Balanced mobile data initiatives are vital in the COVID-19 fight

Governments need real-time data to help prevent the spread of the coronavirus, but may baulk at longer-term privacy battles. Workable options are possible, but officials must act now to enact them.

Covid data

Governments need real-time data to help prevent the spread of the coronavirus, but may baulk at longer-term privacy battles. Workable options are possible, but officials must act now to enact them.

Data-powered decisions

As more governments introduce nationwide lockdowns to prevent the spread of coronavirus, what data are – and should – they be analyzing to inform vital decisions about public health? Following World Health Organization recommendations to ‘test, test, test’, one key source of data comes from test results*, helping officials measure confirmed cases and track the treatment of those already classified as infected. Politicians then vary their public health measures according to the geography and demographics of infected populations.

But most of these measures are reactive, catching up with infection at a comparatively late stage. Officials are taking some precautionary measures, such as isolating higher-risk individuals and requiring citizens to stay at home, but they may only be able to enforce these measures for a limited time.

As governments attempt to ‘flatten the curve’ longer-term, what data other than test data can they can examine and exploit? Several governments have tried to analyze other countries’ actions in this area to assess what worked and what didn’t. But acting on this information is not necessarily straightforward. While the ultimate goal across regions is the same – to delay and defeat the virus – regulatory room to maneuver will differ.

Location data: panacea vs. privacy

One key strategy in fighting the virus is to stay ahead of it using real-time information, and to act as quickly as possible to control the spread and manage available resources, such as hospital beds and ventilators. According to scientists at the Big Data Institute at Oxford University, mobile phone location data is the best source of data governments can use to control the epidemicResearch shows that people can spread the virus more before they exhibit symptoms, so knowing where they have been before they were classified as infected can be a vital factor in containing the spread.

Governments in countries such as China, South Korea, Taiwan and Singapore are using mobile location data to track infected individuals and those they may have been in contact with, and then immediately quarantining them. According to some reports, officials in the UK and the US are already discussing similar initiatives with telecommunication providers.

In these and other regions, however, the use of mobile data has privacy implications. In Europe, the European Data Protection Board (EDPB) has released a statement explaining that – in the public interest – GDPR allows the processing of personal data during epidemics without the need for consent. Nonetheless, the EDPB also emphasizes that other rules are in place to cover the processing of mobile location data. The European Union’s ePrivacy Directive states that operators can use location data only when it’s been anonymized, or with individuals’ consent. When this is not possible, the directive allows countries to introduce new measures to protect public safety (and share data in such a way that individuals can be identified), provided safeguards are in place (such as granting people the right to ‘judicial remedy’ and legal recourse**).

Both options can have problematic consequences. Governments (like those in Italy and Austria) analyze aggregated data, to get a general idea if people are self-isolating, but this compromises the depth of insight they can achieve. Alternatively they can draft emergency bills (with possible safeguards) that help them pull in better quality data, but with the potential for many complaints over privacy breaches and even years of legal action.

Strike a balance, now

Many European governments could baulk at the second option, given its potential timescale and cost. Assuming they do, they have two alternative routes they could take if they want to use individuals’ location data to slow the spread of coronavirus:

  • Take the lead from countries like Singapore, which has released an app via which people can give consent for their location data to be shared as part of the fight against the virus (something similar is being worked on in the UK). With the right campaign, governments could encourage millions to participate. However, in some European countries limited smartphone ownership could reduce the overall effectiveness of app-based data, and the penetration of smartphones is significantly lower in older, higher-risk groups***. Similarly, those in poorer areas are likely to be higher-risk but less likely to have smartphones – potentially skewing the data, and any remediation attempts, toward better-off areas.
  • Consider anonymizing data by either encrypting it or removing identifiable information. Techniques such as character masking and pseudonymization**** could offer anonymity and enable researchers to track movement in something close to real time, and data need only be stored for a limited time (two or three weeks, for example). Some initiatives along these lines are emerging, such as Private Kit: Safe Paths in the US, or ProteGO Safe in Poland. So far, however, as with the app approach, all these ideas rely on the assumption that people have access to smartphones.

An alternative is a combination of these two approaches, which the government in Slovakia may already be putting into practice. The country has passed a bill that establishes a monitoring system for people in quarantine (those already infected and visitors from abroad), with their consent. The data will be stored in the system for up to six hours and will only be available to Slovakia’s Public Health Authority. The bill can be enacted if the country declares a state of emergency, and will be in force until the end of 2020.

While governments focus on reducing the number of infections by introducing lockdowns, dedicated specialists should work on a digital-tracking approach that reaches as many people as possible while protecting their privacy at the same time. As some officials have pointed out, digital tracking is a lower priority in most countries while people are confined to their homes – but its value will increase significantly when lockdown measures are lifted, helping to prevent a second wave of infection like that happening in China and Singapore.

An increase in digital tracking also means that technology-related risks could rise, making this a crucial time for risk technology experts. Once developed, tracking models will have to be validated and stress-tested, and data must be protected against breaches (which have already increased since the coronavirus outbreak). Researchers must be able to audit data to track changes in the system, and edit it to correct errors that might mistakenly flag individuals as at-risk or healthy. The scale of the project could make this a data integrity and control challenge unprecedented in terms of size and speed. Building a resilient system takes time, but the urgency of the situation means that governments must act now to find ways to access and analyze near- to real-time data.

* To some extent, however, this depends on how much testing is going on. Usually, the more testing taking place, the more confirmed cases there are.

** '...[t]he manner in which a right is enforced or satisfied by a court when some harm or injury, recognized by society as a wrongful act, is inflicted upon an individual.'

*** According to estimates, 96% of adults in the UK used a mobile phone in 2018, whereas 79% of UK adults had smartphones in 2019Usage decreases with age after the age of 34.

**** The technique of replacing an identifier with an unrelated but unique value (replacing 'Jane Doe' with '873410578', for example).

Further reading

Points of View are short articles in which members of the Chartis team express their opinions on relevant topics in the risk technology marketplace. Chartis is a trading name of Infopro Digital Services Limited, whose branded publications consist of the opinions of its research analysts and should not be construed as advice.

If you have any comments or queries on Chartis Points of View, you can email the individual author, or email Chartis at info@chartis-research.com.

Only users who have a paid subscription or are part of a corporate subscription are able to print or copy content.

To access these options, along with all other subscription benefits, please contact info@risk.net or view our subscription options here: http://subscriptions.risk.net/subscribe

You are currently unable to copy this content. Please contact info@chartis-research.com to find out more.

You need to sign in to use this feature. If you don’t have a Chartis account, please register for an account.

Sign in
You are currently on corporate access.

To use this feature you will need an individual account. If you have one already please sign in.

Sign in.

Alternatively you can request an individual account here.