As governments around the world struggle to reconcile the health and economic exigencies of the COVID-19 pandemic with democratic freedoms and human rights, the idea of making human mobility and internal restrictions conditional on vaccination or other sources of immunity is being weighed and debated. McGill University law professor Ignacio Cofone addresses how and whether Canada should adopt “immunity passes”, as well as best practices for Canada’s contact tracing apps in this abridged piece based on his upcoming article for the Stanford Technology Law Review, Immunity Passports and Contact Tracing Surveillance (2021).

 

Ignacio Cofone

April 15, 2021

 

Within the range of policy responses designed to contain and manage the COVID-19 pandemic, mobile applications that certify immunity and trace close contacts are being used for the first time in human history. Unlike the response to prior health crises such as the Spanish flu a century ago, governments are now facing a pandemic equipped with data-driven technology to leverage tracing and identification efforts for containing spread.

Since early 2020, governments and private actors have developed contact tracing apps and digital immunity passes (also called immunity passports or digital vaccine certificates). Epidemiologists regard these enhanced, data-driven methods as instrumental to managing the spread of COVID-19. Contact tracing apps leverage prevention efforts because they are more effective than manual tracing. Digital immunity passes can exempt some citizens from COVID-19-related restrictions, allowing them to travel or, in some cases, engage in otherwise prohibited activities such as returning to work or school. As sectors of the population receive vaccines for COVID-19, these apps facilitate containment by certifying people’s immunity status.

I call immunity passes and contact tracing apps “containment apps” because they both use surveillance to contain the pandemic. Because of this characteristic, different containment apps introduce similar risks and social trade-offs, and thus call for similar best practices.

Contact tracing apps and immunity passes will remain a crucial measure until herd immunity can be reached, which the World Health Organization estimated will not happen for at least another year. Even with developed vaccines, COVID-19 containment efforts are far from over—particularly if sectors of the population refuse the vaccine. More importantly, every lesson learned from the COVID-19 pandemic will be useful for future global health crises. Containment may be necessary if new global diseases emerge due to climate change as polar ice caps melt and possibilities for zoonotic contagion increase. So, this moment is an opportunity to develop robust legal and policy frameworks that will be instrumental in the event that new highly contagious diseases emerge due to climate change.

But activists warn about the dangers of containment apps, particularly regarding the risks of on human rights resulting from their surveillance. The apps enable governments and private companies across the world to track and surveil citizens, and often involve collecting, combining, and analyzing highly sensitive data such as health data and location. Once the health crisis is over, there is no guarantee that surveillance will diligently roll back and no part of it will become a new normal—as it has been with measures against terrorism.

In order to curb containment-rationalized surveillance’s risks while maintaining functionality, containment apps generally rely on two safeguards: consent and anonymity. Regarding consent, the use of containment apps in most countries is meant to be completely voluntary. However, the consent guarantee comes with a caveat and a limit. The caveat is that, in privacy, consent does not guarantee that people’s rights will not be violated.  The limit is that, for any app, the extent to which expressed consent displays an informed choice is questionable. Given containment apps’ complexity and the number of unknowns about how the data could be aggregated and used, meaningful explanation rarely happens. Most apps have minimal explanations for their users, mostly focusing on reassuring a concern for users’ privacy.

To minimize unnecessary surveillance, most containment apps come with the promise to anonymize all personal information. But promises of anonymity in these data, when aggregated, are impossible to attain.  One can only remove personal identifiers from data, making that dataset de-identified, but any data can be re-identified with enough effort. Truly anonymous data does not exist.

But surveillance-produced privacy risks are not the end of the story. These apps present an enormously important additional risk due to the distribution of their surveillance: magnifying inequalities. The elderly living in care facilities, the homeless, migrants, refugees, and prisoners, all live in conditions that make them more likely to contract the virus; meanwhile, they lack the means that will also give them access to a device that can support an app to detect or report transmission or one to certify that they are immune. Those who are more vulnerable to the virus because of their living conditions are precisely those who are less likely to own a smartphone that can support these apps.

Creating new levels of digital divide, like these apps do, inevitably deepens existing inequalities. Immunity passes, currently under discussion in Canada, constitute an added layer of privilege in two ways. First, they will deepen inequalities between those with smartphones who have access to the app itself and those without. Those without will be excluded from part of the government’s containment strategy, particularly if the government were to develop other responses based on data from the apps that exclude them (such as identifying hot spots).

Second, they deepen inequalities between those with access to certified sources of immunity and those without. If based on private antibody testing, they become a mechanism for access to public life or travel available only to the wealthy. If based on proof of vaccination, immunity passes will trace the inequality inherent in vaccine distribution, which depends on how effective governments are at ensuring widespread distribution. These apps will deepen, not fix, the consequences of any mistake the government may make in not reaching marginalized communities.

Surveillance-produced privacy risks are not the end of the story. These apps present an enormously important additional risk due to the distribution of their surveillance: magnifying inequalities.

Many containment apps attempt to address these privacy and inequality risks, but they do so with varying success. Moreover, it is impossible for apps to eliminate all surveillance risks while remaining functional and useful.

Effective policy responses to the crisis require identifying the trade-offs inherent in these risks. That is, asking to what extent a specific contact tracing app may help containment efforts against the baseline of manual contact tracing and to what extent a concrete immunity pass will do so against the baseline of paper vaccine cards. Then, asking to what extent the app may impact the population’s privacy and equality rights. This approach can assist governments in developing digital containment policies that minimally encroach on privacy rights and equality efforts. As such, these policies may be more likely to be widely accepted, which is crucial to these apps’ efficacy.

For example, an immunity pass based exclusively on vaccines will have a lower impact on inequality than those that accept other certifications such as privately-taken antibodies testing. It will have a lower impact on inequality if implemented only after  vaccines are universally available. And it will have a lower impact on privacy if it avoids storing unnecessary information, and all information except the vaccination record is stored locally on each device.

Policymakers also have options that lead to different levels of encroachment on these rights when deciding to roll out contact tracing apps. First, some of them use GPS location data while others use Bluetooth proximity data. Bluetooth is less intrusive than GPS data: this method does not reveal a person’s location history and makes it more difficult to infer other personal information and to re-identify information. Second, some apps store collected data locally on each device to identify contacts, while others transmit all data to a central database. Centralizing all information is enormously consequential because it increases the re-identification risk significantly and it allows for inferring new information, exponentially increasing privacy risks. These options have enormous consequences, not only for privacy but also for discrimination and inequality.

The impossibility of removing all risks does not mean that provinces should not adopt containment apps. It means, rather, that these apps have drawbacks and limitations that prevent them from being a holy grail for containing the pandemic’s spread. It also means that it is productive for decision-makers—as it is for individuals—to have a clear picture of what the drawbacks are and how they can be addressed when making implementation decisions. Legislators and judges should be attentive to and deploy efforts to curb these risks, both at the federal and provincial levels.

A trade-off-based approach is also useful for individuals. Many do not use containment apps because they do not fully understand their privacy risks, or because they believe that policymakers have not addressed these risks appropriately. A fuller understanding of trade-offs can help people in their individual decision-making. Individuals can, for example, download a contact tracing app and selectively turn Bluetooth and GPS off to avoid disclosing information that they would rather not, make sure they understand the working of an app to weigh the costs and benefits of using it, and be judicious about drawing inferences about others based on app usage. Developing a nuanced approach based on containment apps’ trade-offs is useful for navigating a polarized debate.

Because contact tracing apps and immunity passes both rely on surveillance to monitor and contain the spread of the pandemic, they share key considerations regarding privacy and inequality. These apps present important benefits for containing the pandemic’s spread and reopening the economy. But their surveillance also introduces risks that must be considered—both at a policy level and at an individual level. The responsible reaction is to identify and mitigate them.

Ignacio Cofone is an Assistant Professor and Norton Rose Fulbright Faculty Scholar at McGill University Faculty of Law.