Data protection and Covid 19

THE USE OF TECHNOLOGY IN THE FIGHT AGAINST COVID-19. A COST-BENEFIT ANALYSIS

1. CONTENTS
2. Introduction................................................................................................................ 3

III. Geolocation of mobile phones by telecommunications operators............. 4

1. Geolocation of mobile phones through social networks........................................ 5
2. Apps, websites and chatbots for self-testing or booking appointments................................................... 6
3. Apps for voluntary reporting of infections (COVapps)......................................... 7

VII. Bluetooth contact-tracing apps (Contact trace apps).................... 8

VIII. Immunity passports......................................................................................... 10

1. Infrared cameras for mass temperature readings............................... 11
2. Conclusion................................................................................................................ 12

II. INTRODUCTION

Before implementing technological solutions to tackle COVID-19, it is essential that they be embedded within a framework of realistic legal and organisational measures that are effective, based on scientific criteria, legitimate and proportionate.

Proportionality is established through an analysis of the cost and benefit to society and to individuals' rights and freedoms. The benefit must be measured in terms of a reduced spread of the infection overall, the possibility of regaining freedom of action, and the protection of individuals' health.

Health data has a high value, so it is essential to prevent third parties from taking advantage of the uncertainty caused by an emergency situation to commit abuses that lead to a loss of freedoms, discrimination or other harm to citizens' personal circumstances.

This document offers a brief, non-exhaustive analysis, for educational purposes, of some of the technologies used in the fight against COVID-19, the benefits they promise in the fight against the pandemic, and the costs to individuals' privacy that they may entail, in particular:

• Geolocation using information collected by telecommunications operators
• Geolocation via social networks
• Apps, websites and chatbots for self-testing or booking appointments
• Apps for collecting information on infected individuals
• Contact-tracing apps
• Digital immunity passports
• Infrared cameras

III. GEOLOCATION OF MOBILE PHONES BY TELECOMMUNICATIONS OPERATORS This technique involves mobile network operators providing anonymised information on the location of their users within the phone cells defined by their masts. Operators routinely collect positioning data on their subscribers, calculated from the signal strength of each phone reaching the various masts in an area. With this information, which is necessary to provide the service, an operator can estimate which phone numbers are in each cell at a given time, and can even give an approximate location for any active mobile phone within a cell. This information, when not anonymised, can be requested by law enforcement bodies, always subject to a court order. Separately, its anonymised use was employed by Spain's National Statistics Institute1 for mobility studies. During the management of the COVID-19 crisis, the Government2 and the European Commission3 have asked operators to provide this type of anonymised information to track population movements.

DOES THIS DATA POSE A THREAT TO PRIVACY DURING THE PANDEMIC CRISIS?

With careful management, appropriately anonymised access to this information should not represent any greater threat than it already did before. That is to say, there is always the possibility of incomplete anonymisation, poorly rigorous subcontracting, or a cyberattack placing the location of users' phones in a third party's hands, although this risk already existed before the pandemic. Making greater use of this anonymised data may carry a greater risk, but not an exponentially greater one.

1

https://www.ine.es/ss/Satellite?L=es_ES&c=INEmasNoticia_C&cid=1259952394212&idp=1254736092060&pagename=masINE%2Fm asLayout The INE carries out a pilot study on mobility based on aggregated mobile phone data

2 https://www.boe.es/boe/dias/2020/03/28/pdfs/BOE-A-2020-4162.pdf . Order SND/297/2020, of 27 March

3 https://www.politico.com/news/2020/03/24/europe-mobile-data-coronavirus-146074 European Commission tells carriers to hand over mobile data in coronavirus fight

DOES THIS DATA REPRESENT A SIGNIFICANT BENEFIT DURING THE PANDEMIC CRISIS?

Knowing the population's mobility patterns, seeing where people travel to for work or at weekends, can be beneficial to an administration at any time. Consider that infrastructure, healthcare or the police are elements that could be dynamically sized with a good mobility model. Think, for example, of how these factors are resized when an event such as a football match or a demonstration takes place. That said, their usefulness must be continuously assessed against changing scenarios of global or partial lockdown.

One idea that has been raised is the possibility of using anonymised geolocation data to observe overall movements, but with the possibility of the police requesting re-identification in certain cases, according to criteria set by the health authorities to ensure control of the epidemic.

IV. GEOLOCATION OF MOBILE PHONES VIA SOCIAL NETWORKS Geolocating mobile phones from social network data is nothing new. The IP addresses from which we access the internet can be known to website administrators, and are routinely used for advertising purposes. Some major providers such as Facebook4 or Google5 have recently published aggregated data in the form of large dashboards.

DOES THIS DATA POSE A THREAT TO PRIVACY DURING THE PANDEMIC CRISIS?

Insofar as this processing locates the individuals concerned, this practice can be a threat to privacy, though not one unique to this moment or situation. This threat can be more serious if this information is enriched with personal information derived from activity on user profiles, or if actions are taken based on those profiles. The terms of use and privacy policies of these services are not an adequate legal basis for carrying out this kind of processing.

4 https://covid-survey.dataforgood.fb.com/ Facebook & Carnegie Mellon University COVID-19 Symptom Map

5 https://google.com/covid19-map/?hl=es Coronavirus disease (COVID-19) map

DOES THIS DATA REPRESENT A SIGNIFICANT BENEFIT DURING THE PANDEMIC CRISIS?

This data could help the authorities, provided the information gathered aligns with a purpose and objective previously defined by the health authorities, who should be able to define everything from the level of detail to the format needed to apply it to their prevention and control strategies. In any case, it would need to be justified how far this represents an improvement over other sources of information the authorities may already have available.

V. APPS, WEBSITES AND CHATBOTS FOR SELF-TESTING OR BOOKING APPOINTMENTS This broad group of solutions includes applications or apps6, websites and chatbots that run question-and-answer tests, provide information, or even allow appointments to be booked with health services. In this document they are grouped together in a single category as they are perhaps the least technologically novel solutions, although they may also be among the most widely used.

DO THESE APPLICATIONS POSE A THREAT TO PRIVACY DURING THE PANDEMIC CRISIS?

Depending on how they are built and what their objectives are, privacy threats can arise. These can emerge from the urgency to offer working solutions, which relaxes the controls and requirements needed to protect citizens' data. In some of these applications7, potential privacy threats have been found in their implementation. It should also be remembered that an app or website is merely an interface for displaying and sending data to a server, and it is there that the quiet work of handling requests actually takes place.

DOES THIS DATA REPRESENT A SIGNIFICANT BENEFIT DURING THE PANDEMIC CRISIS?

In general, when well built, they do represent a great benefit, since they bring health information and services closer to the people who use them. As a side effect, they help free up other channels, such as the telephone,

6 Some examples in Spain are https://www.coronamadrid.com/, https://canalsalut.gencat.cat/ca/salut-a-z/c/coronavirus-2019- ncov/stop-covid19-cat/, or https://www.euskadi.eus/koronabirusa-app-covid-eus/web01-a2korona/eu/

7 https://blog.appcensus.io/2020/04/19/spanish-covid-19-apps/ Analysis of Spanish apps by AppCensus.

enabling access for people who, due to their age or circumstances, cannot get online. The risk, in addition to those already listed, would be to render invisible those who don't know how to, or don't own, a computer or mobile phone, and leaving them without services.

VI. APPS FOR VOLUNTARY REPORTING OF INFECTIONS (COVAPPS)

This category includes mobile applications that have emerged almost instantly, in some cases from citizen initiatives8, aiming to produce their own maps and statistics on the spread of COVID-19 using data provided voluntarily by users. In a very open and transparent setting, an appeal is made for altruistic collaboration in downloading these applications and uploading location data and data on possible infection, thereby helping to build maps and dashboards using information theoretically unfiltered by the authorities9.

DO THESE APPLICATIONS POSE A THREAT TO PRIVACY DURING THE PANDEMIC CRISIS?

These apps could pose a threat if their stated purposes are not as altruistic as claimed, or if haste leads to development without privacy safeguards. It should not be forgotten that what is being handed over to servers on the internet is health data and precise locations. If the quantity and quality of this data were sufficient, thanks to a significant number of users, conclusions could be drawn such as neighbourhoods with high infection levels or "toxic" areas, with the social stigma this can bring for their residents or businesses10. In other words, a significant sample is needed, and no one should be able to maliciously provide false or manipulated information to benefit or harm the group as a whole.

8 https://github.blog/2020-03-23-open-collaboration-on-covid-19/ Open collaboration on COVID-19.

9 https://covidtracking.com/about-project The COVID Tracking Project

10 https://twitter.com/rcalo/status/1240028937008209920 Ryan Calo: Apps that purport to track people infected with COVID-19 are a terrible idea imo for several reasons.

DOES THIS DATA REPRESENT A SIGNIFICANT BENEFIT DURING THE PANDEMIC CRISIS?

Some private initiatives justify their approach by pointing to a hypothetical lack of action or trust in the authorities. However, given the voluntary and uncontrolled nature of use from the outset, it is never possible to know the reliability of the information they contain, so they can contribute to spreading false news and cause harm.

VII. BLUETOOTH CONTACT-TRACING APPS

This type of application uses the Bluetooth technology found in mobile phones, which allows connections with nearby devices such as headphones, speakers or watches.

In this case, the apps use Bluetooth to send the user's "card" to nearby phones as they go about their day, while also collecting the "cards" from those same phones. Each card carries no real identification of the user, only a pseudonym for their identity. In this way, each phone builds an anonymous collection of "cards" from the people it has been near at work, on public transport or during leisure time. If a particular user finds out they are infected, they can "declare" this through the app to a central server. At that point, anyone who has been in contact with them in recent days is expected to receive an alert so they can assess what action to take, such as self-isolating, contacting their health services, or getting tested.

Several strategies11 have emerged for implementing this technology, which essentially differ in who controls the identities and the network of contacts for each user. Some options place that control with the user themselves (decentralised), while others rely on centralised control, supposedly held by an authority.

In the technical debate over which type of solution will be used in Europe, a new factor has recently emerged, with tech giants Google and Apple joining forces to offer a tracking solution12 or contact trace using their iOS and Android systems. Among other reasons, this is because the iOS system considerably restricts third-party

11 https://github.com/DP-3T/documents and https://github.com/ROBERT-proximity-tracing DPT3T and Robert are good examples of Contact Trace implementations.

12 https://www.apple.com/covid19/contacttracing/ Privacy-Preserving Contact Tracing

solutions that use Bluetooth in the background13, and unless some form of adaptation is made, iPhone users would not be able to properly use applications not made by Apple.

DO THESE APPLICATIONS POSE A THREAT TO PRIVACY DURING THE PANDEMIC CRISIS?

The main threats14 to privacy from this type of solution stem from mapping relationships between people, re-identification through implicit location, the fragility of the protocols used to build near-anonymous "cards", and the challenge of scattering infection signals so that the identity of infected individuals is never revealed. It should be borne in mind that this data processing affects not only the app's user but also every third party they have been in contact with, so this processing must comply with data protection principles.

There are studies15 on the robustness of encryption and anonymisation protocols, and there is always a possibility that, given enough time and computing power, these could be broken and the anonymous pseudonyms linked back to phone numbers and individuals. From a privacy standpoint, the more computation is carried out on the server side, the less control users have, meaning centralised solutions always appear less respectful of privacy than distributed ones16 17. The possibility that, due to data accumulating centrally, an unethical company could commit an abuse, expand the purposes of the processing, or fall victim to a cyberattack, is another of the greatest threats posed by this type of solution.

DOES THIS DATA REPRESENT A SIGNIFICANT BENEFIT DURING THE PANDEMIC CRISIS?

Once again, it must be stressed that technical solutions cannot be considered in isolation. The success of this type of solution depends on many factors that have nothing to do with the technology. Firstly, a high number of users must be involved; some studies18 speak of at least 60% of a population, which, once children and the elderly are taken into account, amounts to nearly all mobile phone users. Secondly, it depends on a responsible declaration of one's personal infection status, ideally overseen by a professional to avoid disinformation. Finally, access to testing is essential, not only for all users, but so that information can be updated regularly and so that those notified of contact with an infected person can be tested promptly.

13 https://www.reuters.com/article/us-health-coronavirus-apps/bluetooth-phone-apps-for-tracking-covid-19-show-modest-early-results- idUSKCN2232A0 Bluetooth phone apps for tracking COVID-19 show modest early results

14 https://ec.europa.eu/health/sites/health/files/ehealth/docs/covid-19_apps_en.pdf Mobile applications to support contact tracing in the EU's fight against COVID-19. eHealth Network

15 https://github.com/DP- 3T/documents/blob/master/Security%20analysis/Privacy%20and%20Security%20Attacks%20on%20Digital%20Proximity%20Tracing

%20Systems.pdf Privacy and Security Risk Evaluation of Digital Proximity Tracing Systems. The DP-3T Project

16 Letter from the European Data Protection Board https://edpb.europa.eu/sites/edpb/files/files/file1/edpbletterecadvisecodiv- appguidance_final.pdf

17 European Commission communication: Guidance on mobile applications supporting the fight against the COVID-19 pandemic in relation to data protection https://eur-lex.europa.eu/legal-content/ES/TXT/PDF/?uri=CELEX:52020XC0417(08)&from=ES

18 https://science.sciencemag.org/content/early/2020/04/09/science.abb6936.full Quantifying SARS-CoV-2 transmission suggests epidemic control with digital contact tracing. Another clarifying reference is https://www.straitstimes.com/tech/google-launches-new-tool-to- help-public-health-officials-plan-social-distancing-measures

In the current situation in Spain and other European countries, it does not seem that these applications will succeed in the short term as a global strategy against the pandemic. Looking ahead, once the disease is much more under control, they could succeed within specific groups such as students at a particular school, employees of a company, or groups of friends who voluntarily decide to use the app. One can think of the analogy of WhatsApp groups that parents commonly share with other parents at their children's school, used, for example, to warn one another if a nearby child has an infection or head lice, with all the problems that entails.

VIII. IMMUNITY PASSPORTS

In some countries, use has begun to be considered of apps19 equivalent to what would be a passport or safe-conduct on paper, showing a colour code or a QR code on screen so that a guard or an access control system can decide whether to let the holder through. This process is similar to that used with airport boarding passes, except that instead of confirming a valid plane ticket or that a passenger is on a list, it reveals whether the holder is infected, or presumed20 immune from having had the illness.

DO THESE APPLICATIONS POSE A THREAT TO PRIVACY DURING THE PANDEMIC CRISIS?

These mobile applications anticipate what may become a future form of identity document on the phone, with the added risk of including and displaying health data, along with all the risks that stem from vulnerabilities in such systems: access by cybercriminals, cross-referencing with other data such as location, the addition of metadata, remote reading, or simply being out of reach of many people who cannot use smartphones.

Unlike a boarding pass, tests to determine whether a person is suffering from or has recovered from the illness should be carried out in person, and the healthcare staff performing them could provide the user with a paper certificate or any

19 https://www.bbc.com/mundo/noticias-52215521, https://nypost.com/2020/04/13/will-immunity-passports-be-the-ticket-out-of- coronavirus-lockdowns/ and https://www.infobae.com/america/ciencia-america/2020/04/01/que-son-los-pasaportes-de-inmunidad-del- coronavirus-covid-19-que-se-estudian-en-alemania-para-regresar-a-la-normalidad/ news on possible adoption of passports in China, Germany, Italy, Great Britain, the USA and Chile.

20 https://www.who.int/news-room/commentaries/detail/immunity-passports-in-the-context-of-covid-19 The WHO states there is not enough evidence for antibody immunity.

other low-tech means for it to be shown when required, along with their identity document. A mobile identity system can only be advantageous when registration can be done remotely or when the information it manages changes rapidly, as in the case of a digital wallet, which is not the case here.

DO THESE APPLICATIONS REPRESENT A SIGNIFICANT BENEFIT DURING THE PANDEMIC CRISIS?

The immunity passport incorporates sensitive data, as any health data is, but has also been given the role of serving as a safe-conduct for access. There are reports21 backing an advance in mobile health (mHealth) applications, allowing, for example, a patient to carry their medical history to show a doctor and receive treatment. Likewise, carrying out certain activities such as jobs or intense physical activities may require the candidate to show a medical certificate before being allowed access. A well-managed use of apps for certification or health records, kept up to date, secure and interoperable, will have some usefulness in specific settings, provided access to this information is limited to staff linked to fulfilling purposes related to public policies for pandemic control. However, as with all applications requiring the use of smartphones and evidence of a reliable infection or antibody test, we are far from reaching the whole population, so we can only ask about the benefits they might have in very specific settings.

IX. INFRARED CAMERAS FOR MASS TEMPERATURE READINGS In recent weeks, the debate over CCTV cameras with facial recognition has been overtaken by debate around another type of camera22 that adds the ability to take the temperature of individuals crossing an area, often without requiring any action on their part. These cameras use artificial intelligence algorithms to identify human faces, distinguish them from other elements in the image, and reveal each individual's approximate body temperature.

21 https://www.who.int/goe/publications/goe_mhealth_web.pdf. New horizons for health through mobile technologies. WHO 2011.

22 https://iberia.dahuasecurity.com/thermal/ Body temperature monitoring solution. One example.

DO THESE SYSTEMS POSE A THREAT TO PRIVACY DURING THE PANDEMIC CRISIS?

Spain's Data Protection Agency (AEPD) has already voiced23 its concern about the use of these devices and the need for prior guidance from the health authorities before they are installed. The use of cameras or other devices to record individuals' temperature involves processing special categories of data, which must respect the principles of lawfulness, purpose limitation and accuracy.

The thermal camera and the data it collects can only be understood as part of a broader process, and health data cannot be taken from a person and processed spontaneously by any manager of a public place simply because they believe it is best for their customers or users. In these cases, there is a risk of discrimination, stigmatisation and possibly the public disclosure of health data. All of this can be made worse by the risk of leaks of sensitive information and conflict with people who see the measure as an assault on their rights.

In some settings, such as occupational risk prevention regulations, taking a person's temperature could be useful within the framework of a broader process that includes other checks and additional safeguards which, in any case, respect the rights and freedoms set out in the GDPR.

DO THESE SYSTEMS REPRESENT A SIGNIFICANT BENEFIT DURING THE PANDEMIC CRISIS?

Fever is one of the most likely clinical signs associated with a symptomatic case of coronavirus24, but it should also be considered that the percentage of asymptomatic infections is high25 and that a high temperature can be associated with other conditions26. Applying these measures without criteria set by the health authorities regarding what fever reading is significant, which other symptoms should be checked, and with handling that may lack sufficient precision in the hands of unqualified staff, the use of these systems could create a false sense of security that facilitates contact with genuinely infected people.

X. CONCLUSION

This document has provided a brief overview of the main technologies proposed in the fight against the pandemic, without claiming to be an in-depth analysis of them, with the aim of compiling the options being used to control its spread.

Our society is at a critical turning point, not only because of the pandemic situation, but also in relation to how we approach the model of rights and freedoms. It is therefore essential to be especially careful when taking measures that may have irreversible consequences and may be driven solely by urgency, fear or, worse still, other interests.

23 https://www.aepd.es/es/prensa-y-comunicacion/notas-de-prensa/comunicado-aepd-temperatura-establecimientos AEPD statement regarding temperature checks by shops, workplaces and other establishments

24 https://www.thelancet.com/journals/laninf/article/PIIS1473-3099(20)30198-5/fulltext Clinical and epidemiological features of 36 children with coronavirus disease 2019 (COVID-19) in Zhejiang, China: an observational cohort study

25 https://www.medrxiv.org/content/10.1101/2020.02.03.20020248v2 Estimation of the asymptomatic ratio of novel coronavirus infections (COVID-19)

26 In addition to being easily masked through the use of fever-reducing medication https://www.noticel.com/ahora/20200406/tomaron- medicamentos-para-ocultar-fiebre-y-ahora-estan-hospitalizados-por-covid-19/

At this point, it should be recalled that information technologies cannot be understood in isolation, but always within the framework of a process with a defined objective. This process must implement an overall strategy based on scientific evidence, assessing its proportionality in relation to its effectiveness and efficiency, and objectively taking into account the organisational and material resources required. Furthermore, it must always be borne in mind that the principles set out in the General Data Protection Regulation (GDPR) must be complied with.