How COVID-19 contact tracing efforts will shape digital policy moving forward

Written by Logan Finucan, Senior Manager, Data Policy & Trust, Access Partnership

As the world’s fight against COVID-19 continues, technology has been a critical disruptor and has transformed the practice of contact tracing. However, it has also created a major shift in how some jurisdictions use personal data and has also provoked fear and contentious debate across the globe. For several years, the global privacy debate has been driven by private sector scandals and an EU-led approach to protecting consumer privacy through the private sector-focused General Data Protection Regulation. But, the COVID-19 crisis has marked a shift in the conversation.

A changing dialogue

Today, uses and potential abuses of data by governments are the centre of conversations, as public officials around the globe contemplate more expansive uses of data. Companies, by contrast, are positioning themselves as staunch champions of individual privacy, often forging stronger ties with former civil society critics.

In some countries, discussions of digital contact tracing and other measures to combat the virus have exposed the deficiencies of existing legal systems in ways that may spur more privacy protective action. In the United States, for example, the crisis has provoked new calls to pass a comprehensive national privacy law and resulted in new legislative bills focused on protecting privacy.

However, the current crisis may result in wider and more fundamentally detrimental consequences for privacy. After the apparent success of efforts to combat the virus through the extensive use of personal data in countries like China and Korea, other governments may follow suit – resulting in a partial reversal of the decade-long debate surrounding global personal data protection which has leaned towards restricting uses of personal data.

A lasting impact

Governments are working swiftly to expand the amount of health data available to them and while the scope of these efforts varies between countries, most are moving in the same direction – towards ever more collection and analysis of data. As a result, policy-makers are confronting challenges regarding the extent to which privacy protections that applied in the pre-COVID-19 era should remain applicable. While the EU is strenuously working to ensure the continued applicability of the GDPR, privacy concerns have generally become secondary to public health concerns around the world.

How the global public views privacy protections may also be in flux. While scepticism towards government and private sector data processing remains high in some countries, the fear of a spreading pandemic may grow to outweigh reservations. While comprehensive comparative data is lacking, public opinion surveys in various countries tend to indicate a degree of willingness to use voluntary apps and sacrifice some level of privacy for public health purposes. However, other surveys in the US have indicated scepticism, while France and other Western countries have seen contentious political controversies around contact tracing. These findings suggest that there may in fact be significant public resistance to government overreach in certain countries.

Will the extensive collection and analysis of personal health data by the state become the new normal, in the same manner that extensive state surveillance became largely normalised after traumatic terrorist attacks in the West in the early 2000s? The experience of South Korea indicates that perhaps it will. The country struggled to contain a previous disease outbreak several years ago, leading to the adoption of a law which enabled sweeping government access to personal data despite having one of the strictest privacy regimes in the world. These statutory authorities have now been exercised to the fullest, underpinning Seoul’s contact tracing programme, which has shown real results, and enjoyed public support.

Where do we go from here?

Countries are deploying a diverse set of technical tools and policy responses to combat the COVID-19 crisis. However, while some policy-makers are willing to make a trade-off between privacy and public health, there are signs of a growing public backlash. How this dynamic will play out in the long term is difficult to predict, though it is likely that governments’ push for expanded use of personal data will to some extent become the new normal. The extent to which governments seek to make this trade-off will depend on whether less intrusive and more privacy-protective approaches to contact tracing are effective, or whether the feel they need more expansive approaches like Korea.

Whatever path countries take, governments and stakeholders face a need to continually balance data protection and privacy concerns with public health measures. To build effective solutions and attain the full benefits of technology, these need to build trust with transparent, equitable legal regimes and inclusive dialogue. Companies must continue working as good faith partners and advisors. Due to the central role of technology provided by the private sector in digital contact tracing, their enabling role – through technical expertise, mobilising resources, and providing expert advice – is indispensable.

While the costs of poor governance and eroding trust are high, so too are the potential societal benefits of getting it right. With thoughtful and inclusive policy responses to guide the deployment of digital contact tracing, technology can continue to enhance welfare worldwide – health, wealth, and rights.