Digital contact tracing against COVID-19: a governance framework to build trust
Sacha Alanoca, Nicolas Guetta-Jeanrenaud, Isabela Cosimato Ferrari, Nyasha Weinberg, R. Buse Çetin, Nicolas Miailhe · International Data Privacy Law · 2021
Countries around the world are confronted with an unprecedented health crisis, raising complex social, economical, and ethical challenges. To mitigate the spread of COVID-19, and as a way to transition out of complete lockdown, several Latin American countries have deployed or are considering deploying digital contact tracing applications. However, worldwide concerns have been raised over the widespread and generalized adoption of digital contact tracing applications. Concerns include their purpose, performance, impacts on privacy, data protection, human agency, and risks of stigmatization. Many of these emanate from mistrust in public authorities or technology firms, and fear of establishing mass surveillance. Disinformation and the lack of clear ethical, legal, and technical safeguards have polarized the public debate at a time when we need to build trust, and should not have to sacrifice civil liberties for public health. There is therefore a pressing need to co-design governance mechanisms that capture the health benefits of contact tracing applications while mitigating their potential risks and adverse effects. The urgency of the situation should not impact our collective ability to make informed decisions, and to responsibly navigate potential tensions between public health, safety, and civil liberties. Evidence suggests that the widespread adoption and efficacy of contact tracing applications is reliant on public trust and social acceptability, further reinforcing the need for ethical and legal frameworks governing their development. Since the outbreak of COVID-19 in late 2019 and its classification as a pandemic by the World Health Organization (WHO) in March 2020, the numbers of deaths and infections have continued to rise globally. As of December 2020, the count is at over 70 million diagnosed cases and over 1.5 million deaths.1 In Latin America, numbers have spiked recently, reaching over 14 million infections and 470,000 deaths, with the highest number of cases respectively in Brazil, Argentina, and Colombia.2 According to the WHO, the transmission rate (R0) of COVID-19 in Wuhan in January and February—prior to the implementation of comprehensive control measures—was 2–2.5,3 making COVID-19 highly contagious.4 Facing this unprecedented crisis, most governments immediately responded with strict social distancing rules coupled with partial, or total, lockdowns. These measures have slowed down the rate of infections, or ‘flattened the curve’, enabling healthcare systems to treat the flow of incoming patients. However, without capacity for large-scale testing and immunization, and without a vaccine deployed in the near future, these efforts can only delay the spread of the pandemic. Moreover, with about half of the world’s population in partial or total lockdown, these measures have had very significant socio-economic costs. At the peak of pandemic’s first wave, it is estimated that over 8 million people have registered for unemployment in France5 and over 33 million in the USA.6 Millions are unemployed across Latin America: in Brazil, a record 7.8 million people lost work between March and May 2020, leaving the percentage of the population that is still working below 50 per cent.7 An additional cost is the considerable mental health toll of stress and anxiety,8 and yet unknown costs from the suspension or delay of routine healthcare treatments. Confronted with the urgent need to mitigate the crisis, governments around the world have explored a combination of health care and technological tools. ‘Contact tracing’ describes a variety of techniques used to identify people who may have come into contact with a positively diagnosed individual, and take appropriate action to inform, isolate, and treat those contacts.9 The current debate over ‘digital’ contact tracing tends to overshadow the fact that ‘manual’ contact tracing has systematically been deployed in the past to mitigate epidemics such as tuberculosis, measles, HIV and, more recently, to limit the spread of Ebola and SARS.10 Relative to other diseases of the similar type, COVID-19 is considered to be highly contagious: it has a median incubation period of five days, with 97.5 per cent of those who develop symptoms doing so within 11.5 days.11 Estimates of the asymptomatic share of infected individuals range from 15.5 per cent12 to 56 per cent.13 In this context, labour-intensive manual contact tracing, which relies on human memory and trained medical staff, lacks both speed and accuracy to match the spread of the virus.14 Digital contact tracing can ‘improve’ manual contact tracing through the mobilization of digital planning and analytics, and ‘automate’ the process via a smartphone or smart bracelet for proximity tracking or digital health monitoring. By facilitating targeted testing of ‘at-risk’ individuals, digital contact tracing helps to break contamination chains. When coupled with appropriate measures such as social distancing, testing, and self-quarantine, it could be a key component to an effective strategy to contain the spread of COVID-19. Several countries which have managed to ‘flatten the curve’ of the first wave—such as Taïwan, South Korea, or Singapore—have deployed digital contact tracing as part of their strategy. According to the COVID-19 Digital Rights Tracker, there are currently 120 contact tracing applications deployed across 71 countries (Figure 1).15 The ‘Perú en tus manos’ application by the Peruvian Government. However, worldwide concerns have been raised over the widespread and generalized adoption of digital contact tracing applications. Issues include their purpose, performance, impacts on privacy, data protection, human agency, and risks of stigmatization. Many of these emanate from mistrust in public authorities or technology firms, and fear of establishing mass surveillance. Disinformation and the lack of clear ethical, legal, and technical safeguards have polarized the public debate at a time when we need to build trust, and should not have to sacrifice civil liberties for public health. There is therefore a pressing need to co-design governance mechanisms that capture the health benefits of contact tracing applications while mitigating their potential risks and adverse effects. The urgency of the situation should not impact our collective ability to make informed decisions, and to responsibly navigate potential tensions between public health, safety and civil liberties. Evidence suggests that the widespread adoption and efficacy of contact tracing applications is reliant on public trust and social acceptability, further reinforcing the need for ethical and legal frameworks governing their development. This article aims to shed light on problems related to digital contact tracing. Therefore, considering: (i) that this is an unprecedented global situation; (ii) that the operation of these tools is still largely misunderstood, especially by legal experts; and (iii) that this knowledge is essential to evaluate their potential to assist in health crises, to understand the real dimension of their risks and, therefore, to regulate them; one considers that addressing the theme could not be done without a detailed overview on contact tracing methods and technical features. Contact tracing applications can be based on a range of technologies and privacy-preserving protocols (see Figure 2). They can be voluntary—available for consenting individuals on mobile application stores—mandatory, or nudged. The data collection process can be proximity-based (usually acquired through Bluetooth), rely on GPS localization data, or both. Data can be stored locally on the individuals’ mobile devices in a decentralized approach, on a centralized server, or with a mixed approach. Finally, the analysis that is conducted by the relevant authority can range from simple proximity calculation to epidemiological modelling, hotspot mapping, and more. Digital Contact Tracing Technical Features. A technical imperative to the success of a contact tracing application is widespread installation. Once the application is downloaded, the contact tracing feature operates in the background of the device. While there is still no consensus among epidemiologists on the modelling assumptions of COVID-19 transmission—which depend on the number of cases, the R0 transmission rate, social customs, broader health strategies, and more—one initial study estimated that a contact tracing application with a minimum adoption rate of 60 per cent could effectively ‘stop the epidemic’.16 However, this is an upper bound, and the authors of the report subsequently pointed out that lower levels of adoption could be vital to curbing the spread of the virus.17 Installation of the application is a sizable issue for governments fighting COVID-19. Several countries have taken the radical approach of making the application mandatory for all citizens. China’s ‘contact detector’ plugs into the and used applications and The health and data to to individuals, to and essential In other such as or the application is from its is mandatory and The of countries have on or or can be in the additional on to or while to the pandemic or health The to which these additional adoption of the application depend on there are to the contact tracing per cent per cent and per cent a combination of a which the lack of consensus around the most effective approach. protocols rely on proximity A mobile other within a range for a this is as a the of numbers which several a of the other These can be stored on devices or a (see Data a to individuals when have been in proximity of a as Countries such as and the have all the In most cases, proximity is as within and are (see Figure application by the Government. the other GPS rely on mobile data to When individuals are as the contact tracing application other with have The GPS the additional with of of the and enabling targeted However, this is at especially or GPS protocols have been with of the more such as in or initial application Finally, application protocols and GPS data for contact tracing. The both GPS and data to record individuals’ The is and has been in several countries At a contact tracing applications or proximity for has no However, other applications additional in and in among numbers for In other such as for individuals who have been diagnosed with and is done such as in and medical at contact tracing applications COVID-19 data to the of the data at data has been and among application and In centralized data by contact tracing applications is on a this is highly and for on the other of proximity and locally on A decentralized as Tracing and by a is in several that of and a The and Tracing to the Tracing data on devices of all to a centralized an has The technical debate over data protocols the for a between technology firms, and governments to and for for In for applications to be across technologies be and such as the have for a firms, their control over devices have taken as adoption of by the fact that and relies on that to other protocols on not background further the This has countries such as who the to over to over a of contact tracing are and contact tracing applications concerns by data, of is complete data is in methods of data are of most contact tracing applications. such as in in or in to which in cases over time for additional the and the protocols to that data by the application not to be Since contact tracing is only relevant within a number of of a most contact tracing applications limit the time period for data which it is from the medical world application the incubation period of the has been at about days, 14 has been used in and have all applications that data for no more In decentralized data is on the mobile for In data is only countries such as South Korea, and have not their applications to The data by contact tracing applications can for governing The of contact tracing data in proximity between infected individuals and application by or However, several countries data from contact tracing applications for The initial for digital tracing data from the COVID-19 application into epidemiological to study The adoption of digital contact tracing applications ethical the and of the data these technologies have the potential to civil liberties and human such as privacy, data protection, human and digital contact tracing of to that could on This health and, in cases, other data such as or social According to the COVID-19 Digital Rights Tracker, contact tracing million not have a of and legal, and safeguards therefore There are of in this the of the application and the to which it over to the while control over individuals to make about the of their the pandemic through digital contact tracing may of Since it to privacy, individuals should be to out these to build trust in and for the technology There is currently debate among digital over the privacy-preserving application (see Figure protocols have over GPS contact are to However, these protocols are more at of there is no of and people can individuals could the to and spread the and symptoms to the of applications to COVID-19. for this from on COVID-19 tracking of is data Technical taken in this by contact tracing applications may not mitigate the Several have been of to In data from 1.5 million people and that it so to that per cent of could be with only contact tracing applications data with other such as and social as in and South Korea, there is a for and mass surveillance. risks the concerns over the of a by governments and technology through digital contact tracing. between the lack of healthcare and the of socio-economic governments such as and the have deployed digital contact tracing without through and on informed Many fear such measures on civil liberties the pandemic and Therefore, an effective governance is essential to the of digital contact tracing applications their initial Concerns have been raised about the impact of contact tracing applications on who have and There are significant in countries or that or the data from contact tracing applications to make on the data from contact tracing applications can be used to and there is a that from data be used to or such as or or socio-economic is the that or individuals of contact tracing applications be to or to Digital contact tracing an of as it data on This data can be used the of COVID-19 and to out risks of of or could an for and In and such as are more to the in these with the impact of digital contact tracing be all the more for these and social However, the data that be used to an essential in fighting the pandemic’s the of the risks with COVID-19, data by contact tracing applications can be to To be contact tracing applications rely on mass to digital technologies and the measures at the digital be and be to mobile technology across the In of the world’s population not a and smartphone only per cent in and 60 per cent in and South to is in not to the cost of to Digital is highly with other socio-economic one of in to be on and more highly the with have from the digital has that it is not only essential to a percentage adoption rate for contact tracing applications to be that adoption be spread across the the more it is and is most widespread there is more digital and of mobile Therefore, there is a very of the and their The digital may a The of these concerns suggests the need of a and governance to that of contact tracing technology is by and that governments and the are for of this governance tools can be in the of contact tracing legal of and impact and public and that public trust and social an in with COVID-19 governance is therefore essential for the of contact tracing and can rely on several legal and In several countries contact tracing applications have been these technologies are by legal a in which the public and the applications can and legal that application and are to the At the very countries contact tracing applications with and and frameworks are most has been to to the and of contact tracing applications. Data through contact tracing applications to health which is by systems for data However, across While the has a comprehensive data in the of the Data data across Latin the and the of a data as a To trust, digital contact tracing should be in with of data by and In these be by the which that of and be with about the be and that this be in an Data should include to the of data by or of the for in that the of essential data the of people infected or of infected with the is mandatory between public and of of the and the There is a significant that a of could to widespread of is to that is on the of the analysis of health not the of contact tracing applications. To we need to between of and In this contact tracing applications based on the health of their individuals are or to the There is no in and of to this The when the data by these applications is used to make between when health that data to to those who have been infected by COVID-19. When these In those cases, for the of or of 14 of the of frameworks and for the of contact tracing applications and the way may of the be that to to or other of social the of and and to in the of a technology that is to with the risks The for the governance of applications is to a of around the digital contact tracing and have all or in this that have been considered in these the of the of the legal of and to and of contact tracing on the for which applications can be for make of the application a for to of data the data be no more that for the spread of COVID-19. In to legal safeguards on the of contact tracing their and can rely on other of is essential in of the process to build in should be can the with ethical and Finally, could that the is the of digital contact tracing the has that these be to an that that as can mechanisms for and of the technology to that impact are out to and that the technology is working as The may be to the the the applications the or to a theme as part of an such as for data the in an on the contact tracing a first for the governance of Several countries have taken in this when deploying their contact tracing by making their application The of for is on and from and and have to make their among and with can public To the of those who are to be to the application that have a in testing and the of the to this public could include from the public health civil and of legal are and additional are a technological impact A technological impact the of digital contact tracing public are and is to In the the impact to be at an The of the data through the applications suggests that impact are to the and ethical, and the impacts at of these levels helps to build public of the application of these and concerns about the lack of by can to The should to the of the application ethical and and to these to those that the The of an to an should to In to legal and governance the adoption of an ethical is a for several Since contact tracing applications are a there are legal frameworks on the Many countries not have and those that still about the and of these tools in the of contact tracing. Since ethical are based on we to on such a the of our can make the to these into their legal governance include legal tools that can with on an They are and to be This at such as COVID-19, risks are still largely is the collective of public health authorities and digital to develop an ethical and legal to navigate tensions between public health, safety, and civil liberties. The urgency of the situation should not impact the capacity to build a comprehensive application and that informed individuals are more to significant when these are and a is therefore key to social and contact tracing In this we an that we have to evaluate digital contact tracing applications. The of the is to as the for civil application and among when the ethical risks and benefits raised by digital contact tracing The have been to be with a with to for the of contact tracing applications. This for the of digital contact tracing applications with to of among other This article several of the on for the adoption of systems and other These include ethical frameworks for adoption by the for and the and of and ethical for digital health applications in of pandemic by as the Data or as the of and for cases the World for In cases, these ethical such as by and of data and are by legal frameworks such as the for the However, these are into a in light of the pandemic and digital contact tracing applications. is the is to evaluate all contact tracing are deployed or development. The from the aims at application public health authorities and to the of contact tracing applications. This in or not to technological and which and with which strategy. and The of applications should be in the broader context, and and be to to the with no not should be to the application or at all by Contact tracing applications should the highest levels of Data should be and of data and technology Data collection be and with a data to the should be used and and The complete for the application and tracing be and without for and and should that contact tracing applications not people and their of social and people who not to the should be that smartphone applications and are not for the and should be to and informed on the purpose, and data should be to the and should be a Contact tracing applications be and by in the and should be through clear legal frameworks of and purpose, and the contact tracing application within a broader public health strategy with social distancing measures and the other public health measures there a or the of the the of the application can be by or other there an for the application in it has its or to its and the application additional on the application or to and are these with have the to or the with all their by considered when the the data collection and the data applications are more GPS are additional taken to data such as the data with this in the of and can of data and technology of data is of health data is other data is the of data by the contact tracing application by the and with the of the health of are conducted in to contact with the and with the is data stored and the of data and clear to the and by The should be in clear and the application on a that and and been to the people could from the data and from the application on the application of social social such as and the applications as a the application used for to people to benefits or to to the application for the digital of population the or there been measures to mitigate this the by the application and informed for their at there in the application can include via of the application on to or the there and the public their trust in these the public in the and of the application both and the public in The of contact tracing that be the to about and measures to and their data who is to and the data which is are on the of the data which is is this data and in combination with which other data this with the of data and who can make about the and governance of the are these can these applications through the of this a range of by A number of have out the most the applications of and and China’s applications have been to of with our and (see Figure In cases, technical safeguards public and has not been to this However, the of the first of that applications that for the highest levels of and can the lack of clear and public tensions and in the current digital contact tracing applications. The of Latin is of numbers have way to record across the all Latin American and governments have in technologies for of these applications is complex in Latin to per cent of the population not have to to the has These applications in their the of the most are to or both countries have deployed contact tracing in the contact tracing to has deployed a contact tracing ‘Perú en tus The application both and GPS and the of that all data is stored on The epidemiological of COVID-19, and the way it has spread across the make digital contact tracing applications a in a to the pandemic. However, the of the ethical at in the and to of such it is our collective to build ethical and governance frameworks to make informed to these are the of public trust and raising public of which are essential to an adoption and In this we have an overview of governance mechanisms as as an ethical and a number of on which to evaluate contact tracing or still in development. governing should be of as a way out of only a combination of technological and public health by an informed can COVID-19.