Could a Mobile App Help Contain COVID-19? Balancing Privacy Rights & Public Interest

As the COVID-19 pandemic continues to accelerate, there are some innovative efforts to minimize its impact.

In one such approach, a multidisciplinary group of computer scientists, mathematicians, and epidemiologists at the Big Data Institute at Oxford University have developed a mathematical model instantiated in a mobile application that traces contact.

Those involved in the project believe it's "..possible to stop the epidemic…if contact tracing is sufficiently fast, sufficiently efficient, and happens at scale."

Typically, contact tracing is the most effective way to contain an outbreak. However, with a virus like COVID-19, that's preponderantly transmitted by asymptomatic patients, "classical contact tracing will not be enough to achieve the speed and efficiency needed, but it could be achieved by a contact tracing mobile app if used by a sufficiently large proportion of the population."

The Oxford research team has developed a proposal for their contact tracing mobile app that can "replace weeks of work performing manual contact tracing with an instantaneous, scalable messaging service."

Based on their modeling, the research team believes that their mobile application can reduce manual contact tracing from 72 hours to 4 hours. While the use of this mobile application would not be mandated, the researchers suggest that 60% of the population would have to adopt it "for the digital contact tracing to reach enough new infections to stop the spread." In addition, public health authorities would have to undertake continuous testing to proactively survey potential outbreaks.

A Look at Taiwain's Successful COVID-19 Containment

There is empirical evidence to suggest that the application of rigorous wide-scale testing coupled with the application of mobile technology can blunt and control infection and mortality rates associated with COVID-19. A recently published report co-authored by Dr. Jason Wang of Stanford University's school of medicine demonstrates how Taiwan, a country just 130 km from the epicenter of the outbreak in China, was able to contain the outbreak without the draconian lock-down measures in place throughout many of the advanced economies.

How did Taiwan manage to limit and contain the spread of the virus? The report highlights five interconnected factors:

1. Pandemic readiness
2. National Electronic Health Records Database
3. Wide-Scale Testing
4. Big Data Analytics
5. Use of Mobile Technology to track movements of those subjects with positive test results

Within 72 hours of the outbreak, a comprehensive case identification protocol was instituted based on travel histories, and "those identified as high risk were then monitored electronically through their mobile phones."

Health authorities were able to trace the movements of high-risk subjects, thereby immediately mitigating the risk of further transmission through targeted isolation measures. Taiwan may serve as a template for how to mitigate future pandemics.

Other Technology-Driven Initiatives

There are also initiatives underway by platform providers, notably Google and Facebook, to track and analyze the "collective movements of millions of users to determine how the coronavirus is spreading across the US and gauge the effectiveness of calls for social distancing."

For example, Facebook's "Data for Good" project is designed to track movements of people to measure and anticipate potential outbreaks and "in the coronavirus context, researchers and non-profits can use the maps, which are built with aggregated and anonymized data that people opt in to share, to understand and help combat the spread of the virus."

Balancing Privacy Rights and Public Interest

There are those who argue that the implementation of mobile tracking applications represents an unwelcome intrusion to privacy rights, given that the proposed COVID-19 digital containment application will likely require wide-scale adoption and data subject consent.

However, GDPR identifies six grounds for lawful processing of personally identifiable information, including a provision that when processing is, "necessary for the performance of a task carried out in the public interest," such processing of personally identifiable information is warranted without obtaining data subject consent.

Furthermore, Recital 46 of GDPR stipulates that processing of personally identifiable information is warranted without obtaining data subject consent when such "processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters."

However, it is important to note that Recital 46 construes the application of the public interest provision narrowly that its application should "take place only where the processing cannot be manifestly based on another legal basis."

But apart from the balancing of privacy rights with public interest, it is also incumbent on the technology sector and on policymakers to implement ethically sound, transparent, and fair guidelines relating to the use of AI-driven profiling and sharing highly sensitive health information.

The Oxford research team considers these ethical considerations as paramount in securing trust and adoption: "The appropriate use of a coronavirus mobile application will depend on building public trust. This requires high ethical standards throughout the intervention, including guaranteeing equal access and treatment, addressing privacy, and data usage concerns…"

The principles of fairness and transparency are re-enforced by the EU Commission on The Ethics Guidelines for Trustworthy Artificial Intelligence which laid out seven guiding principles associated with the application of AI technologies:

1. Human Agency and Oversight
2. Technical Robustness and Safety
3. Privacy and Data Governance
4. Transparency
5. Diversity
6. Non-Discrimination and Fairness
7. Societal and Environmental Wellbeing and Accountability

These principles were further re-enforced by the AI Now Institute in its 2018 report, "Respect the public's right to know which systems impact their lives and how they do so by publicly listing and describing algorithmic systems used to make significant decisions affecting identifiable individuals or groups, including their purpose, reach, and potential public impact."

Ethical use of AI ought to be considered not only a legal but a moral obligation. The Electronic Frontier Foundation recently commented that the use of technologies that can help us mitigate the impact of COVID-19 pandemic, while essential to protect health safety, "it must be medically necessary, as determined by public health experts; any new processing of personal data must be proportionate to the actual need; people must not be scrutinized because of their nationality or other demographic factors, and any new government powers must expire when the disease is contained."