Surely the century’s deadliest pandemic calls for some of Big Tech’s strongest firepower? As governments around the world start looking toward exit strategies without a vaccine for COVID 19 yet available, Apple, Google and Facebook are stepping in to fill the gap. But will contact tracing work? And what about data privacy? The social credit system in China may well make tracking apps and symptom reporting more readily acceptable. But other countries must tread the fine line between individual privacy and communal protection.

The use of technology to help combat the highly infectious coronavirus, began even before its status as a pandemic was established. The tracking ability of apps is clearly helpful in tracing the path of infection as it moves from person to person. This is called contact-tracing in medical circles and is not new. Contact tracing was used in the fight against HIV and the 2015 Ebola outbreak in Africa. It involves asking people who test positive for the names of everyone with whom they have recently been in contact. People who may then have been exposed to the disease are traced and contacted in order to provide them with advice on how to proceed.

This has traditionally been done by human beings. The provision of advice on an individual basis is still best done by people rather than apps. In Massachusetts for example, 1000 contact tracers have been hired to interview people who’ve become infected with coronavirus. But given the speed of transmission of COVID 19, digital tracing methods are increasingly attractive. Contact tracing can also work if one self-reports, assuming of course that one is reasonably honest and accurate. For example, the Governor of Rhode Island, asked the entire population to keep a journal of the people they met and the places they visited each day. If they fall sick, this journal can be handed over to health officials and used to trace those who may have been infected.

Carnegie Mellon University very happy with Facebook and Google survey results so far.

Facebook has begun work with Carnegie Mellon University in the US to create a map, showing the proportion of people who say they have experienced coronavirus symptoms, by State. The data was gathered from more than a million Facebook users who completed a survey compiled by Carnegie Mellon University. It is voluntary and depends on respondents accurately reporting their symptoms. Nevertheless, researchers at the university say that they are very happy with both Facebook and Google survey results so far. Updated on a daily basis, these results, combined with other data sources, provide real time indications of COVID 19 infections. This information helps health officials and local governments make decisions about how to allocate limited resources such as ventilators, testing equipment and face masks.

Google and Apple have recently announced their joint effort to use Bluetooth technology  in order to create the foundation (application programming interface) for contact-tracing apps that will work across both iOS and Android phones. The idea is to use low energy Bluetooth waves, which have a range of about 9 meters, to track whether a smartphone owner has come into contact with someone who may be infected with coronavirus.

No one knows for sure if Bluetooth will work for digital contact-tracing.

Importantly, Apple and Google say that the system will be anonymized. This means there will be no identifying data stored on a server and it won’t involve location data.  Data experts agree however that Bluetooth was not designed with this in mind. So no one knows for sure if it will work, warns Bennett Cyphers of the Electronic Frontier Foundation. ‘It is highly experimental and we certainly shouldn’t put all our eggs in one basket’, he says. Nevertheless Cyphers agrees that the current Apple/Google initiative is ‘relatively good’, in terms of transparency and decentralization.

Currently in the development phase, it is later that issues concerning consent will come to the fore. ‘Consent is going to be critical at every stage’ emphasises Bennett.  This means that even after a user has opted in for such an app, it should still be possible to change one’s mind and op out, taking one’s data with you. Further, any new data collection from an individual who has previously given consent should require further requests for consent. There should also be no compunction to download the app, this includes from your boss or child’s school. Voluntary use of these apps, which is clearly linked to trust, is vital for success.

Data scientists concerned about slow eroding of data privacy over time.

Data Scientist and researcher at the Brookings Institute in the US, Alex Engler, supports what he terms ‘a cohesive effort for digital contact tracing’ because of the relative ease and low cost of such projects. However, he worries about ‘the slow eroding of data privacy over time’, especially if the pandemic drags on over a period of years.  Engler also points out that privacy issues can arise simply from combining different sets of data. So-called re-association can take place with just a few other data points. Data Protection Officer for Uber, Europe, Simon Hania, agrees that ‘Anonymized data is not necessarily innocuous data’.

Clearly digital contact tracing requires consideration of multiple issues. In the European Union, Member States are approaching the challenge individually. The Netherlands, for example recently trialed 3 pilot apps but concluded that none reached the requisite privacy requirements. Anna Buchta, Senior Official at the European Data Protection Supervisor, notes that from one member state to another, there will likely be slightly different combinations of technological and non-technological solutions to COVID 19.

GDPR will not stand in the way of combating COVID 19 – European Data Protection Supervisor confirms.

But she points out that the GDPR regulations, in force across the EU since 2018, are in fact ‘quite flexible so should not stand in the way of combating COVID 19’. A European-wide contact-tracing app has been proposed, but its adoption by Member States is voluntary. Buchta stresses however that before such technology can be really useful, definite exit strategies will need to be agreed. Experts from both the US and the EU ultimately agree that technology will always remain only part of a co-ordinated response to COVID 19.