of trust of citizens in the way CSDs are supervised (or not) around the world, governments should focus on erecting guardrails to build confidence in this. technology, starting with strengthening existing systems.

If they manage to gain the trust of users, governments could create a situation in which DCTs are trusted and become an integral part of global health systems in the post-COVID-19 world.


Comments are closed.