In the UK there are plans to use a mobile ‘phone app to trace people who have been in contact with someone who has COVID-19 to warn them to go into quarantine in order to slow the spread of the virus. This approach is reported to have been successful in other countries, but it has raised concerns over individual privacy and how the government might use the data. However, while data analytics and other techniques can help with the pandemic privacy is not the only challenge.
Quarantine Works
Plagues are not new, and history has taught us that the most effective response to a plague is to quarantine those infected. In 1665 a tailor from the village of Eyam in Derbyshire ordered a box of materials from London, that he was going to make into clothes for the villagers. This box contained some of the fleas that spread the bubonic plague which led to the villagers becoming infected with this deadly disease. However, the villagers set an extraordinary example of self-sacrifice by sealing themselves and the village off from the surrounding areas to prevent the disease from spreading.
Quarantining a whole village is an effective but costly approach while locking down the whole group stops the disease from spreading many people under quarantine may die - in Eyam 260 people died. A more calibrated approach is to implement the quarantine at an individual level. This manages the spread of the disease by tracing, testing and quarantining only the individuals that have been in contact with the disease. This approach is used successfully to prevent the spread of communicable diseases such as Ebola, Tuberculosis and Sexually Transmitted Diseases. It is very effective but has clear implications on the privacy of individuals.
Contact Tracing Ethics and Privacy
Contact tracing is also a very labour-intensive process. According to a report by the World Health Organization, “in Wuhan, more than 1800 teams of epidemiologists, with a minimum of 5 people/team, are tracing tens of thousands of contacts a day.” According to Dr Andrew Winter NHS eHealth lead speaking to the BCS Legal Group on April 9th, “this was an enormous effort that is just not practical in Europe”. The protocols used for tracing contacts in Europe take individual privacy very seriously and the manual process normally takes around 1 hour per contact.
The process involves verifying the contact without revealing the reason or the identity of the original infected person unless permission has been obtained. Verification also has legal implications; the original infected person may not accept that they are infected. This makes testing very important; the law provides strong measures that can be used to prevent an infected person from passing on a notifiable disease, but these measures are balanced with the need to prove the infection exists. Clinical diagnosis based on symptoms may not be enough proof.
In China, new technologies, such as the use of big data and artificial intelligence, were applied to strengthen contact tracing and the management of priority groups. In Europe, and in the UK, these technologies are also being adopted but privacy constraints and public acceptance may limit the extent to which these can be effective.
Voluntary Analytics
In the UK, on March 24th, King’s College London launched an app which tracks symptoms related to the coronavirus (COVID-19), allowing anyone to self-report daily. According to King’s College London researchers - the data from the study will reveal important information about the symptoms and progress of the COVID-19 infection in different people, and why some go on to develop more severe or fatal disease while others have only mild symptoms. However, it depends upon users honestly self-reporting their symptoms and test results. King’s College claims that the data collected by this app is protected according to the requirements of GDPR.
Contact Tracing App
In the UK NHSX, the health service’s technology arm, has been working on a contact tracing app with Google and Apple to use Bluetooth technology to alert those who have been in close proximity with someone who has tested positive for COVID-19. According to the BBC - NHSX - will test a pre-release version of the software with families at a secure location in the North of England next week.
Downloading this app would be voluntary and it would track their location as well as communicate with other users of the app nearby using Bluetooth. Users will be able to declare that they have self-diagnosed themselves as having COVID-19 at which point people using the app that have been in close proximity for an extended period of time would receive a Yellow Alert. If the diagnosis is confirmed by a medical test, then a Red Alert would be sent indicating that their contacts should self-quarantine.
However, this depends upon testing for COVID-19, which in the UK has mostly been limited to people who are admitted to hospital. While there are plans to expand testing until these are realized most diagnosis will be based on clinical assessment.
Privacy is not the only challenge
From a privacy perspective, there are grave concerns over how the data gathered by this app will be secured and used. In European democracies, the tracking of individuals is subject to strict legal controls and the infrastructure needed for this is not scalable to cover the whole population. Even where it does exist many factors lead to the data being noisy and accurate tracking depends heavily upon the data analysis process.
My colleague Matthias Reinwarth published a blog describing the PEPP-PT (Pan European Privacy Protecting Proximity Tracing) concept developed by a multinational team including several Fraunhofer Institutes including the Heinrich Hertz Institute in Berlin. This provides a technologically sound and privacy-compliant approach to provide support for pandemic containment. The approach is based on phones with the app contacting using Bluetooth when in range and does not involve storing data centrally. It is not clear whether this approach will be used in the UK app.
However, the challenges related to tracking are not just technical. Where the diagnosis is made by the patient or is based upon clinical assessment both false positives and false negatives are likely. In some cases, anonymity may encourage malicious individuals to report themselves as being COVID-19 positive in order to impact on people against whom they feel a grudge. The system would also need to cater for parents and carers to report on behalf of their children as well as the elderly without access to the technology. There would also need to be a way to distinguish health professionals and carers who are in contact with the infection as part of their work.
Another challenge is enforcement, while the law may support the isolation of infected individuals, most European countries do not currently require their citizens to carry proof that they are clear of infection. For this approach to be fully effective it may be necessary for people to accept this kind of control.
My colleagues have been publishing blogs on home office in times of pandemic, the don’ts of IT in the times of crisis, AI and healthcare, how to work securely at home and ransomware during the pandemic crisis.
