The effects of COVID-19 tracing applications on individual privacy

4th May 2020

Technology continues to play a critical role in maintaining control of the ongoing global coronavirus pandemic. The contact-tracing applications (apps) currently being rolled out across the world are easy to use and are able to provide fast data of who may have come into contact with someone infected with Covid-19. On the face of it, this seems a sensible and simple way for the public to help the government and health services in the containment of Covid-19. Critics, however, are worried the application of personal data may see a further increase of the surveillance state and that personal and location data would be too tempting for governments to use in other ways.


According to media reports, in the UK millions of people will soon be asked to track their movements to limit the spread of Covid-19. Contact-tracing is a method used to slow down the spread of infectious outbreaks by encouraging individuals known to be infected or who have come into close contact with an infected person to notify others who they themselves have been in close contact with. The primary aim is to encourage anyone informed that they have been in close contact with an infected person to self-isolate to prevent further viral spread. Whilst this can be achieved to some extent through communications with friends and family, the most proven and effective method for contact tracing is through location and contact tracking smartphone apps. In the UK contact-tracing ‘apps’ on smartphones have already been trialled at an RAF base in North Yorkshire and will also be trialled early May on The Isle of Wight.1


Contact-tracing apps are based on the principle that people’s smartphones will be able to log, using a Bluetooth signal, when two people are in close enough proximity for long enough that there is a risk of contagion. If one of the parties is then diagnosed with Covid-19, alerts will be sent to whomever they have been in contact with advising them to self-isolate. This technology is already being used in Hong Kong, Singapore, and Germany, 2 amongst others. However, academics advising the UK National Health Service (NHS)  estimate around 67% of the population would have to use the app to make it effective. The head of the German Public Health Institute’s reference lab on coronaviruses has stated that: “contact tracing on its own cannot stop a resurgence of the virus as half of the infection events happen before the person passing on the infection develops symptoms”.3


Initial concerns with the technology have been raised as phones can notice each other from up to 30m away without determining the actual distance, potentially giving false readings.4 Problems have also emerged with Apple smartphones that require the apps to be in continual use instead of just running in the background.5 Additionally, Apple smartphones must operate from iOS 13, which means that any device older than the iPhone 6s will be incompatible with the apps. This means that roughly 12% of smartphones in the UK and about 25% of smartphones globally are unlikely to function with the current contact-tracing apps. This seems to create somewhat of a digital divide with those able to afford newer Apple smartphones having access to these apps only.


In a bid to improve privacy and eliminate many privacy data concerns associated with contact-tracing apps; Google and Apple plan to remove the embedded contact-tracing features from their devices once the pandemic ends. However, both Apple and Google’s platforms have been described as decentralised as the contact match occurs on the users’ devices, preventing the authorities from accessing the data unless the user decides to disclose it. Although both companies have tightened up privacy measures, they are still waiting for the NHS to commit to the platforms to enable UK use of the apps. Meanwhile, France and Germany are pursuing designs of their own and are pressing Apple to have greater freedom with the iPhone’s capabilities. Nations do face problems if they go it alone as third-party apps use of Bluetooth is restricted by Apple and competes against other apps using Bluetooth on smartphones, meaning they may not be accurate.6


There are also growing concerns over who will have access to the data and how the data will be used after the pandemic is over. In Australia, the government is urging the public to use their contact-tracing app and publicising it as a way of being able to get back to normal life. 3.5 million users downloaded the app in the first five days of its release. The Australian Health Minister has said only health authorities would have access to data and “not even a court order” would allow other authorities, such as the police, access to this data.7 The Tony Blair Institute for Global Change has stated that increased state surveillance is a “price worth paying” in order to beat Covid-19, offering an “escape route” from the crisis. 8 However, the think tank has also suggested contact-tracing should be opt-in rather than compulsory, in order to preserve the trust of the British people, with a “digital credential” to notify who was immune from the disease and therefore safe to return to work.


Other technologies and methods are being used around the world. In Hong Kong people are being asked to wear wristbands that report their whereabouts to the government if they change location, in an effort to keep people restricted to their homes. China is using a colour based QR code to monitor people’s movements and health, which is mandatory.9 In South Korea, travellers who do not download a government app are refused entry. This has enabled the country to avoid extensive lockdown measures due to contact-tracing combined with mass testing. 10  India’s version of the app is already reported to have 75 million users but still a fraction of the 1.35 billion population. The app is not compulsory except for health workers as almost half the smartphones in circulation are the old 2G models. Indian digital rights organisations think the app does not adhere to “normal transparency and accountability”.


The level of personal data intrusion being developed into this new contact-tracing technology would have been unthinkable before the current Covid-19 pandemic. Human and data rights groups are concerned that emergency measures and moral inducement of the public will lead to data collection considered a breach of personal privacy only a few weeks ago.11 Phones that used a centralised model, unlike Apple and Google phones, will be at risk of data interference from governments willing to get around privacy-preserving protocols for the sake of ‘inferring’ statistics.12 In the US republicans are planning to introduce a privacy bill to regulate Covid-19 apps. However, this has been alleged to help protect US firms Apple and Google, with a privacy watchdog stating that this is “deregulation dressed up as consumer protection”.13


‘Mission creep’ seems to be the new term being used to describe the reason contact-tracing apps are being rolled out. There is an underlying fear that governments are normalising the use of surveillance-based technology in society during a crisis for a future without one. Even once this current pandemic is under control it may be that these apps are with us to stay and that we have either little choice since they are part of the ‘package’ or they just become an accepted part of everyday life.