While governments and health authorities around the globe work together to find ways to cope with the COVID-19 pandemic, they are keeping in mind the goal to protect lives and get society up and running normally. Governments and their public health authorities, as well as universities and NGOs, around the world, have been doing important work researching how to develop an opt-in contact-tracing technology. We are emphasizing the “opt-in” part for a reason: this means that no person will be traced nor will be driven to provide their own personal data or personal data of other persons, without their explicit consent. Hence, software developers have been giving their contribution by crafting technical tools to help combat the virus and save lives.
In this spirit of collaboration, Google and Apple are announcing a joint effort to enable the use of Bluetooth technology to help governments and health agencies reduce the spread of the virus.
On Friday, April 10, 2020, Apple and Google announced the launch of a new Bluetooth-based system for tracking the spread of coronavirus. So far, there has been no strong interest in voluntary participation in contact-tracing. This new system would use short-range Bluetooth communications to establish a voluntary contact-tracing network, keeping extensive data on phones that have been in close proximity to one another. In case you are now wondering “What data – personal data?”, the idea is that your phone logs any other phones which have been nearby, and personal data. Your phone periodically would blast out unique and (most importantly) anonymous pieces of code, derived from other phones’ unique ID’s, and then store those codes it received and time of receipt, building up a log. Official apps from public health authorities will get access to this data, and users who download them will be able to report if they have been diagnosed with COVID-19. In the end, it all the system amounts to alerting people who download the app if and when they were in close contact with an infected person.
Contact-tracing system which involves figuring out who an infected person has been in contact with, and trying to prevent them from infecting others, is the newest and one of the most promising solutions for containing the spread of the COVID-19 virus. Apple and Google plan to introduce a pair of iOS and Android application program interfaces (API’s) in mid-May, and after the API is complete, the companies will work on building tracing functionality into the underlying operating system, as an option immediately available to everyone with an iOS or Android phone, which is around three billion phones from all around the world. Specifically, this system will be built into official public health apps which will be built by public health authorities.
Privacy and effectiveness concerns
First of all, and unlike other methods of contact-tracing – for instance using the GPS data – this Bluetooth system is not meant to track people’s physical location. Tracking anyone’s physical location would, without a doubt, be a violation of their rights to protection of personal data as prescribed by the General Data Protection Regulation, widely known as GDPR. In order to comply with these terms, the system that Apple and Google are creating would pick up signals of nearby phones at 5-minute intervals and store connections between them in a database. Therefore, in case one person tests positive for the coronavirus, they could share that information with the application. This way, other users of the application whose phones were within close range of that of an infected user in the preceding days could be notified about having been in close proximity to an infected person. Otherwise, these applications are not meant to log any identification data nor location data, although health applications that use the system will need to know who you are if you are to share your diagnosis with the health officials. We should keep in mind that none of this will be possible if an insufficient number of uses decide to install any of the applications
The major question is whether any identification data is stored within the system. Well, the system takes a number of steps to prevent people from being identified, even after sharing their data. While the application regularly sends information out over Bluetooth, it broadcasts an anonymous key rather than a static identity, and these keys will cycle every 15 minutes to preserve privacy. Although one user may share that they have been infected, the application will only share keys from the specific period in which the contagion may have taken place.
It is a key feature of the design of the system that there is no centrally accessible list of which phones have “matched”, contagious or otherwise. That is because cryptographic calculations required to protect privacy are made within personal phones. As far as the system and application plans are concerned, we do not see any major red flags with regards to the rights enshrined within GDPR, however, it is left to be seen what will happen once the whole system is up and running.
Potential weaknesses
Contact-tracing is, in essence, a type of a medical surveillance system, which sounds a bit like something from a spy movie, but is actually not. Firstly, a user can choose whether to install the application and make use of the system and secondly, this system is the fastest way to find those infected by coronavirus.
Some of the challenges that this system may encounter is getting Android and Apple phones to communicate reliably since it is not easy to measure range with Bluetooth and one of the consequences of this would be that the results of “matches” would vary depending on the way a phone is oriented. Another problem is that it could “match” people in adjacent rooms who are not even sharing the same space with each other, making some users unnecessarily worried. It may also fail to capture the nuance of how long someone was exposed – someone could be working next to an infected person all day, for instance, and be exposed to a much greater viral load than just bypassing them by on the street, but both of these “matches” will potentially be treated the same. It also depends on people having applications in the short term and up-to-date smartphones in the long term, which could mean it is less effective in areas with lower connectivity. Moreover, if people in one community use a contact-tracing app, but others in a different community do not have the necessary devices, cannot get signal, or are afraid for their privacy, a situation may arise where the virus can more easily get a foothold in certain communities, further increasing existing inequalities and creating disparities.
This system probably cannot replace other old-fashioned methods of contact-tracing, such as interviewing infected people about where they have been and who they spent time with – however, on the other hand, it could offer a high-tech supplement through devices that billions of people already own.
The truth is that, based on the public comments which have been circling through social networks, people are inclined to trust these systems primarily in case they protect their privacy, remain at a voluntary level, and store data on person’s device, and not in a centralized network data storage.
If you have any additional questions or concerns you can contact us at covid19@geciclaw.com.
