Wednesday, June 24, 2020
Contact tracing apps are being developed globally in a bid to try and slow the spread of COVID-19 and re-open economies.
We published an article on 22 April looking at contact tracing apps and the European Commission’s attempts to encourage a co-ordinated approach in the area of contact tracing. This article provides an update on what has been happening in the world of contact tracing apps.
Reminder – benefits of using contact tracing apps
The benefits of using an app-based approach to contact tracing over manual tracing are obvious. Manual contact tracing requires an individual to accurately recall and identify the people who they have been in close contact with, places where may have been within 2 metres of other people and at what times etc. Contact tracing apps, on the other hand, keep track of anonymous devices which have come into contact with each other for more than a few minutes. While none can yet be said to be 100% accurate, it certainly would seem to have a better chance of creating a more accurate list of contacts than an individual person relying on their memory and imperfect information could create.
Centralised vs decentralised
There has been division across countries as to whether centralised or decentralised contact tracing apps should be used.
A decentralised model ensures that most of the data is stored on the person’s phone, to minimise the potential for “de-anonymisation” by either hackers or an overeager government. This gives the user of the app greater control over their data and, as with most decentralised apps, once the app is deleted all of the data is deleted with it. However, with a centralised model, the data you choose to share on the app is stored on a central server and can be used in the future for another purpose.
Privacy advocates say the decentralised model is less intrusive and less open to abuse. On 19 April an open letter was signed by nearly 300 academics who endorsed Google and Apple’s approach and warned that any central database risked “mission creep” and could “catastrophically hamper trust in and acceptance of such an application by society at large”. The academics also endorsed a Bluetooth-based model over a model based on sharing geolocation (i.e., GPS) and argued that GPS lacks sufficient accuracy and also carries privacy risks because the GPS data is sent to a centralised location.
Overall, the difference between a centralised and decentralised model comes down to data control and how much of that control people are willing to allow their respective Governments and Health Authorities to have.
What is Ireland doing?
The HSE has announced that its contact tracing app is ready to launch and, subject to final Government approval and approval from the Google and Apple app stores, is expected to be available for download late this week or early next week.
It is understood that the Irish app relies on the Google-Apple contact tracing API, i.e. a ‘decentralised model’) and will use Bluetooth technology, as opposed to using or recording exact location data, and the app will only operate on a voluntary basis where users provide their explicit consent.
The planned launch of the Irish contact tracing app follows recent work at European level where the EU Commission and Member States have agreed on a set of technical specifications to ensure a safe exchange of information between national contact tracing apps based on a decentralised model. The idea being to have a series of national contact tracing apps that are interoperable, so effective digital tracing can take place when citizens start to increase travel as lockdown restrictions are relaxed across Europe.
We expect to see more information made available on the privacy impacts of the Irish app and guidelines for users.
Interestingly, the UK had opted for the centralised model on which to base their contact tracing app. However, they have now abandoned this approach in favour of using the de-centralised Google-Apple model, following countries such as Germany, Denmark, Italy and Poland.