AS COVID-19 APPEARS to have reached its peak in many countries across the EU, governments are now examining ways in which current restrictions can be lifted without risking a second wave of infections.
In its ‘roadmap’ for a pan-European exit strategy, the European Commission made a series of recommendations to the 27 EU member governments in advance of lifting current restrictions. One recommendation is that countries should have “appropriate monitoring capacity” before easing restrictions, which includes the potential use of mobile digital applications for contact tracing.
Such an app will require access to citizens’ personal data, a feature that requires close scrutiny to ensure that it aligns with the EU’s strict approach to data privacy, which is the cornerstone of the EU’s Digital Strategy.
How would a contact tracing app work?
Last month, in an unprecedented move, Apple and Google, whose operating systems are present in over 3.5 billion devices worldwide, announced that they are joining forces to assist contact tracing technology efforts. The exact measures taken resulted in Google and Apple aligning their Bluetooth technology, which enables devices to communicate over a short distance.
The Economist reports that apps using Bluetooth technology will work by releasing anonymous individual identifiers by way of a unique code from a device, that can then be picked up by other devices within Bluetooth range that have the app installed. Each app will have the capability to retain all the codes it will have come in contact with. In the event a person with the app installed is diagnosed with Covid-19, their code can be used to identify any contacts they may have had with those who also have the app downloaded.
Advocates of data privacy favour the use of Bluetooth technology as it provides users with an increased level of anonymity compared to apps that use GPS technology, as this model allows for data to be stored in a ‘decentralised’ manner by an individual on their phone.
The alternative to a decentralised model is one where data is stored in a centralised database controlled by a health service or national government. Although 7 in 10 contact tracing apps in operation today are run in a centralised manner, over 300 experts in the UK expressed their concern over the large-scale collection of citizens’ data in this manner claiming that this could expose data to potential misuse in the future.
Looking at other countries, like Iceland and Singapore where contact tracing apps are operational, the apps are not producing the results that are required. For a contact tracing app to be effective, scientific experts estimate that 60% of a population must download it. However, as sign-up to these apps is voluntary, the uptake has not quite been where it needs to be. For example, uptake in Iceland and Singapore is only at 40% and 20% of the population, respectively.
Considering that sign-up to contact tracing apps being built in the EU, including the app under construction by Ireland’s HSE, will be voluntary, similar problems could arise. If the EU considers contact tracing apps essential part of an exit strategy, it is critical that any contact tracing app developed gains the trust of citizens to ensure sufficient take up.
Applying contact tracing EU-wide will be challenging
The EU seems acutely aware of the importance of gaining the public’s trust regarding the protection of personal data. While this approach has not been without its critics (BBC), recent technologyh policy like the introduction of The General Data Protection Regulation (GDPR) in 2018, described by Politico as ‘the world’s toughest privacy law’ – reflects the seriousness the EU places on the issue of data privacy.
However, critics argue that the creation of apps that have access to citizen’s movements is in direct conflict with the data privacy regulation long favoured by the EU. In a recent interview with the Economist, the Executive Vice President of the European Commission for A Europe Fit for the Digital Age (Competition), Margrethe Vestager was challenged on this matter, with the interviewer arguing that regardless of precautions, an app that collects data from a large amount of devices will infringe on people’s right to privacy. Vestager replied that the antidote to such worries is maximum transparency in the creation and roll out of the app, meaning that citizens are informed about exactly who is collecting what elements of their data, what is then being used for and for how long it is being stored.
There is an added challenge to the EU’s approach, as many Member States have opted to explore this concept on a national basis, instead of engaging in an EU– wide coordinated approach. As travel restrictions within the EU are not a long-term prospect, governments must work across borders to ensure interoperability between apps across the EU and in neighbouring countries. This may prove difficult as there is a clear difference of approach among countries with Germany, Italy and Ireland among the countries whose apps will run on a decentralised basis, whereas contact tracing apps in France are set to store data in a centralised location.
This has been met with opposition in the French parliament with critics and opposition MPs stating that people are uncomfortable with the idea, as it could instigate an erosion of people’s civil liberties were it to become widespread. Furthermore, – and perhaps a point that should be given more consideration in the EU’s Digital Strategy – in France alone, a quarter of the population don’t own smartphones that can download apps.
Reflecting on the current status of contact tracing apps within the EU it is apparent that there is no easy solution. Given the strong opposition regarding the protection of civil liberties and data privacy, as well as the practical challenges that lie in the face of the creation of such an app, it is clear that Covid-19 contact tracing apps may test the robustness of the EU’s Digital Strategy. Like many other aspects of the Covid-19 recovery plan, cooperation between EU Member States is imperative to its success.