The response to COVID-19 highlights the tensions between the desire to track data and data protection laws

Viewpoints
April 8, 2020
2 minutes

Desperate times may call for desperate measures as the old adage goes, but in the desire to track and respond to the COVID-19, law makers must be aware of not blurring the boundary of good intention and surveillance state.

There are a number of ways that health tracking apps - which map resting pulse, sleep and activity levels and can identify tell-tale signs of infection - or mobile phone location data could assist governments and authorities in locating people who have been exposed to COVID-19 and tracking the spread of the virus, as was undertaken in Korea. With many countries now in lockdown and some looking to exit from it, the location data and health monitoring apps could also provide a monitoring strategy for  a smooth re-integration of society.  

EU governments are also working with telecoms operators to obtain phone location data to help track the movement of people and its link to the spread and/or containment of the pandemic. Both politicians and telecoms industry insiders have spoken of the location data sets as being statistical and anonymised so that no individual identities will shared.

But the use of such data to track the virus has triggered fears of whether with such detailed information on movement linked to an individual's mobile device it is ever truly anonymous, with research showing that 99.98 per cent of individuals can be re-identified with just 15 demographic characteristics using location data. Also what happens to all this data once the pandemic has ended?

The EU is looking to establish common international standards to allow data from multiple apps to be consolidated and compared easily.  The EU Commission has been setting out its proposals on the most efficient and effective ways of using of digital tools, especially mobile apps to assist an international response to COVID-19, and is preparing guidelines on the the use of tracing apps, which may require individuals to give informed consent to the collection, analysis and sharing of their personal data, and hopefully to its deletion as well. 

It is clear that for an effective global response to the pandemic to be successful and quick, data will need to be shared, whether it be location data or that collected by apps. However, the challenge for governments and regulators will be striking the balance between the public health and safety needs of society at large and the protection of  the rights and freedoms of the individual. 

Any emergency measures need to be temporary and, wherever possible, must still be linked to the safeguards already enshrined in national data protection and privacy laws.