he exponential spread of COVID-19 has prompted the creation of contact-tracking and contact-tracing apps to help rapidly identify potential infections and curb the disease’s spread. Digital contact-tracking and tracing is preferred over manual methods due to the ineffectiveness of the latter and due to recent insights, such as a study showing that infectiousness begins four days before the onset of symptoms.
However, the exorbitant cost of developing and operating these apps has grabbed the limelight. For instance, in Germany, the app development cost was a whopping €20 million (around $23 million) and the monthly operating costs are estimated to be around €3 million. The crucial facet of the interoperability of these apps has received little attention, in turn leading to major gaps after reopening borders post partial lock-downs. As recently as June, interoperability between national COVID-19 apps was discussed intensively with open outcomes on time horizon, implementability, and costs (see Switzerland, Germany, Italy, France).
Amid such regulatory initiatives and technological innovations, however, a landmark ruling by the Court of Justice of the European Union (CJEU) has firmly brought the fundamental rights of privacy and personal data protection into focus. There are concerns that many of these apps do not have privacy policies and/or ‘publicly stated anonymity measures’ though it is important that they ensure anonymity, privacy, and data security.
The CJEU judgement on July 16 effectively invalidated a pact enabling transfer of EU citizens’ data to the U.S. The agreement, called the EU-U.S. Privacy Shield, was challenged by the Austrian privacy activist and lawyer Maximillian Schrems on the grounds that U.S. laws do not adequately protect EU citizens’ data from being accessed by U.S. authorities as part of that country’s national security-related monitoring programs. According to the CJEU, U.S. surveillance programs are regarded as having primacy over such an agreement in the interests of U.S. national security, public interest, and law enforcement—which could allow for interference in the fundamental rights of EU citizens. The CJEU said that protection of EU citizens’ data is not guaranteed “in a way that satisfies requirements that are essentially equivalent to those required, under EU law.”
This ruling would not only directly affect data flows from the EU to the U.S., but could also have implications for cross-border data flows across the world as concerned stakeholders raise alarms over how data privacy is protected by other governments. This, in turn, complicates relevant privacy and data protection regulations including those governing digital contact tracing and tracking apps.
Following the CJEU ruling, there has been a move to ensure “data independence” for EU-U.S. data flows, as well as retrieving and transferring EU citizens’ personal data that was stored in the U.S. back to Europe, or to a third country where data is protected adequately.
Given the interconnected and interdependent nature of the world today, the likelihood of pandemics that can be caused by viruses is going to be a long-lasting threat. This prospect, combined with the surge in digitalization of economies as well as increasing smartphone use, would mean that there would be a governmental-level push towards developing a digital contact-tracking and tracing app ecosystem and the related regulatory structure to tackle such situations. Fueling this trend is concerns over the sluggish pace of manual tracing failing to keep up with the surge in the spread of the disease. In addition, ground reality shows that the vaccination route to eliminating the disease is expected to be a long-winding one.
Ideally, such a situation should have made it easy to get everyone to use contact tracing and tracking apps. There are, however, ample challenges due to: the level of effectiveness of these apps (in terms of their ability to correctly alert the users—who are healthy—when they come in close contact with another user infected by the virus); technical problems related to the functioning of the apps; as well as the general disinclination to install these apps on smartphones owing to concerns over inadequate privacy and data protection as well as on account of complacency following a fall in the number of cases.
The digital contact tracing solutions so far are mainly driven by national initiatives that unfortunately do not address the global nature of the challenge posed by the pandemic. The world is now divided into countries where contact tracing is either comprehensive or limited in use and where there is no such activity. This disparate scenario calls for ways to ensure global interoperability of these apps in a manner that improves their operational efficiency. Interoperability can help strengthen the global economy by not only making it easier for people to re-engage in international business operations but also by boosting tourism.
The pandemic has shown that the existing regulatory system had not properly envisaged ways to effectively handle the post-lockdown phase. It would be important for the regulators to note that in order to open regional and national borders and simultaneously manage the risk of larger outbreaks in case of a shortage of vaccine, they will have to enforce interoperability of existing contact tracing applications or find ways to complement them. Private companies and governments need to collaborate now with intensity to increase their efforts to minimize the negative consequences of the disease on lives and the quality of living—not only for the current but also for future pandemics.
Data privacy, security, and even sovereignty concerns are legitimate and must be honored in the process of implementing interoperability. There is already criticism of commercial exploitation of personal data by companies to garner huge profits, a phenomenon also being described as surveillance capitalism. In addition, there are concerns over the possibilities of repurposing of contact tracing and keeping it in force even after the pandemic is over. It is, therefore, important to find the right balance between such concerns and the greater public good—both at the national and global levels. This can be done by ensuring that tracing and tracking technologies not only help control the spread of infections but also result in quick return to life without the mobility restrictions that have been in place since the pandemic outbreak.
International level regulatory dialogues are important to ensure that interoperability is among the good regulatory practices that promote market openness. Greater interoperability will benefit consumers (lower information costs and prices) and policymakers (helping them address challenges such as cyberattacks). However, striking the right balance is crucial because mandating “uniform technical standards and interfaces” just for the sake of interoperability could thwart the efforts of firms from bringing out innovative products.
At the same time, it is vital to consider the time constraints during a pandemic such as COVID-19. The benefits on account of greater interoperability in the back end as well as aligned data content and privacy standards outweigh the potential innovation limitations.
However, innovation should be promoted in the frontend to foster high adoption rates. The complexities of the situation warrant the need to hold discussions with all stakeholders, including the private sector. Such an approach can ensure that global interoperability is achieved organically (without coercion) in a transparent and non-discriminatory manner, which not only facilitates trade, helps in “greater sharing of the benefits of digital trade,” and promotes innovation and global growth, but also protects privacy, security and consumer interests.
Current contact tracing initiatives, however, could encounter several interoperability hurdles as they attempt to work in alignment with several existing frameworks. To address this issue, we propose a five-level customer centric contact tracing framework to ex-ante avoid global interoperability issues or help to heal them after they materialize.
Since the purpose of digital contact tracing is to serve the entire humanity, it must be inclusive, easy to use, and cost-efficient in order to enable its adoption on a large scale. Here it is vital to note that digital contact tracing will improve only if these apps are made interoperable and are used by a majority of the population. Most national contact tracing approaches might fail if they do not offer relevant incentives to boost their adoption as well as promote interoperability nationally and globally. In this regard, it is important for governments to address the digital divide by facilitating the development of digital infrastructure, including high-speed digital connectivity even in remote regions, and inclusion. As an alternative solution, governments could take steps to promote additional digital devices (such as Excalibur) or wearables (preferably globally interoperable) that support monitoring young children and the elderly, who generally do not use smart phones, as well as address situations handicapped by the unavailability or exclusion of smart phones (e.g. production lines, hospitals, slaughterhouses).
What will be crucial to achieve global interoperability is ensuring that the shared benefits from it outweigh the costs incurred in achieving it.
The costs of the lock-down accumulate to USD $1.4 trillion on the financial market and USD $6 trillion globally until April 2020. Recent estimates suggest an impact of USD $1.2-3.3 trillion on the tourism sector alone. That implies the promised value of a worldwide interoperable contact tracing would be worth the effort, as the benefits stemming from such an exercise would exceed the costs.
The benefits are that: it can lead to faster and more focused local lockdowns and speedier recovery of economies—as it can ensure that lesser number of people are infected and fewer need to be quarantined; and, it can lead to quicker and more controlled opening of international transport—as it will make it easy to track down the infected people and super-spreaders as well as those who do not comply with the reasonable restrictions in place for safeguarding public health—in turn, bringing down the overall economic damage.
What is required now is a stronger collaboration between governments and companies to bring out more incentives to ensure widespread adoption of a variety of interoperable digital contact tracing options. Only such an approach would lead to equitable distribution of benefits on account of a trustworthy infrastructure and data shared by the users across the world.
Lack of cooperation and collaboration will lead to more infections, loss of lives, and prolonged lockdown. A look at the history of pandemics helps us understand that COVID-19 will not be the last one and that a vaccine for the disease would not be a panacea. With lives, freedom of movement, and economic growth at stake, it is important to turn to data-secure and privacy-respecting digital contact-tracing and tracking solutions and a globally accepted interoperability mechanism.
a global affairs media network
Digital Contact Tracing Interoperability: Balancing Privacy and Public Health Concerns to Fight COVID-19
September 25, 2020
T
he exponential spread of COVID-19 has prompted the creation of contact-tracking and contact-tracing apps to help rapidly identify potential infections and curb the disease’s spread. Digital contact-tracking and tracing is preferred over manual methods due to the ineffectiveness of the latter and due to recent insights, such as a study showing that infectiousness begins four days before the onset of symptoms.
However, the exorbitant cost of developing and operating these apps has grabbed the limelight. For instance, in Germany, the app development cost was a whopping €20 million (around $23 million) and the monthly operating costs are estimated to be around €3 million. The crucial facet of the interoperability of these apps has received little attention, in turn leading to major gaps after reopening borders post partial lock-downs. As recently as June, interoperability between national COVID-19 apps was discussed intensively with open outcomes on time horizon, implementability, and costs (see Switzerland, Germany, Italy, France).
Amid such regulatory initiatives and technological innovations, however, a landmark ruling by the Court of Justice of the European Union (CJEU) has firmly brought the fundamental rights of privacy and personal data protection into focus. There are concerns that many of these apps do not have privacy policies and/or ‘publicly stated anonymity measures’ though it is important that they ensure anonymity, privacy, and data security.
The CJEU judgement on July 16 effectively invalidated a pact enabling transfer of EU citizens’ data to the U.S. The agreement, called the EU-U.S. Privacy Shield, was challenged by the Austrian privacy activist and lawyer Maximillian Schrems on the grounds that U.S. laws do not adequately protect EU citizens’ data from being accessed by U.S. authorities as part of that country’s national security-related monitoring programs. According to the CJEU, U.S. surveillance programs are regarded as having primacy over such an agreement in the interests of U.S. national security, public interest, and law enforcement—which could allow for interference in the fundamental rights of EU citizens. The CJEU said that protection of EU citizens’ data is not guaranteed “in a way that satisfies requirements that are essentially equivalent to those required, under EU law.”
This ruling would not only directly affect data flows from the EU to the U.S., but could also have implications for cross-border data flows across the world as concerned stakeholders raise alarms over how data privacy is protected by other governments. This, in turn, complicates relevant privacy and data protection regulations including those governing digital contact tracing and tracking apps.
Following the CJEU ruling, there has been a move to ensure “data independence” for EU-U.S. data flows, as well as retrieving and transferring EU citizens’ personal data that was stored in the U.S. back to Europe, or to a third country where data is protected adequately.
Given the interconnected and interdependent nature of the world today, the likelihood of pandemics that can be caused by viruses is going to be a long-lasting threat. This prospect, combined with the surge in digitalization of economies as well as increasing smartphone use, would mean that there would be a governmental-level push towards developing a digital contact-tracking and tracing app ecosystem and the related regulatory structure to tackle such situations. Fueling this trend is concerns over the sluggish pace of manual tracing failing to keep up with the surge in the spread of the disease. In addition, ground reality shows that the vaccination route to eliminating the disease is expected to be a long-winding one.
Ideally, such a situation should have made it easy to get everyone to use contact tracing and tracking apps. There are, however, ample challenges due to: the level of effectiveness of these apps (in terms of their ability to correctly alert the users—who are healthy—when they come in close contact with another user infected by the virus); technical problems related to the functioning of the apps; as well as the general disinclination to install these apps on smartphones owing to concerns over inadequate privacy and data protection as well as on account of complacency following a fall in the number of cases.
The digital contact tracing solutions so far are mainly driven by national initiatives that unfortunately do not address the global nature of the challenge posed by the pandemic. The world is now divided into countries where contact tracing is either comprehensive or limited in use and where there is no such activity. This disparate scenario calls for ways to ensure global interoperability of these apps in a manner that improves their operational efficiency. Interoperability can help strengthen the global economy by not only making it easier for people to re-engage in international business operations but also by boosting tourism.
The pandemic has shown that the existing regulatory system had not properly envisaged ways to effectively handle the post-lockdown phase. It would be important for the regulators to note that in order to open regional and national borders and simultaneously manage the risk of larger outbreaks in case of a shortage of vaccine, they will have to enforce interoperability of existing contact tracing applications or find ways to complement them. Private companies and governments need to collaborate now with intensity to increase their efforts to minimize the negative consequences of the disease on lives and the quality of living—not only for the current but also for future pandemics.
Data privacy, security, and even sovereignty concerns are legitimate and must be honored in the process of implementing interoperability. There is already criticism of commercial exploitation of personal data by companies to garner huge profits, a phenomenon also being described as surveillance capitalism. In addition, there are concerns over the possibilities of repurposing of contact tracing and keeping it in force even after the pandemic is over. It is, therefore, important to find the right balance between such concerns and the greater public good—both at the national and global levels. This can be done by ensuring that tracing and tracking technologies not only help control the spread of infections but also result in quick return to life without the mobility restrictions that have been in place since the pandemic outbreak.
International level regulatory dialogues are important to ensure that interoperability is among the good regulatory practices that promote market openness. Greater interoperability will benefit consumers (lower information costs and prices) and policymakers (helping them address challenges such as cyberattacks). However, striking the right balance is crucial because mandating “uniform technical standards and interfaces” just for the sake of interoperability could thwart the efforts of firms from bringing out innovative products.
At the same time, it is vital to consider the time constraints during a pandemic such as COVID-19. The benefits on account of greater interoperability in the back end as well as aligned data content and privacy standards outweigh the potential innovation limitations.
However, innovation should be promoted in the frontend to foster high adoption rates. The complexities of the situation warrant the need to hold discussions with all stakeholders, including the private sector. Such an approach can ensure that global interoperability is achieved organically (without coercion) in a transparent and non-discriminatory manner, which not only facilitates trade, helps in “greater sharing of the benefits of digital trade,” and promotes innovation and global growth, but also protects privacy, security and consumer interests.
Current contact tracing initiatives, however, could encounter several interoperability hurdles as they attempt to work in alignment with several existing frameworks. To address this issue, we propose a five-level customer centric contact tracing framework to ex-ante avoid global interoperability issues or help to heal them after they materialize.
Since the purpose of digital contact tracing is to serve the entire humanity, it must be inclusive, easy to use, and cost-efficient in order to enable its adoption on a large scale. Here it is vital to note that digital contact tracing will improve only if these apps are made interoperable and are used by a majority of the population. Most national contact tracing approaches might fail if they do not offer relevant incentives to boost their adoption as well as promote interoperability nationally and globally. In this regard, it is important for governments to address the digital divide by facilitating the development of digital infrastructure, including high-speed digital connectivity even in remote regions, and inclusion. As an alternative solution, governments could take steps to promote additional digital devices (such as Excalibur) or wearables (preferably globally interoperable) that support monitoring young children and the elderly, who generally do not use smart phones, as well as address situations handicapped by the unavailability or exclusion of smart phones (e.g. production lines, hospitals, slaughterhouses).
What will be crucial to achieve global interoperability is ensuring that the shared benefits from it outweigh the costs incurred in achieving it.
The costs of the lock-down accumulate to USD $1.4 trillion on the financial market and USD $6 trillion globally until April 2020. Recent estimates suggest an impact of USD $1.2-3.3 trillion on the tourism sector alone. That implies the promised value of a worldwide interoperable contact tracing would be worth the effort, as the benefits stemming from such an exercise would exceed the costs.
The benefits are that: it can lead to faster and more focused local lockdowns and speedier recovery of economies—as it can ensure that lesser number of people are infected and fewer need to be quarantined; and, it can lead to quicker and more controlled opening of international transport—as it will make it easy to track down the infected people and super-spreaders as well as those who do not comply with the reasonable restrictions in place for safeguarding public health—in turn, bringing down the overall economic damage.
What is required now is a stronger collaboration between governments and companies to bring out more incentives to ensure widespread adoption of a variety of interoperable digital contact tracing options. Only such an approach would lead to equitable distribution of benefits on account of a trustworthy infrastructure and data shared by the users across the world.
Lack of cooperation and collaboration will lead to more infections, loss of lives, and prolonged lockdown. A look at the history of pandemics helps us understand that COVID-19 will not be the last one and that a vaccine for the disease would not be a panacea. With lives, freedom of movement, and economic growth at stake, it is important to turn to data-secure and privacy-respecting digital contact-tracing and tracking solutions and a globally accepted interoperability mechanism.
