NEW YORK, NEW YORK - MAY 13: Two women wearing masks pass each other while crossing the street amid the coronavirus pandemic on May 13, 2020 in New York City. COVID-19 has spread to most countries around the world, claiming over 297,000 lives with over 4.4 million cases. (Photo by Alexi Rosenfeld/Getty Images)
Too close for comfort: fears about use of personal data potentially deter some mobile phone users from downloading track and trace apps © Getty

Governments racing to find new technologies that will keep citizens safe from coronavirus are pinning much of their hope on contact-tracing apps and health-monitoring tools. The aim is to identify individuals at risk of infection and to trace chains of infected people.

Yet privacy questions surround such tech tools, including the extent to which individuals’ personal data is at risk of becoming public or used for mass surveillance.

Marietje Schaake, international policy director of Stanford University’s cyber policy centre, pointed to privacy risks linked to innovations responding to the pandemic, when she spoke last week at the FT’s Global Boardroom online conference.

“This is a test of how much the democracies of this world will be prepared to stand up for individual rights and freedoms,” she said. “I have a worry that the concerns about the crisis will ‘wipe over’ this.”

The development raises questions of legal rights and protections. Lawyers are rising to the privacy challenge as part of the FT’s legal hackathon, in which more than 2,500 participants from 70 countries have collaborated online to try to solve urgent problems arising from the coronavirus pandemic.

The hackathon started on April 27 online and will run until May 22. Organised by Global Legal Hackathon (GLH), and supported by FT Innovative Lawyers, the hackathon brings together legal professionals, software developers, designers and businesspeople to develop answers to problems trigged by the pandemic.

Of the 272 projects currently under way in the hackathon, several aim to develop ways to help companies and individuals adapt to a post-Covid-19 world without compromising their right to privacy.

“Privacy is a personal right, we believe it should be protected,” says Elsa Mikaelian, a trainee solicitor in London at international law firm Herbert Smith Freehills.

One area of concern is contact-tracing apps, which use location to alert mobile phone users if they have come into contact with someone infected.

Many governments want the apps to help them identify affected individuals and clusters. But privacy terms and conditions of apps present two important challenges, says Ms Mikaelian. Some users will skip reading them because the details are difficult to digest. Equally, others want clear, firm reassurances on how their data will be used before they are prepared to download such an app.

Mandatory Credit: Photo by LAURENT GILLIERON/EPA-EFE/Shutterstock (10623380d)
A smart phone app using Decentralized Privacy-Preserving Proximity Tracing (DP-3T) is pictured before a test with Swiss soldiers at the Swiss Federal Institute of Technology (EPFL) during the state of emergency of the coronavirus disease (COVID-19) outbreak, in Lausanne, Switzerland, 24 April 2020. Secure contact tracing could be a powerful tool to fight the spread of COVID-19. A unique, decentralized system developed as part of an international consortium, including EPFL and ETH Zurich, will soon be launched with the support of the Swiss Federal Office of Public Health. DP-3T proposes a secure, decentralized, privacy-preserving proximity tracing system based on the Bluetooth Low Energy standard. Its goal is to simplify and accelerate the process of identifying people who have been in contact with someone infected with the SARS-CoV-2 virus.
Swiss army tests proximity tracing app, Lausanne, Switzerland - 24 Apr 2020

To help explain privacy policies quickly and clearly to users, the seven-strong hackathon team, all from HSF, turned to visualisation techniques, such as pictograms or flowcharts. “We want to make sure the public is aware of what their rights are in relation to their data, and how data is handled,” she says.

The main challenge for the team during the hackathon has been keeping track of the fast-changing landscape of contact-tracing apps. Team members check every morning, sharing relevant articles through the chat function on Microsoft Teams. The experience has taught them that privacy policies will need to be reviewed frequently over time.

While this is a coronavirus-specific project, Ms Mikaelian points to the broader application of the visual tools: “More generally we want to help people pay more attention to privacy policies and their implications — to make T&Cs, privacy conditions, and contracts more accessible for the general public.”

At telecoms company Vodafone, after observing some of the drawbacks of contact-tracing apps highlighted by users and experts, lawyer Bernadette Gooding and her team focused on creating a company-specific app. “It’s a track and trace Covid-19 app for employers to trace their employees,” says Ms Gooding, legal counsel at Vodafone Business. “Employees already trust their employers with their data, so we thought, how can we take this further?”

The app is designed to be active only when an employee is on-site at work; if a worker starts showing symptoms the app will log it. While statistical data could be shared with governments to help identify Covid-19 hotspots, the personal data collected by the app would remain with the employer, which would protect the employee’s privacy rights as usual.

Ms Gooding says the hackathon has been an opportunity to be creative and for the team to contribute their skills to tackling the crisis: “We would never have come up with this idea if it wasn’t for this process . . . And even if we had the idea, we never would have worked it up into a viable proposition.”

As organisations everywhere generally become stricter and more intrusive about checking personal data for safety reasons, there is a risk that they all try to do so in myriad, confusing ways.

Various activities — such as visiting a workplace for a meeting, catching a train or joining a gym — will now require individuals to provide more personal information about their health in more detail, says Alejandro Sánchez del Campo, counsel for start-ups and open innovation at law firm Garrigues in Madrid. His team is creating an app, called My G Form, to standardise such information requests and to give individuals better control of their data.

“In future we will have to exchange more information — medical, professional — so, can we do this in a simpler and more secure way? We want to create a standard for [deciding] which information should be shared.”

Visiting a house to buy or rent, for example, might require people to reassure each other on their health. “Exchanging information through this app will help both parties . . . I know the person is going to come and they are safe, as I have their information,” says Mr Sánchez del Campo.

He leads a team of 12 on the hackathon project, all at Garrigues but from a range of areas of the firm. They use an online collaboration platform and catch up for 20 minutes daily. Some are lawyers, but the contributions from Garrigues’s marketing and technical teams have also been beneficial, he says.

Early on in the hackathon process, for instance, the team had promising initial ideas but struggled to progress to the next stage.

“The most difficult thing was trying to imagine the solution: should it be an app, or something else? Should it be free or premium? It’s harder than expected to create something from scratch,” says Mr Sánchez del Campo. Then one participant from the communications team came up with a visual tool to show how it would work.

“We are learning so much from the hackathon,” he says. “It’s like a sandbox to try new ideas, new concepts and new ways of working.”

Copyright The Financial Times Limited 2024. All rights reserved.
Reuse this content (opens in new window) CommentsJump to comments section

Follow the topics in this article