Logo Assembly Logo Hemicycle

Contact tracing applications: ethical, cultural and educational challenges

Resolution 2478 (2023) | Provisional version

Parliamentary Assembly
Assembly debate on 25 January 2023 (5th sitting) (see Doc. 15648, report of the Committee on Culture, Science, Education and Media, rapporteur: Mr Duncan Baker; and Doc. 15660, opinion of Committee on Legal Affairs and Human Rights, rapporteur: Mr Vladimir Vardanyan). Text adopted by the Assembly on 25 January 2023 (5th sitting).
1. The Parliamentary Assembly notes that over the past two years, data collection and processing by using digital public health technologies, such as contact tracing applications (CTAs), have been promoted worldwide by governments as well as private companies to mitigate the Covid-19 pandemic, identify subjects at risk of contamination or ensure compliance with confinement rules.
2. In May 2020, the World Health Organisation (WHO) issued guidelines for their use and related ethical considerations. The Consultative Committee established by the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No. 108, Convention 108), the Data Protection Commissioner and the Committee on Bioethics of the Council of Europe, also issued several statements, raising concerns and providing useful guidelines. The Council of Europe 2020 Data Protection Report highlighted that, by adopting widely diverging systems, countries have limited the efficiency of the measures taken and the influence they could have exercised on actors in the digital market.
3. CTAs are available in app stores; their ethical and legal frameworks remain unclear, with risks related inter alia to unlawful interference with the right to respect for private life, protected under Article 8 of the European Convention on Human Rights (ETS No. 5), as well as specifically through the guarantees set out in Convention 108 and its amending Protocol (CETS No. 223), Convention 108+. Respecting the confidentiality of health data is a vital principle in the legal systems of all States Parties to the European Convention on Human Rights. In particular, in order to respect the right to private life in Article 8 of the Convention, domestic law must afford appropriate safeguards to prevent the inappropriate communication or disclosure of personal health data.
4. In its Resolution 2338 (2020) “The impact of the Covid-19 pandemic on human rights and the rule of law”, the Assembly noted that “a lack of public trust in such apps due to privacy-related concerns, resulting in low levels of installation or use, would seriously undermine their effectiveness”. Hence, these applications need to be carefully evaluated and public authorities must monitor their implementation to ensure compliance with the right to private life and with the data protection standards laid down by Convention 108 and its modernised version, Convention 108+.
5. The Assembly stresses that the collection and processing of personal and health data must be justified by legitimate public health objectives and be suitable and proportionate to achieving the intended goal. The data collected via these applications should not be accessible to third parties that are not involved in public health management. Data collection and processing must be transparent and concise, and reader-friendly information on the purpose of data collection, data storage and sharing must be easily available. Data should only be retained to the extent and for the duration necessary. Decisions on downloading and using applications must remain voluntary and respect personal autonomy. Specific care must be taken in the design and application of these applications to ensure adequate safeguards for children, and in particular respect for their rights to privacy and the protection of their personal data. Discrimination due to the digital divide should be avoided. Furthermore, data protection authorities must be involved in the development, oversight, and audit of digital contact tracing systems.
6. The effectiveness of such digital technologies largely pertains to the technical designs, implementation methods and the level of public trust. Therefore, the Assembly considers that the lack of citizens’ involvement in the debate may explain the low adoption rates of the available applications in many Council of Europe member States. In this respect, Resolution 2333 (2020) and Recommendation 2176 (2020) “Ethics in science and technology: a new culture of public dialogue” highlighted that it is essential to involve the general public in decisions which highly impact on their lives, especially during crises.
7. Digital epidemic surveillance is – and should only be – intended to prevent forward transmission and break the chains of infection. However, to date substantial scientific evidence of CTAs’ impact and effectiveness remains relatively limited.
8. CTAs which have been developed in most European countries do not collect identifiable health data, at least not without explicit consent; moreover, sensitive health-related information, including when collected via manual contact tracing (for example in testing centres) cannot be shared with third parties, including the scientific community, without consent. As with other, particularly digital, forms of data processing, it is important that consent is freely given, specific, informed and unambiguous.
9. While this approach serves the purpose of protecting privacy, the fact that contact tracing and testing datasets cannot be processed and combined without citizens’ consent may hinder the ability of governments to analyse aggregated data, including user demographics or temporal, spatial and public health impact trends of CTA usage and exposure notifications.
10. The Assembly stresses that a timely and accurate assessment of the CTAs’ public health impact is a key prerequisite of an effective public health policy. A continuous quality improvement of public health processes and interventions is essential. In particular, digital epidemic surveillance must respond to an evolving situation, taking into account the changing transmission and immune-evasion properties of a virus.
11. Data protection standards must be considered as an advantage in conditions of uncertainty such as a pandemic. However, these standards must be applied in a way that allows for the collection and use of sufficiently detailed data when this is necessary for the public health objectives, and provided that the appropriate safeguards are present. The right balance between data protection standards and public health objectives must be struck not only to help fight the current pandemic but also to design future technology aimed at tackling future health crises.
12. The Assembly believes that technology can make a significant contribution to the promotion of public interests only by ensuring a careful balance of all interests at stake and by carrying out an in-depth assessment of the risks posed to human rights and fundamental freedoms in a democratic society.
13. To that end, the Assembly calls on Council of Europe member States to:
13.1 ensure that recourse to digital public health technologies is part of a comprehensive national epidemiologic strategy, articulated in different tools, balancing all interests at stake and based on an appropriate evaluation of its real impact and effectiveness;
13.2 monitor the implementation of these new technologies as well as their compliance with data protection standards, and ensure that the collection and processing of personal and health data are justified by legitimate public health objectives and are adequate and proportionate to achieving the intended goal; this also implies that such data is only retained to the extent and for the duration necessary for those objectives;
13.3 consider the possibility of voluntary data donorship for contact tracing applications or other future technologies, which includes an opt-in for users who would like to consent to have their personal data anonymised and processed to collect evidence for scientific research and impact assessment, with appropriate safeguards to preserve privacy and to ensure consent is freely given, specific, informed and unambiguous;
13.4 keep the public well informed about public health interventions, in particular regarding the impact and effectiveness of new digital technology, including via parliamentary hearings and public information campaigns, with a view to raising citizens awareness, building citizens’ trust and strengthening the effectiveness of new technology;
13.5 counter negative attitudes or low interest in the population through systematic, targeted information campaigns, both through the media and with civic initiatives in schools, that are context-specific, based on science, address doubts and concerns raised, debunk disinformation and highlight individual and collective responsibility for one’s own health as well as other people’s health;
13.6 encourage voluntary access to CTAs in resource-limited settings, for example through reduced mobile data costs, higher availability of and compatibility with low-cost devices and conditions facilitating the use of CTAs such as a help function, a tutorial, or testimonials of other users;
13.7 initiate, if not done yet, and promote globally the signature and ratification of the Convention for the protection of individuals with regard to automatic processing of personal data (Convention 108) and its Protocol (Convention 108+) which certainly contributes to the convergence towards a set of high-level standards in the area of the protection of privacy and personal data.
14. The Assembly resolves to enhance co-operation with the Consultative Committee established by the Convention 108 to share best practices regarding the implementation of privacy and data protection principles and rules in public interest areas, and to identify areas of possible joint actions to raise awareness on, and enhance compliance with, international standards in the field.
15. The Assembly also encourages the European Union to continue developing co-ordinated solutions at European and international levels, including beyond the European Union, to promote safe international travel and global control of the Covid-19 pandemic as well as future threats to public health.