Covid19 tracing apps: How can Europe improve emergency management?

But what will citizens tolerate of their own government? How willing will travellers be in adopting local tracking apps once travel abroad begins to pick up? How much privacy are people willing to sacrifice?

These were just some of the questions addressed during our latest FIPRA talk, with interventions from FIPRA Chairman, Robert Madelin, in conversation with guest speaker Visiting Research Fellow at the Oxford Internet Institute ex-Commissioner for Security, Sir Julian King.

The discussion, moderated by Jacki Davis, navigated privacy, trust and the balance between privacy and health. Joined by Thaima Samman, Head of FIPRA’s Digital Practice and Founding of FIPRA’s partner in France, as well as Detlef Eckert, Digital Special Advisor, it was discussed that, amidst the mayhem of COVID19, this pandemic presents an opportunity to accelerate and deepen learnings as to what helps society get the most out of digital technologies and what works best in digital innovation.
The discussion took place under the Chatham House rule.

Tracing apps: unique to the pandemic or an extension of the ongoing debate on new technologies?

The discussion on tracing apps hoped that the pandemic experience would offer broad lessons: on how we relate to new technology, on how it is used in managing challenges and on how some intensely personal issues like health are dealt with. Ultimately, the discussion boils down to the kind of society people would like to live in. The issues arising from tracing apps are not only about privacy; they also concern transparency and accountability of technology. These questions need to be answered in order to build an ecosystem of trust in technology, where we can use tech quite confidently. Transparency and benefit of the tracing apps are the two pillars of trust: technology has to be transparent so that it can be trusted and, there must be benefits – the threshold for society to accept a new technology should be higher than just “do no harm”.

Building trust

On various issues wider around trust, proportionality, necessity as well as apps being ‘purpose-limited’ and ‘technologically-sound’ are deemed as core issues. Other noteworthy issues include how willing people will be to use tracing apps and what purposes those tracing apps serve (contacts with infection, social distancing, overall mapping of patterns of infection…). It is of vital importance to answer these questions in order for citizens to engage with those tracing apps and, more broadly, new technologies that touch upon them.

It was noted that there are competing models tracing apps are deploying in terms of their architecture and governance: different models have different merits. Two important points were raised with regard to what is voluntary. In cases where restraints, state-driven or private, are imposed as regards leisure, travel or work, are imposed on a person who does not agree to use such apps, it is questionable as to whether this is truly voluntary.  Studies have shown that, in order to make tracing apps effective and useful, 50% uptake of citizens, in Europe meaning up to 80% of smart phone users, are needed to feed the apps with necessary data. In fact, it is rather difficult to get that level of engagement (note – similar high levels of participation are needed for vaccination alone to create herd immunity!).

The role of the EU in tracing apps

It was discussed that using good architecture – wherever it comes from (global tech giants, or startups or research consortia) will be a pro-competitive approach, as long as no concession is made on allowing unregulated access to data. The key role of government is to ensure any apps to be used are fit for purpose while the second role is to ensure the apps are privacy compliant.

Whilst the conversation focused heavily on privacy, there was also strong recognition of the  importance of balancing privacy concerns with the benefits (both health and economic) of such tracing apps. Carefully designed tracing apps can help  to relaunch tourism after the pandemic and by reaching bilateral or multilateral agreements to recognise a standard set of apps, tracing apps can allow people to resume international travel.

It was discussed that, internationally, global governance principles need to be developed on commonly recognised tracing apps. As global travel recommences, EU citizens will need ideally to know that the apps they use at home will be recognised abroad, and that they will not be required to upload to their devices a third country app whose effectiveness and privacy status they cannot know.

The WHO, it was said, could be the right forum to develop and host such multilateral agreements, since they can be in part the digital equivalent of vaccination regimes for diseases such as Yellow Fever, and they would sit well in the framework provided by the International Health Regulations.

It was stated that it is natural that national authorities are playing a leading role as health issue is close to national competence. But in Europe, there is a need for better and closer coordination, at least at the regional level. This is what the Commission is trying to achieve by publishing guidelines to build up shared confidence on some apps. Member States would do well to follow these collective guidelines, to maintain a EU critical mass of comparable regulation. In the context of COVID-19 pandemic, tracing apps are best deployed in compliance with the principle of privacy by design, with a strict time limit and with data access and use that are bothproportionate to the purpose of combating COVID-19.

The feasibility of such an approach at international level is, however, questionable due to the lack of common values around the globe. It is a difficult balance between privacy and what a government feels that it needs to know in order to combat the pandemic. Both privacy and public health are identified as our civil liberties, but it should be borne in mind that each civil liberty can be offset in the pursuit of other civil liberties.

Authorisation of tracing apps and cybersecurity

In the discussion it was deemed necessary to have some form of approval, which is in fact what was also spelt out in the Commission’s exit roadmap. The remaining question is how to spread this approach more internationally. There are very different preferences, as yet unresolved, between centralised and de-centralised models, for data hosting, for governance and in terms of cybersecurity. No matter what model is chosen, it is necessary to keep a high cybersecurity standard. It would only take a few cases of personal health information being leaked to lose people’s trust.

International cooperation

It was stated that there are two angles in this aspect. First, internal health regulations are being rediscovered and a WHO approved COVID-19 contact tracing book might be necessary. Second, COVID-19 may provide a great opportunity for international cooperation in order to maintain certain level of open global value chain but there is no guarantee on any political appetite for such international cooperation due to lack of trust of major international players. With regards to regional cooperation in Europe, it was stated that the Commission’s exit roadmap to deal with the pandemic in a transparent and coordinate in a regional level is the right way. If European cooperation on managing tracing apps turned out to be positive, it may offer a model for other countries to follow and opt-in to. It was warned, however, that if the European debate on tracing apps was perceived too privacy focused, it may put bring the entire project to a stop.

Conclusion

It is important to reflect on how Europe can be more united and executive in emergency management, especially in light of the possible upcoming second wave. The public has to break out tech silence to turn the debate on tracing apps into a wider public debate and political debate to build trust. One issue that remains to be solved in the future is how different actors around the tracing apps, the public authority and big technology industry player in particular, can work together to deliver satisfactory accountability.