Recommendation on the Use of IT for COVID-19 Infection Mitigation
The Board of Directors of Informatics Europe has issued the following policy recommendation regarding the use of tracking technology in the efforts to control COVID-19 infection spread.
“The current COVID-19 pandemic has forced many countries to take drastic measures to prevent and control virus transmission from individual to individual. These measures go from stopping all activities that imply direct person to person interaction or creation of crowds (i.e. “social distancing”), to tracking the movements of people in order to keep potential infections under control.
In this context, Information Technology (IT) plays a facilitating role in several areas. As an example, tools to support smart working from home and distance education are important enablers for making a long quarantine possible in many countries. As a matter of fact, smart working is only possible thanks to IT and, while it is not applicable in all sectors, still, it is ensuring work continuity for a significant fraction of the population, thus guaranteeing at least stability of some business areas. Moreover, for the first time in history, in Europe, schools of all grades are intensively using teleconferencing systems and content sharing tools to allow teachers and students to be in touch with each other and continue the learning experience. Of course, the situation is not always easy with some students unable to access digital contents and teleconferencing, but without these systems, which are showing significant robustness and reliability, various generations of pupils would be depleted of the most important asset in their life, education. In general, the society heavily relies on IT and society would not be able to survive this period without it. Finally, IT is also supporting research in the analysis of the virus RNA and in the identification of the medications that could be the most promising ones in the fight against this invisible enemy.
Nevertheless, there is one particular area in which the usage of IT should be applied with the utmost caution. That is the area of individual tracking. On the one hand, the possibility of individual tracking is technically viable and could, in principle, be adopted both to limit the possibility of contagious situations and to ensure the safety of a significant part of the population. On the other hand, tracking the general population, even only a subset of it, can be seen as a significant violation of personal privacy which, especially in Europe, the majority of people view as a basic right. Thus, we need to carefully analyze the dilemma between the needs and the interests of the whole society in this specific contingency and the need to guarantee the freedom and the privacy rights of each individual.
As Europeans and people competent in IT, we think it is possible to guarantee data privacy of individuals while still enabling some useful forms of individual tracking. Both the European Convention on Human Rights and the GDPR should be the foundations and the driving force for any action in this area. The former, in fact, requests that any infringement on rights must be “temporary, limited and supervised” while the latter consents exceptions in processing of personal data only if they constitute “necessary, appropriate, and proportionate measures”.
We sincerely worry that the extraordinary measures taken to manage an unprecedented crisis can become a permanent tool for governments to limit civil liberties and digital freedom. The actual success of any location tracking system depends more on public health policies and operational measures than on the technical solution itself. It is therefore of the utmost importance to ensure to have all the required components in place before adopting a solution which otherwise could result ineffective. Therefore, our recommendation to policy makers and technical experts is that, in case individual tracking reveals to be essential for containment and monitoring reasons, such tracking ought to be done with full consideration of the following principles:
- Track individuals with their consent and under their direct control, allowing them to freely and easily switch tracking on and off even during the same day. To achieve this goal, we recommend technical experts to develop software which is not only GDPR-ready, but also dynamically reconfigurable by the end users within the limits defined by the current jurisdiction.
- Track only aggregated data that cannot be traced back to particular individuals if they have not given their explicit consent.
- Keep the tracking process transparent and open to the scrutiny of public opinion from the beginning of its use and rely on the evaluation by independent scientific advisors to assess the impact of security measures taken.
- Make any software and hardware used open to examination by the civil society.
- Specify the time limit for tracking without allowing for any extension in absence of an independent evaluation of the motivations
By adhering to these principles, the legitimate needs of society in the midst of the COVID-19 crisis can be fairly balanced with the needs and rights of the citizens impacted by the crisis.”