The EU and many Member States have been making progress towards contact tracing apps as part of the COVID-19 exit strategy, but the effectiveness of the measures may be hampered by a fragmented and uncoordinated approach.
At this point of the pandemic, it is clear that one of the main problems we have faced has been the collapse of health care systems. For this reason, while we wait for effective treatments or a vaccine against the virus, technology remains the best tool we have to allow societies to gradually go back to -relative- economic and social normality, while continuing working on prevention of further COVID-19 infections. We particularly refer to contact-tracing mobile applications, which are already being used in some Asian countries and will soon be available in Europe.
In this sense, serious concerns have been raised, for example, about the privacy boundaries or implementation approaches (centralized vs decentralized) of these technologies. This is not a minor issue: these criteria will determine whether the applications are effective to overcome the crisis or whether they are a collective failure.
There are many decisions to be made but, at this point, the dilemma most of the European governments are facing is whether to use the centralised (PEPP-PT) or the decentralised (DP3T) model.
Success or failure of this virus-tracking technology will depend to a great extent on the capacity of governments and public authorities to convey trust to their citizens. It is clear that, in the race to develop mobile tracing apps, both models must not only fully comply with the General Data Protection Regulation (GDPR), but they also must go beyond if we want to have a trust-worthy solution.
Contact tracing apps should also be interoperable with other national apps, allowing citizens’ mobility between states and, thus, providing an oxygen injection into the languishing tourism industry. Data must be used on a strictly temporary basis throughout the duration of the pandemic. And they ought to rely on the least intrusive technologies possible in order to win public support. For example, when it comes to traceability, end-to-end encryption between devices using Bluetooth would be preferable to permanent surveillance using geolocation.
The centralised model or PEPP-PT (Pan-European Privacy-Preserving Proximity Tracing) is a pan-European project which countries like Spain, Italy and France have embraced. With the current information available, the encrypted codes which our mobile phones exchange are stored on a central server managed by the health authorities (national or regional, as the case may be).
The decentralised system or DP3T (Decentralised Privacy-Preserving Proximity Tracing) is a protocol designed by universities and research centres from different countries to which Germany and the Netherlands, among others, have joined. It is decentralised because, throughout the day, each phone storages the encrypted codes exchanged with other phones which have the same application. If, and only if, one user registers in the application that he has tested positive in COVID-19, an alert is sent through a central server to those who may have been in proximity with this confirmed case.
The defenders of the first model believe it proves greater security against cyber-attacks: data is stored in a government database, not in the phone device, and the health authorities can rely on relevant information to define their epidemiological strategy. The defenders of latter say the decentralised approach offers users a higher degree of privacy, protecting them from hackers or the state itself revealing their social contacts.
Within this context, Google and Apple are working to develop a joint protocol which will allow health authorities of each country to develop compatible applications between the respective operating systems (Android and iOS). For the time being, all the indicators are that this protocol will pursue the path of the decentralised model, but it is still not clear if it will be compatible with the centralised one; a critical element for the joint functioning of every model used at a European level.
Every option has its pros and cons, all of them legitimate and defensible. But only one will allow us to regain the needed freedom of movement: the one that will guarantee interoperability while protecting the users’ privacy.
Otherwise, we could find situations in which a Spanish phone with the application can exchange data to detect COVID-19 cases with a French device, but it fails to do so with Danish or Dutch devices. Application interoperability is a basic health guarantee and the technological version of a Europe without borders. Without it, we are doomed to a practical dismantling of the borderless Schengen Area and sentenced to return to borders.
It is therefore imperative to claim for a collective effort on European coordination and to press for the European Union’s determination. The crisis is teaching us that, when we need it the most, Europe has no choice but to technologically depend on US companies and that Europe lacks sufficient capacity to swiftly and efficiently deploy its own traceability applications.
The future of Europe, therefore, involves an ambitious investment plan and a commitment to technological innovation. It relies on actively promoting the technology of leading European companies in 5G, artificial intelligence or Big Data. Urgent action is required and the time to act is now, without delay. Europe cannot afford to waste this opportunity.
Adrián Vázquez Lázara
MEP Ciudadanos / Renew, Chair, Committee on Legal Affairs