Privacy and health: COVID-19 tracking apps

By Katharine Kemp, UNSW

The Australian government has announced it is working on a mobile app to monitor our movements and contacts during the coronavirus pandemic. This follows numerous moves overseas to track individuals in the fight against COVID-19. The Australian app could be available in as little as two weeks.

The aim of these apps is to alert users to the fact they have been in close contact with someone who is subsequently diagnosed with COVID-19. However, important choices need to be made about how this is done.

One option is to use location information – a log of where we go, or at least where our mobile phone goes – but this can be highly personal. It can reveal whether we see a psychologist, attend a certain mosque or church, spend all afternoon in a pub or join a political rally. 

There are better options, and the government will need to improve its approach to privacy protections if it wants a large proportion of Australians to put their trust in this tracking app.

This will require a clear and accurate privacy policy; strict limits on the data collected and the purposes for which it can be used; strict limits on data sharing; and clear rules about when the data will be deleted. The government should fix the confusing and open-ended privacy policies of its current Coronavirus App while it’s about it. 

What tracking is the government planning?

The proposed mobile phone app is intended to allow the government to relax some of the current coronavirus restrictions, while permitting it to rapidly and accurately determine who should be alerted to self-isolate whenever a new COVID-19 case is identified.

The government has not confirmed how individual locations would be tracked, but it seems quite likely it is considering Bluetooth technology since it has been in touch with the Singaporean government about its TraceTogether COVID tracking app which uses Bluetooth. 

The app would be offered on an ‘opt in’ basis, so that only Australians who choose to download the app would be part of the scheme. To be effective, at least 40 per cent of Australians would need to download the app.

It is therefore critical the app does all that is reasonable to protect our privacy.

It’s not a question of privacy or health

Some commentators have recently presented potential contact tracking methods as a question of ‘privacy or health’. We can protect our privacy and suffer the full force of the pandemic or give up our privacy for the sake of the nation’s health. 

But it’s not a zero-sum game when it comes to privacy and health. There is plenty we can do to respect privacy and still enable contact tracking for new coronavirus cases. More importantly, it will be vital to protect privacy in order to persuade at least 40 per cent of Australians to sign up. 

As a number of experts in Australia and Europe have pointed out, ideally, these tracking apps should be decentralised. That means all relevant contacts would be registered in encrypted form on our phones and we would receive a notice if someone we had been in close enough contact with for a sufficient period tested positive for COVID-19.

With a decentralised system, neither we nor the government could know the identity of the relevant person, but our phone would recognise the person’s encrypted identity as a contact in a list of new cases broadcast by the system. We would then be alerted if we needed to self-isolate as a result of our contact.

In a centralised system like Singapore’s, we would not know the identity of the relevant person nor they ours, but the government would have the capacity to know both our identities, as would a malevolent actor accessing the government’s system.

Aside from the matter of decentralisation, privacy by design principles are vital, including:

• strict limitations on the data collected and who can access it
• strict limitations on the pandemic-fighting purposes for which the data can be used
• clear notice about when the data will be deleted, which should, for the most part, be when the user chooses (such as by deleting the app) or at latest when the current crisis ends
• a clear and accurate privacy policy.

The government has not done well on these last three points with its current Coronavirus App.

Continue Reading…