I. Introduction
From the early days of the COVID-19 pandemic, technology companies have participated in the search for solutions to new challenges. One of these has been the need for public health authorities to engage in contact-tracing to help curb the spread of the disease. Manual contact-tracing for public health purposes is a well-established component of the management of epidemics and pandemics. Public health authorities identify infected individuals, question them about close contacts, and then reach out to those contacts with the appropriate public health advice. From the outset of the pandemic, many believed that technology could play a role in supplementing manual contact-tracing. How it could do so quickly became tied to issues of how it should do so, engendering a normative discussion affecting the partnership between business and government in the large-scale design and deployment of technology for public health surveillance.
This piece explores the role of the private sector in the development of contact-tracing or exposure notification (CT/EN) apps. The use of technology to track and trace the spread of disease across the population created an interesting tension between technological capability and human rights. In many instances potential app features and functionality were ultimately discarded in favour of less sophisticated but more privacy-friendly apps. The narrative is one of quick response to rapid changes in needs, circumstances and politics. The most challenging issues were privacy and trust, and these considerations affected app design and government choices. It also led to the normative engagement of technology companies in ways that will merit further study.
II. Tracking and Tracing
The private sector already has considerable capacity to track and trace individuals. Unsurprisingly, some early contact-tracing efforts of governments used these pre-existing data.Footnote 1 For example, early in the pandemic, Israel used cell phone location data to trace the movements of those diagnosed with COVID-19 infections.Footnote 2 Public health authorities in British Columbia were reported to have contemplated using payment and loyalty card data to assist contact-tracing efforts.Footnote 3
Although existing private-sector data could be leveraged by governments for contact-tracing, such methods raise significant privacy issues. Israel’s early use of location data led to a constitutional challenge to this level of surveillance, and the eventual suspension of this approach.Footnote 4 Relying on existing private sector data is not a user-centric approach. Someone whose data is accessed by the state is not a voluntary participant in either the tracking/tracing process or in post-notification decision-making. With a user-centric approach, the individual chooses to participate and remains engaged at every stage, ensuring the autonomy and dignity so central to privacy.
III. Contact Tracing and Exposure-Notification Apps
As the scale of the COVID-19 pandemic became evident, interest grew in the development of purpose-specific technologies that could assist in contact-tracing. Weaknesses in manual contact-tracing systems included under-resourced public health agencies, imperfect recollection by individuals of their movements and contacts, and the challenges of identifying contacts in more anonymous public settings. Officials were also concerned about the ability to conduct manual contact-tracing quickly enough as community infections rose.Footnote 5 Nevertheless, adoption of contact-tracing technologies by governments generated many privacy and ethical concerns.Footnote 6 Contact-tracing technologies also raised the spectre of governments requiring citizens to engage in self-tracking and reporting of movements and/or contacts prior to any infection.
One of the earliest purpose-specific contact-tracing technologies was Singapore’s TraceTogether App, developed by Singapore’s Government Technology Agency, and launched on 20 March 2020.Footnote 7 TraceTogether eschewed the use of more controversial location data in favour of contact data based on Bluetooth signals. On 10 April 2020, technology giants Google and Apple announced their Google Apple Exposure Notification (GAEN) system.Footnote 8 This system – which also relied on Bluetooth – was built in consultation with privacy experts, and offered a high level of privacy protection. Not an app itself, the GAEN works at the operating system level, and creates a base on which governments can build their own exposure notification apps for both iOS and Android smartphones.
A major difference between apps such as TraceTogether and GAEN-based appsFootnote 9 relates to whether contact data are stored centrally (accessible to government) or in a decentralized way (local storage on a user’s device).Footnote 10 Privacy advocates raised concerns that government access to contact information through centralized storage was unduly intrusive, particularly if the use of such an app might become mandatory.Footnote 11 Decentralized data storage ensures that governments cannot access contact details. A user of a GAEN-based app who tests positive for COVID-19 is given a unique code by public health authorities. The user enters that code in the app, which generates exposure notifications for contacts recorded on their phone. No contact information is shared with authorities. It is up to those receiving notifications to self-isolate or seek testing. Such apps are less useful from a public health perspective because they do not permit direct public health follow-ups, nor do they provide public health authorities with contact data that could also be used for disease modelling. The trade-off is increased user trust through reduced privacy risk.
The particular concerns with contact-tracing technologies in the hands of government created interesting design choices for developers. There were many ways that available technologies could be used to harvest data useful to track movements and trace contacts. Additional functionality could be integrated to collect supplementary data useful for research and modelling such as demographic and symptom information. Yet what was technologically possible from a public health perspective had to be balanced against trust, privacy and human rights considerations which favoured less data collection and decentralized data storage.
IV. The Normative Dimensions of the GAEN
The GAEN was developed by two technology giants whose operating systems dominate the smartphone market. It was expressly designed to enhance user privacy.Footnote 12 Because of this, Google and Apple quickly dropped the term ‘contact-tracing’ in favour of ‘exposure notification’. They emphasized that the app notified users of possible exposure to people infected with COVID-19, rather than enabling the tracing of contacts. Many features of the app – from decentralized data storage, to the deletion of contact information after 14 days – were considered privacy-enhancing.
The GAEN system facilitated the deployment of exposure notification apps. Yet adoption of this system required governments to use a decentralized approach. Decentralized data storage is both a technological and a normative choice, as it favours the protection of privacy over the needs of public health authorities to access data that might be useful in understanding the disease and its spread. Some governments explicitly rejected GAEN because it could not provide sufficient useful data.Footnote 13
Other features of the GAEN system are also normative in nature. For example, apps built on the GAEN must be voluntary – user consent is required to activate them and users must be able to uninstall the app.Footnote 14 GAEN apps are not permitted to supplement their data with location or other data from a user’s phone.Footnote 15 Apps built upon the system will cease to function once Google and Apple have determined, on a regional basis, that they are no longer needed.Footnote 16
A technological feature of the GAEN system with an indirect normative impact is the fact that contact-tracing apps not built upon GAEN have experienced serious difficulties operating on Apple’s iOS platform.Footnote 17 These difficulties have been cited as one of the reasons why the UK abandoned its first attempt at a contact-tracing app, and pivoted to the development of an app based on the GAEN.Footnote 18 They have been a source of difficulty with TraceTogether and with Australia’s app as well.Footnote 19 Thus, effectively the GAEN makes it more difficult for governments to adopt contact-tracing apps not built upon GAEN.
These normative dimensions of the GAEN are significant. Although the solution greatly facilitated the rapid design of apps that could operate effectively on the major smartphone operating systems, it also effectively limited choices that governments could make about features and functionality. The normative approach, encoded by US-based technology giants, had a global effect, which also raises interesting business and human rights issues. The balancing of privacy and human rights considerations with the public interest during a public health emergency is closely entangled with social and cultural norms that vary from one country to another. The encoding of one set of norms within a base technology raises questions of cultural absolutism.
V. Additional App Functionality and Metrics
The global push for CT/EN apps created interesting economic opportunities for developers, and some governments were influenced by these in their choice of app. Choosing a local company would mean that pandemic funding supported local industry. This also fed into other government plans to support high-tech innovation. Some companies saw pandemic contact-tracing as an opportunity to innovate in partnership with government. Great Britain’s first (failed) app is one example of such a partnership;Footnote 20 France also pursued its own solution.Footnote 21 Indeed, countries such as Great Britain, Germany and France – each with strong ambitions for their high-tech innovation sectors – at least initially opted for unique in-house solutions, although both Great Britain and Germany ultimately switched to GAEN-based apps.
Instead of the highly privacy-preserving GAEN approach, some developers pitched more complex apps with additional functionality, including the possibility for users to provide other data via questionnaires (e.g., symptom tracking).Footnote 22 Mila’s COVI appFootnote 23 proposed the collection of additional data combined with the use of artificial intelligence (AI) to help understand the spread of the virus. The ambition of this app may have defeated its uptake; lack of trust in government made it challenging to propose the adoption of apps that collected additional data and used AI.Footnote 24 Nevertheless, the app was seriously considered by the Quebec and Canadian governments, both of which had an interest in supporting high-tech innovation, including the burgeoning AI sector. The relationship between government apps and innovation agendas is interesting as considerations for app adoption were not necessarily limited to concerns over issues such as privacy and public health. Effective design of a CT/EN app could be a boon for a company. For example, the successful roll-out of Ireland’s contact-tracing app, created by an Irish company, has led to that company securing contracts to develop apps in other jurisdictions.Footnote 25
Given the public resources sunk into the development and adoption of CT/EN apps, an evaluation of their effectiveness is important.Footnote 26 While the private sector has a tendency to collect a great deal of data via its apps, the trend in CT/EN apps was towards minimal data collection, making evaluation challenging. Download data from app stores does not provide a regional picture of adoption, nor does it reveal whether apps are activated or uninstalled. Useful metrics in a decentralized model would include knowing how often users input positive test results, how many notifications are sent, and whether those receiving notifications get tested. In order to assess the reliability of the apps’ proximity measurements, it would also be useful to know what percentage of those receiving notifications test positive for COVID-19.Footnote 27 Some early evaluations of CT/EN apps have relied upon simulations to assess effectiveness of the apps.Footnote 28 Additional data collected by some apps built on the GAEN system (e.g., UK, Ireland) can help assess their functionality.Footnote 29 A UK study released in early February 2021, and based partly on projections, reported that the use of the app was highly effective.Footnote 30 An early assessment of Australia’s COVIDSafe app – for which centralized data were available – showed less remarkable results.Footnote 31
VI. Beyond Government Contact-Tracing
Although government-led contact-tracing solutions have garnered the most attention in fighting the COVID-19 pandemic, employers have also sought technology-based solutions to address the spread of COVID-19 at work.Footnote 32
Some employers have considered using government contact-tracing apps within the workplace by requiring employees to download and use the apps while at work.Footnote 33 Others have leveraged existing workplace technology – such as surveillance cameras or keyless entry systems – to aid with tracking and tracing. Still other employers have sought COVID-19-specific technology solutions from a broad range of private sector companies. Such solutions can include mobile apps, Bluetooth-enabled wearables,Footnote 34 workplace mapping tools,Footnote 35 or devices that alert employees if they are too close to one another.Footnote 36
The private sector workplace presents very different privacy and trust issues than government adoption of contact-tracing apps. In a workplace context, employers have obligations to protect worker health and safety, and these obligations may justify the use of some form of contact-tracing.Footnote 37 Workers may also have fewer objections to the use of such technologies within their workplaces if it can help protect them from the spread of illness, keep workplaces open, and limit loss of work hours. Furthermore, the tracking and tracing occurs in a place where the worker is already known to be – and it records contacts only among co-workers, rather than friends, family or private associates. While the privacy issues in these contexts are real, and should not be minimized, they are different. The workplace is emerging as a prime location for the deployment of such technologies.
VII. Conclusion
In just over a year since the onset of the global pandemic, data and technology have been used by governments in attempts to control the spread of disease. Early efforts shifted quickly from leveraging existing private sector data to developing purpose-specific CT/EN technologies. App development was shaped by concerns over privacy, ethics, and a lack of trust in government.
CT/EN apps are both a public health tool and an element of technological innovation. Their use has become widespread in spite of challenges in evaluating their performance. This broad deployment indicates the speed and agility of the technology sector in adapting and responding to new challenges, and the openness of governments to embracing technological solutions to large-scale problems. The debates over core functionality of such apps revealed the importance of privacy and human rights considerations in the adoption of technology of this kind and on this scale.
Pandemic contact-tracing concerns are not limited to population-level public health measures. Public and private sector employers have actively sought means of tracking and controlling disease outbreaks in their workplaces. This too has spurred technological innovation that has attracted considerably less public attention and that raises a different set of privacy and ethical concerns – ones that may outlast the pandemic.
Only a year from the initial adoption of such technologies, perhaps the most interesting feature has been the normative principles embedded within the GAEN system, and the challenges experienced by governments that have sought to adopt non-GAEN solutions to meet their CT/EN needs. As the lines continue to blur between public and private sectors on digital and data governance issues, this development and its implications for human rights deserve further consideration.
