Logo Assembly Logo Hemicycle

Contact tracing applications: ethical, cultural and educational challenges

Doc. 15648: compendium of written amendments | Doc. 15648 | 24/01/2023 | Final version

Compendium index

Amendment 1 Amendment 2 Amendment 3 Amendment 4 Amendment 5 Sub-amendment 1 to amendment 5 Amendment 6 Sub-amendment 1 to amendment 6 Amendment 7 Sub-amendment 1 to amendment 7 Amendment 8 Sub-amendment 1 to amendment 8 Amendment 9 Sub-amendment 1 to amendment 9 Amendment 10

Caption: AdoptedRejectedWithdrawnNo electronic votes

ADraft Resolution

1The Parliamentary Assembly notes that over the past two years, data collection and processing by using digital public health technologies, such as contact tracing applications (CTAs), have been promoted worldwide by governments as well as private companies to mitigate the Covid-19 pandemic, identify subjects at risk of contamination or ensure compliance with confinement rules.
2In May 2020, the World Health Organisation (WHO) issued guidelines for their use and related ethical considerations. The Consultative Committee established by the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No. 108, Convention 108), the Data Protection Commissioner and the Committee on Bioethics of the Council of Europe, also issued several statements, raising concerns and providing useful guidelines. The Council of Europe 2020 Data Protection Report highlighted that, by adopting widely diverging systems, countries have limited the efficiency of the measures taken and the influence they could have exercised on actors in the digital market.
3CTAs and countless other health, lifestyle and wellness applications are available in app stores; their ethical and legal frameworks remain unclear, with risks related inter alia to unlawful interference with the right to a private life.

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 71 in favor 3 against 6 abstentions

In the draft resolution, paragraph 3, delete the following words:

"and countless other health, lifestyle and wellness applications".

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 84 in favor 0 against 4 abstentions

In the draft resolution, paragraph 3, replace the words "right to a private life" with the following words:

"right to respect for private life, protected under Article 8 of the European Convention on Human Rights (ETS No. 5), as well as specifically through the guarantees set out in Convention 108 and its amending Protocol (CETS No. 223), Convention 108+. Respecting the confidentiality of health data is a vital principle in the legal systems of all States Parties to the European Convention on Human Rights. In particular, in order to respect the right to private life in Article 8 of the Convention, domestic law must afford appropriate safeguards to prevent the inappropriate communication or disclosure of personal health data."

4These applications need to be evaluated carefully and public authorities must monitor their implementation to ensure compliance with the data protection standards laid down by Convention 108 and its modernised version, by its amending Protocol (CETS No. 223, Convention 108+).

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 90 in favor 0 against 2 abstentions

In the draft resolution, at the beginning of paragraph 4, add the following words:

"In its Resolution 2338 (2020) "The impact of the Covid-19 pandemic on human rights and the rule of law", the Assembly noted that "a lack of public trust in such apps due to privacy-related concerns, resulting in low levels of installation or use, would seriously undermine their effectiveness". Hence,".

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 92 in favor 0 against 4 abstentions

In the draft resolution, paragraph 4, before the words "the data protection standards" add the following words:

"the right to private life and with".

5The Assembly stresses that the collection and processing of personal and health data must be justified by legitimate public health objectives and be suitable and proportionate to achieving the intended goal. The data collected via these applications should not be accessible to third parties that are not involved in public health management. Data collection and processing must be transparent and concise, and reader-friendly information on the purpose of data collection, data storage and sharing must be easily available. Decisions on downloading and using applications must remain voluntary and respect personal autonomy. Discrimination due to the digital divide should be avoided. Furthermore, data protection authorities must be involved in the development, oversight, and audit of digital contact tracing systems.

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 95 in favor 0 against 3 abstentions

In the draft resolution, paragraph 5, after the third sentence, add the following sentence:

"Data should not be retained unless necessary for a legitimate purpose, and should only be retained to the extent and for the duration necessary."

24 January 2023

Tabled by the Committee on Culture, Science, Education and Media

Votes: 92 in favor 0 against 3 abstentions

In Amendment 5, delete the words:

"should not be retained unless necessary for a legitimate purpose, and"

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 101 in favor 0 against 2 abstentions

In the draft resolution, paragraph 5, after the fourth sentence, add the following sentence:

"Specific care must be taken in the design and application of these applications to ensure respect for the rights of the child, adequate safeguarding of children, and in particular the rights of children to privacy and to have their personal data protected."

24 January 2023

Tabled by the Committee on Culture, Science, Education and Media

Votes: 97 in favor 0 against 1 abstention

In Amendment 6, replace the words "respect for the rights of the child, adequate safeguarding of children, and in particular the rights of children to privacy and to have their personal data protected." with the following words:

"adequate safeguards for children, and in particular respect for their rights to privacy and the protection of their personal data."

6The effectiveness of such digital technologies largely pertains to the technical designs, implementation methods and the level of public trust. Therefore, the Assembly considers that the lack of citizens’ involvement in the debate may explain the low adoption rates of the available applications in many Council of Europe member States. In this respect, Resolution 2333 (2020) and Recommendation 2176 (2020) “Ethics in science and technology: a new culture of public dialogue” highlighted that it is essential to involve the general public in decisions which highly impact on their lives, especially during crises.
7Digital epidemic surveillance is – and should only be – intended to prevent forward transmission and break the chains of infection. However, to date substantial scientific evidence of CTAs’ impact and effectiveness remains relatively limited.
8CTAs which have been developed in most European countries do not collect identifiable health data, at least not without explicit consent; moreover, sensitive health-related information, including when collected via manual contact tracing (for example in testing centres) cannot be shared with third parties, including the scientific community, without consent.

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 105 in favor 0 against 1 abstention

In the draft resolution, at the end of paragraph 8, add the following sentence:

"As with other, particularly digital, forms of data processing, it is important that consent is freely given, specific, informed and unambiguous – this includes ensuring adequate transparency in how data is being used."

24 January 2023

Tabled by the Committee on Culture, Science, Education and Media

Votes: 102 in favor 0 against 3 abstentions

In Amendment 7, delete the words:

"– this includes ensuring adequate transparency in how data is being used"

9While this approach serves the purpose of protecting privacy, the fact that contact tracing and testing datasets cannot be processed and combined without citizens’ consent may hinder the ability of governments to analyse aggregated data, including user demographics or temporal, spatial and public health impact trends of CTA usage and exposure notifications.
10The Assembly stresses that a timely and accurate assessment of the CTAs’ public health impact is a key prerequisite of an effective public health policy. A continuous quality improvement of public health processes and interventions is essential. In particular, digital epidemic surveillance must respond to an evolving situation, taking into account the changing transmission and immune-evasion properties of a virus.
11Data protection standards must be considered as an advantage in conditions of uncertainty such as a pandemic. However, these regulations must be interpreted in a way that allows for detailed data collection, with the appropriate safeguards. A right balance between data protection standards and health impact assessments must be struck not only to help fight the current pandemic but also to design future technology aimed at tackling future health crises.

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 101 in favor 0 against 2 abstentions

In the draft resolution, in paragraph 11, replace the last two sentences with the following sentences:

"However, these standards must be applied in a way that allows for necessary data collection provided that the appropriate safeguards are present. The right balance between data protection standards and public health objectives must be struck not only to help fight the current pandemic but also to design future technology aimed at tackling future health crises."

24 January 2023

Tabled by the Committee on Culture, Science, Education and Media

Votes: 104 in favor 0 against 2 abstentions

In Amendment 8, replace the words "necessary data collection" with the following words:

"the collection and use of sufficiently detailed data when this is necessary for the public health objectives, and"

12The Assembly believes that technology can make a significant contribution to the promotion of public interests only by ensuring a careful balance of all interests at stake and by carrying out an in-depth assessment of the risks posed to human rights and fundamental freedoms in a democratic society.
13To that end, the Assembly calls on Council of Europe member States to:
13.1ensure that recourse to digital public health technologies is part of a comprehensive national epidemiologic strategy, articulated in different tools, balancing all interests at stake and based on an appropriate evaluation of its real impact and effectiveness;
13.2monitor the implementation of these new technologies as well as their compliance with data protection standards, and ensure that the collection and processing of personal and health data are justified by legitimate public health objectives and are adequate and proportionate to achieving the intended goal;

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 100 in favor 0 against 1 abstention

In the draft resolution, paragraph 13.2, replace the words "and are adequate and proportionate to achieving the intended goal", with the following words:

", are adequate and proportionate to achieving the intended goal, and that such data is only retained to the extent and for the duration necessary for those objectives;"

24 January 2023

Tabled by the Committee on Culture, Science, Education and Media

Votes: 97 in favor 0 against 1 abstention

In Amendment 9, replace the words ", and that such" with the words:

"; this also implies that such"

13.3consider the possibility of voluntary data donorship for contact tracing applications or other future technologies, which includes an opt-in for users who would like to consent to have their personal data anonymised and processed to collect evidence for scientific research and impact assessment, with appropriate safeguards to preserve privacy;

24 January 2023

Tabled by the Committee on Legal Affairs and Human Rights

Votes: 101 in favor 0 against 2 abstentions

In the draft resolution, at the end of paragraph 13.3, add the following words:

"and to ensure consent is freely given, specific, informed and unambiguous;"

13.4keep the public well informed about public health interventions, in particular regarding the impact and effectiveness of new digital technology, including via parliamentary hearings and public information campaigns, with a view to raising citizens awareness, building citizens’ trust and strengthening the effectiveness of new technology;
13.5counter negative attitudes or low interest in the population through systematic, targeted information campaigns, both through the media and with civic initiatives in schools, that are context-specific, based on science, address doubts and concerns raised, debunk disinformation and highlight individual and collective responsibility for one’s own health as well as other people’s health;
13.6encourage voluntary access to CTAs in resource-limited settings, for example through reduced mobile data costs, higher availability of and compatibility with low-cost devices and conditions facilitating the use of CTAs such as a help function, a tutorial, or testimonials of other users;
13.7initiate, if not done yet, and promote globally the signature and ratification of the Convention for the protection of individuals with regard to automatic processing of personal data (Convention 108) as amended by the Protocol CETS No. 223 (Convention 108+) which certainly contributes to the convergence towards a set of high-level standards in the area of the protection of privacy and personal data.
14The Assembly resolves to enhance co-operation with the Consultative Committee established by the Convention 108 to share best practices regarding the implementation of privacy and data protection principles and rules in public interest areas, and to identify areas of possible joint actions to raise awareness on, and enhance compliance with, international standards in the field.
15The Assembly also encourages the European Union to continue developing co-ordinated solutions at European and international levels, including beyond the European Union, to promote safe international travel and global control of the Covid-19 pandemic as well as future threats to public health.