NOTE: This post was originally published on February 4, 2021
The wide adoption of contact-tracing apps in 2020 seemed to herald a rare moment of unity in public-health circles, leveraging the ubiquity of our devices to ascertain and quell the spread of Covid-19.
Contact-tracing apps help at both the individual and societal level. Letting individuals know they may have been exposed to the virus helps them avoid public spaces and other crowded spots, stops them from making social calls to friends and family, and puts them on alert to possibly seek out medical attention. At the societal or public health level, contact-tracing apps aggregate data, build virus heat maps, and assist with modeling and predictive efforts.
Public skepticism on the data gathering practices of contact-tracing apps is a common theme, but some countries seem to have allayed fears better than others. Finland, for example, persuaded 20% of its entire population to download the national contact-tracing app in one day.
[Stay in the know. Sign up for the ExpressVPN Blog Newsletter.]
But there’s a fine line between invasive data-collection practices and the need for individual privacy. The danger here is that contact-tracing apps are collecting more data than they need, and that they’re not doing enough to ensure anonymization.
In Singapore, the TraceTogether app was one of the first contact tracing apps in the world, rolled out in the months immediately following the emergence of Covid-19. It’s been downloaded by nearly 80% of the 5.7 million people who call the city state home as officials moved it from voluntary participation status to mandatory in certain situations (although there’s also an option for a BlueTooth token).
But a disturbing development earlier in January has cast a shadow over the app’s use of personal data. Singaporean officials announced that data collected by TraceTogether could be handed over to the police to assist with criminal investigations. This is a reversal from the original privacy policy that said the data would only be used for the purposes of contact tracing.
Officials in the Lion City argue that Singaporean laws give local security forces unfettered access to data when it comes to investigating crime, and TraceTogether cannot be treated differently. The app’s privacy policy was also updated a few weeks ago to reflect this change.
To be fair, TraceTogether has certainly helped achieve public health objectives in Singapore. There are zero cases of community transmission, for example. But it’s unclear where the collected data is stored; privacy best practices state that third-party data centers store this information, rather than the government. And in the case of Finland and other European countries as mentioned above, governments have strived to balance the two requirements.
There are other examples of questionable data gathering practices, too.
In Bahrain, the BeAware contact tracing app serves a variety of use cases. Travelers arriving in the country are required to self-isolate and must download the app. But that’s not all: The app is also paired with a wristband that pings the government if the individual leaves their isolation quarters. Needless to say, the app collects both location data and movement history. In some cases, the Ministry of Health may also ask individuals to upload selfies showing both their face and the wristband.
Penalties for non-compliance are harsh, with either a prison sentence of three months or a fine up to 26,000 USD. Amnesty International has criticized Bahrain’s app, calling it “among the most dangerous for privacy.”
The advocacy body also notes that Bahraini authorities have published personal information of suspected Covid-19 cases online, including data pertaining to nationality, age, gender, and travel history.
To entice citizens to download the app, the app automatically added users to a television game show called Are You At Home?. The host of the show randomly video called phone numbers provided by the government to check if the individuals were staying home and following social distancing protocols. Compliant individuals received cash prizes.
While Bahrain is an extreme example, a number of other countries in the Middle East and North Africa also seem to value contact-tracing technology more for its surveillance capabilities than its public-health benefits.
On the other hand, countries like South Korea, Germany, and Australia have used contact-tracing technology effectively and in a less invasive manner, balancing public skepticism with public-health considerations. That ought to be the norm.
Have a view on how countries should approach the needs of public health vs. those of individual privacy? If you’re a student, you can enter our annual essay contest to win $5,000!