Mobile device is typically able to determine its position to an accuracy of between 7 and 13 metres (in urban areas), whereas Covid-19 seems to spread between people who are within a 1-metre distance. Moreover, cross-referencing individual location data typically requires building and maintaining centralised databases of personal data, which poses significant privacy and cybersecurity challenges.
Alternatively, contact tracing can be done automatically using Bluetooth – a wireless technology for short distance data exchange. This method allows data about mobile phones in close proximity to be collected and risk alerts to be sent when the owner of a given phone has been diagnosed positive.
China obliges citizens to use an app that tracks their movement. The Alipay Health Code system combines location data and other information (e.g. a health survey) to score persons based on their contagion risk, and restrict mobility. Taiwan rolled out a phone-based electronic fence that monitors individuals’ movements and alerts police if quarantine is not respected. In Hong Kong, persons who have been placed in quarantine must carry a location-tracking wristband. South Korea has launched an app to monitor people on lockdown and uses a public database of known patients (with additional information about their age, gender, occupation, and travel routes). In Thailand, people arriving at airports are obliged to download an app to help monitor their movements.
Singapore launched a contacttracing app, TraceTogether, which uses Bluetooth technology to keep a log of nearby devices. Data is encrypted and stored on the device, and persons who become symptomatic can voluntarily upload it (in pseudo-anonymised format) into a database, which the Ministry of Health uses to notify the owners of devices which have been pinged by the infected person’s phone. Israel adopted emergency regulations to allow security services to track the movements of people suspected or tested positive for the virus. It has also launched an app to track users’ movements and cross-reference the information with data on infection cases. Russia entrusted its Ministry of Communications to develop a mobile-based contact tracing system to help monitor the spread of the virus. The app will request access to users’ calls, location, camera, storage, network information and other data. In Iran, the Ministry of Information and Communications Technology developed an app to monitor individuals’ location and collect a wide range of other data, such as mobile number, name, and gender. In the United Kingdom, it is reported that the government is discussing with BT, the owner of one the biggest mobile operators in the country, about using phone location and usage data to monitor the effectiveness of social distancing measures. Similar discussions are taking place in the United States of America between the government and the tech industry, and reports have confirmed that government agencies have started using mobile advertising data to track the spread of the virus. Iceland has launched a voluntary app that tracks users’ movements in order to help with contact tracing in Covid-19 cases.
Situation in EU Member States
France has not taken any concrete initiative on location tracking, but it has been reported that the government is reflecting on a strategy for the digital identification of people who have been in contact with infected persons. Mobile operator Orange confirmed that it has started sharing aggregate and anonymised geolocation data with Inserm, a public research institute fully dedicated to human health, to enable them to ‘better anticipate and better manage the spread of the epidemic’. Germany is exploring introducing an app for tracking new infections and tracing contacts. According to a spokesperson for the Interior Ministry, Germany does not plan to ‘evaluate and track cell phone data nationwide’. The German Justice Minister Christine Lambrecht affirmed that tracking apps to help tackle Covid-19 could only be used voluntarily. Deutsche Telekom announced that it was sharing anonymised location data of its users with the Robert-Koch Institute, a research institute and government agency responsible for disease control and prevention. In its guidelines, the Federal Data Protection Authority emphasised the sensitivity of personal data in the context of Covid-19 and reiterated the need to comply with data protection principles.
Spain is planning to use mobile phone location data to track people’s movements in order to assess adherence to lockdown measures. A study known as ‘DataCovid’ will be carried out by the national statistics institute in cooperation with the country’s main telecoms operators. It is reported that the Ministry of Health also intends to use location data to launch an app which will alert users to carry out a self-assessment. Such tracking apps have already been released in Catalonia and Madrid.
eHealth EU toolbox: The essential requirements which should be: voluntary; approved by the national health authority; privacy-preserving (personal data should be securely encrypted); and dismantled as soon as no longer needed. The Commission recommends the use of voluntary apps and the use of Bluetooth communications between devices to determine proximity because this ‘appears more precise, and therefore more appropriate, than the use of geolocation data’ and because this functionality ‘avoids the possibility of tracking’.
The European Data Protection Supervisor (EDPS) Statement of 19 March
- ‘Emergency is a legal condition which may legitimise restrictions of freedoms provided these restrictions are proportionate and limited to the emergency period’.
- ‘If such measures are introduced, a Member State is obliged to put in place adequate safeguards, such as granting individuals the right to judicial remedy’.
- Public authorities should first seek to process location data in an anonymous way. Member States are obliged to put in place adequate safeguards, such as providing individuals of electronic communication services the right to a judicial remedy.’ The processing of historical non-anonymised location data is an invasive measure that could be considered proportional only under exceptional circumstances. Such measures need to be subject to ‘enhanced scrutiny and safeguards to ensure the respect of data protection principles (proportionality of the measure in terms of duration and scope, limited data retention and purpose limitation)’.
- Before rolling out such digital solutions, there is a need to carefully assess their technological readiness, effectiveness and implications on fundamental rights. There are both legal and technological limits with regard to using location data, in particular when this involves the systematic tracking of individual movements.
- Anonymised and aggregate location data is preferable to individual monitoring. Location tracking using mobile applications and alternative solutions based on Bluetooth signals may support contact tracing efforts to identify people at risk. Upholding fundamental rights standards and adopting effective and transparent public policies are key to ensuring public trust.