A range of technology solutions have been used internationally to enable contact tracing to occur, with various levels of effectiveness. Currently there are an estimated 50 apps that have been established to assist with contact tracing, and contact tracing is being used to some extent in 29 countries.
This is a fast moving issue, as nations across the globe strive to use technology to assist with managing the pandemic. In New Zealand, the Minister of Health has announced that a government-developed contact tracing phone app is well developed and expected to be released for voluntary registration very soon. The details of this app, how it will work, and how people's data will be protected, are yet to be released.
This article canvasses the steps taken in key jurisdictions overseas, analyses the options for contact tracing that New Zealand could adopt bearing in mind varying degrees of anticipated efficacy.
Overseas approaches
- Singapore: Singapore is considered to be one of the leaders in the implementation of contact tracing technology, and has rolled out a “TraceTogether" app which it uses to support ongoing contact tracing efforts amid the COVID-19 outbreak. By downloading the app and consenting to participate in it, TraceTogether allows users to "proactively help" in the contact tracing process. Users are only asked to share records when contacted by the Ministry of Health as part of contact tracing investigations. If they refuse, a user may be prosecuted under the Infectious Diseases Act 1977. It is notable that while this app has been downloaded 1.2 million times, it is believed that only six additional cases of COVID-19 have been found as a result of the use of this technology.
- Australia: The Australian Government has launched an app that will trace every person who has been in contact with a mobile phone owner who has tested positive for COVID-19 in the previous few weeks, in a bid to automate contact tracing, and allow the easing of restrictions. The app works by using Bluetooth to record the details of anyone the phone carrier gets close to who also has the app. The two apps exchange anonymised IDs, which are stored encrypted on phones and deleted after 21 days. The Prime Minister has said consent would be key to the app, indicating it would not be mandatory, and people would share information through the app only if they consented to it.
- Israel: Confirmed and suspected COVID-19 patients' cell phones are monitored by the Shin Bet (the domestic security service) and police. This monitoring followed emergency regulations approved by the government that enabled the gathering of cell phone location data and additional personal information about those diagnosed with COVID-19, or those suspected of having been infected.
- Taiwan: From January, the National Health Command Centre rapidly produced and implemented a list of action items, including border control from the air and sea, case identification (using new data and technology), quarantine of suspicious cases and proactive case finding. This included the electronic monitoring of quarantined individuals via government-issued cell phones. If an individual fails to comply, they may be fined under the Communicable Disease Control Act (which gives health authorities extremely broad powers to impose restrictive measures in response to communicable diseases).
- South Korea: Laws published since the country's last outbreak in 2015 (Middle East respiratory syndrome) specifically allow authorities to publish location information about residents in an effort to limit the spread of COVID-19. Amnesty International reports that this tracking “does not appear to meet the conditions required for surveillance to be lawful and is a violation of the right to privacy".
- Hong Kong: In Hong Kong, travellers are required to quarantine for two weeks and wear a tracking bracelet. The Hong Kong Privacy Commissioner for Personal Data has indicated that this is subject to the (previously existing) Personal Data (Privacy) Ordinance (Cap 486) (PDPO). The PDPO has released guidance indicating there are sufficient legal grounds under the Ordinance upon which the government can collect and use information to track potential COVID-19 carriers or patients.
- United Kingdom: There are reports that the UK is gathering anonymised or aggregated location data from telecom companies to track people's movements in response to the COVID-19 pandemic. There is no apparent law that has been enacted to allow this tracking, however the Information Commissioner's Office (the UK authority set up to uphold information rights) has released a statement indicating that such data use is subject to existing data laws, and that “where this data is properly anonymised and aggregated, it does not fall under data protection law because no individual is identified. In these circumstances, privacy laws are not breached as long as the appropriate safeguards are in place." The UK is currently trialling a contact tracing app in the Isle of Wight, and it is expected an app will be fully rolled out in the UK later this month.
Options for contact tracing in New Zealand
Contact tracing using mobile phones
- Tracing members of the population via their mobile phones could be an important tool in ensuring the lockdown is properly followed, and has been used extensively overseas. However, there are drawbacks and risks.
- Most mobile phone GPS is accurate to 25 metres, which is a very large zone (much bigger than would realistically give rise to a risk of transmission). This means that any automated GPS tracking and notification could make contact tracing a much larger, more complicated and difficult endeavour than it needs to be, through over-notification.
- There are issues with variability of hardware, software, and signal strength, which could make the use of phones for contact tracing less efficacious than initially anticipated. There may also be an issue if more than one app is used; Google for example has stated that it intends to support one app per jurisdiction. Battery drain and data usage would also be an issue, especially if the relevant app was operating continuously on users' phones.
- Some of these issues could be ameliorated by adopting a decentralised system, whereby the relevant data is mostly kept on your own device. This is the approach that has been taken in Ireland, where Bluetooth keys are added to your device when you come into contact with other people using the app. If you are diagnosed with the disease, a message is pushed out to people with those Bluetooth keys, telling them what to do next (for example, to isolate or get tested). This puts the responsibility on the user of the device to take such steps as may be required.
“Covid card"
- New Zealand appears to be the only country in the world that is currently considering a hardware solution to the issue of contact tracing, namely the “Covid card" which would be an EFTPOS-sized card issued to everyone in New Zealand.
- This card would be Bluetooth-enabled and would store data on the device until a person received a positive diagnosis. At that time, the data would be uploaded to the cloud, and people who the infected person had come into contact with could be notified of their potential exposure.
- This has advantages of overcoming the digital divide, as not everyone has a mobile phone or carries one with them at all times. In addition, it solves the issue of existing Bluetooth devices using different standards that may not “talk" to each other in the same way.
- There is however, an issue with cost and proportionality. It would need to be considered whether issuing Covid cards to five million people, at an initial cost of NZ$100 million, is a proportionate response to the need for contact tracing and the potential benefits this could bring.
QR codes
- At Alert Level 2, businesses will be required to keep a record of who enters an establishment, so as to allow for contact tracing if an infection occurs.
- It has been suggested that technology such as QR codes could make this process easier, allowing people to 'check in' to an establishment by scanning a code, rather than relying on a tracing app or manually providing their details.
- QR codes are likely to be useful for businesses to maintain records of their customers, but these may not be a suitable or comprehensive solution for other situations.
Manual recording of movements and contacts
- It is likely that manual recording of people's movements will be one of the major ways contact tracing is managed at Alert Level 2, especially as businesses and venues reopen.
- It has been suggested that one of the most effective and safe uses of GPS data from people's phones would be to use an app to provide individuals who have tested positive with information about what their own movements, as a reminder, so that they can create their own record of potential contacts.
- Manual recording of who people have been in contact with does give rise to the issue of then finding those people's correct contact details to allow them to be contacted. Manual recording can also take a considerable time, and lead to a greater risk of human error.
What next?
The Privacy Commissioner has identified three key questions to ask when considering contact tracing options:
- Is the proposed solution going to work?
- Is it proportional?
- What happens to the data once it is uploaded?
In considering the best approach to contact tracing, there has been considerable activity on the supply side, as developers and others in the tech industry try to find solutions. A key to the success of any contact tracing solution, however will be what will work for the health professionals who will be using any data collected, and how public health officials can use these tools to better manage the situation and protect the nation. Any solution therefore, needs to have the full support of the health sector.
Consent and trust will be very important for whatever approach is taken. There appears to be no realistic prospect of the public at large being required to use technology for contact tracing if they do not want to do so. Given the potential scope and value of the data that will be collected, encryption and other data protection safeguards will need to be used, and any storage of data will need to be time-limited (likely only long enough to cover the potential incubation period for the virus).
There may be a need for legislation to specifically state what the limitations are for using any data that is collected, and providing for automatic deletion of data from the relevant device or database when this is no longer required. It should be noted that the Health (Retention of Health Information) Regulations 1996 currently provide that health information must be held by health or disability services providers for a period of 10 years, which would not appear to be appropriate for data collected in the context of contact tracing.
Any contact tracing solution will need to incorporate privacy by design, and privacy impact assessments will need to be undertaken.
If you have any questions about the use of technology and its impact on privacy in the context of the COVID-19 pandemic, or any other issues raised in this article, please contact the authors or your usual Bell Gully adviser.
To view our other COVID-19 related publications, click here.
To receive all Bell Gully's updates on COVID-19 you can subscribe here.
Disclaimer
This publication is necessarily brief and general in nature. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.