A decentralized approach of coronavirus contact-tracing apps is starting to gain ground in the privacy debate, within the EU and beyond after centralized solutions came under fire for both a lack of transparency in their software operations and potential risks linked to fundamental rights.


© NEC Corporation of America | Experts push decentralized Covid19 apps to gain trust
However, the European Commission and the EU's data protection watchdog back both centralized and decentralized models, as they recognize that the differences are not "completely clear".
"Deciding on models that are not clear is not something we should do on policymaking," said on the deputy director of the commission's directorate-general for communications networks and technology, Khalil Rouhana, in a videoconference Friday (24 April).
Yet, there seems to be an international consensus in favor of the decentralized approach.
A group of privacy-minded academics recently developed a fully-decentralized solution (DP3T) for coronavirus contact-tracing apps that keeps data on the user's handset - instead of sending it to a centralized database run by, for example, public health authorities.
Google and Apple have also teamed up to develop a decentralized framework for contact-tracing to allow developers to build Covid-19 tracing apps.
"The Google-Apple framework, inspired by DP3T, offers the best privacy-preserving solution while, at the same time, it offers a lot of flexibility, because the app is built by member states and public health authorities," said the vice president for engineering at Google, Dave Burke.
Both systems have a very similar structure and use Bluetooth to track who has been in contact with coronavirus patients since this technology does not reveal the user's identity or location data.
However, according to Michael Veale, co-developer of the DP3T solution, certain risks apply to all Bluetooth contact-tracing solutions (decentralized or not).
For example, if the building where a person lives has a very thin wall the system could interpret that this person has been in contact with his or her neighbor when this has not happened.
"This is because Bluetooth has not been designed by epidemiologists," said Veale, adding that his colleagues are still working on possible solutions to minimize these technical problems.

No trust?

Conversely, a group of academics and businesses have developed the PEPP-PT (Pan-European Privacy-Preserving Proximity Tracing) which seems to have opted for a centralized approach - and it is currently being implemented by German and Italian governments.
Also, the European People's Party (EPP) group recently mentioned this solution as one of "the technical possibilities to collect data anonymously and in accordance with existing EU data protection".
However, nearly 300 leading academics warned in an open letter that centralized contact-tracing apps can enable "unwarranted discrimination and surveillance", following the release of a report over PEPP-PT's concerns.
According to Gary Davis, who is the global director of privacy & law enforcement requests at Apple, "it is encouraging that a lot of academics support the DP3T model because it is support for the decentralized system which hopefully is the one that will encourage the user adoption, what it is required to make it [the apps] effective".
However, the fact that a centralized system can be misused is likely to undermine the uptake of the use of this technology, although its effectiveness is still not conclusive for many privacy advocates.

High contagion, many asymptomatic

"There is little evidence available today that would indicate that contact-tracing apps would help curve the spread of the virus. In the context of Covid-19, it is quite difficult to trace contact because this virus involves a high rate of contagion and many infected patients are asymptomatic," warned Estelle Mass, a senior policy analyst at NGO Access Now.
"We always must consider the long-term of any decision that is taken during this crisis. When some technologies are deployed is very difficult or, in some cases, impossible to go back," she added.
Liberal MEP Sophie in 't Veld, from the parliament's committee on civil liberties, has called on the commission to develop a clear legislative framework in addition to the guidelines already announced.
"This [issue] is not only about privacy and data protection, but it is also about harmonization, interoperability, and field of play for providers, among other things," she said.
Additionally, MEPs are expected to discuss the ethical and practical implications of coronavirus contact-tracing apps during the plenary in May.

This article was originally published by EUobserver.
Previous Post Next Post