The privacy implications of COVID-19 tracking technology

By Eloise Bevan, Innovation Funding Consultant at ABGI-UK

GPS and location data from individuals’ smartphones is currently being tracked by some countries impacted by COVID-19. The historic movements of the population with diagnosed COVID-19 are analysed, and real-time movements are tracked in order to monitor transmission. The data can also be used to identify hotspots and notify people who have come into contact with a carrier to quarantine themselves.

Using location tracking data could accelerate the resolution of this pandemic by prioritising the health of the population, whilst also allowing the economy to function. However, there is a concern about data privacy for the individuals whose data is used to track the spread of coronavirus. Once the coronavirus pandemic is over, the increased technological surveillance data could be used by governments to track down activists, human rights defenders, journalists or even opposition figures.

This being said, different countries have taken different approaches in using data for fighting COVID-19; some countries have made it a legal right to access the information of a patient, some of the entire population, some only with the individual’s consent.

Israel and South Korea have given its security agencies the power to track the mobile data of people suspected of having coronavirus, with South Korea’s government even explicitly acknowledging the intrusive nature of the tools being used. These nations are using the data to force suspected carriers into quarantine and warn people who have come in to contact with them.

The stronger actions imposed stem from the countries‘ previous encounter with a deadly virus. In 2015 the Middle Eastern Respiratory Syndrome (MERS) virus migrated from the Arabian Peninsula to the Republic of Korea. In the aftermath of the relatively low (in comparison to COVID-19) 186 cases and 36 deaths, legal changes were made to the country’s infections Disease Control and Prevention Act, giving the Minister of Health the “legal authority to collect private data, without a warrant, from both already confirmed and potential patients”. Because of this, the travel histories of confirmed COVID-19 patients are published, and South Koreans check these maps to monitor any encounters they may have had on a daily basis.

What’s interesting, is that South Korea – with a population of 51 million – has experienced a successful Wave-1 battle with Coronavirus: a total of 10,810 cases and 256 deaths being officially recorded. This has been attributed to the use of tracking data, alongside very high testing rates.

However, the publicly available data of infected individuals and the continuous collection and possible long-term storage of this data has raised privacy concerns. In addition to the possible use of this data beyond COVID-19 and the associated security risks, data trails of infected individuals have been so detailed that individuals could be identifiable. This could create a social stigma of the infected and dissuade some infected people from coming forward to get tested. However, in a 1,000-person survey published in February 2020, most respondents supported the government sharing travel details of people with COVID-19 with preference to “the public good over individual rights”.

In light of the benefits contact tracing can have by utilising the technologies now available to us, 30 countries are now building tracing apps. In order to protect data privacy, it is imperative that the associated software does not allow for the identification of an individual, does not breach privacy rights, and if personal details are taken, these are taken with consent and are not stored for extended periods of time.

It is highly unlikely the COVID-19 virus is going to go away anytime soon, and with a vaccine far on the horizon, the proven method of contact tracing to minimise transmission is a promising technique to implement, whilst striving for a revitalisation of global economies. As long as existing privacy right policies are adhered to and new policies regarding the collection, use and storage are created to protect these.

In the third and final part in our mini-series on Technological advances in the COVID-19 crisis, we’ll take a closer look at the NHS COVID-19 Contact Tracing App, to find out what the UK plans to do with the collected data.