Contact tracing applications: ethical, cultural and educational challenges
Resolution 2478
(2023)
| Provisional version
- Author(s):
- Parliamentary Assembly
- Origin
- Assembly
debate on 25 January 2023 (5th sitting) (see Doc. 15648, report
of the Committee on Culture, Science, Education and Media, rapporteur:
Mr Duncan Baker; and Doc.
15660, opinion of Committee on Legal Affairs and Human Rights,
rapporteur: Mr Vladimir Vardanyan). Text adopted by the
Assembly on 25 January 2023 (5th sitting).
1. The Parliamentary
Assembly notes that over the past two years, data collection and
processing by using digital public health technologies, such as
contact tracing applications (CTAs), have been promoted worldwide by
governments as well as private companies to mitigate the Covid-19
pandemic, identify subjects at risk of contamination or ensure compliance
with confinement rules.
2. In May 2020, the World Health Organisation (WHO) issued guidelines
for their use and related ethical considerations. The Consultative
Committee established by the Council of Europe Convention for the protection
of individuals with regard to automatic processing of personal data
(ETS No. 108, Convention 108), the Data Protection Commissioner
and the Committee on Bioethics of the Council of Europe, also issued several
statements, raising concerns and providing useful guidelines. The
Council of Europe 2020 Data Protection Report highlighted that,
by adopting widely diverging systems, countries have limited the
efficiency of the measures taken and the influence they could have
exercised on actors in the digital market.
3. CTAs are available in app stores; their ethical and legal
frameworks remain unclear, with risks related inter
alia to unlawful interference with the right to respect
for private life, protected under Article 8 of the European Convention
on Human Rights (ETS No. 5), as well as specifically through the
guarantees set out in Convention 108 and its amending Protocol (CETS
No. 223), Convention 108+. Respecting the confidentiality of health
data is a vital principle in the legal systems of all States Parties
to the European Convention on Human Rights. In particular, in order
to respect the right to private life in Article 8 of the Convention,
domestic law must afford appropriate safeguards to prevent the inappropriate
communication or disclosure of personal health data.
4. In its Resolution 2338 (2020) “The impact of the Covid-19
pandemic on human rights and the rule of law”, the Assembly noted
that “a lack of public trust in such apps due to privacy-related
concerns, resulting in low levels of installation or use, would
seriously undermine their effectiveness”. Hence, these applications
need to be carefully evaluated and public authorities must monitor
their implementation to ensure compliance with the right to private
life and with the data protection standards laid down by Convention
108 and its modernised version, Convention 108+.
5. The Assembly stresses that the collection and processing of
personal and health data must be justified by legitimate public
health objectives and be suitable and proportionate to achieving
the intended goal. The data collected via these applications should
not be accessible to third parties that are not involved in public health
management. Data collection and processing must be transparent and
concise, and reader-friendly information on the purpose of data
collection, data storage and sharing must be easily available. Data
should only be retained to the extent and for the duration necessary.
Decisions on downloading and using applications must remain voluntary
and respect personal autonomy. Specific care must be taken in the
design and application of these applications to ensure adequate
safeguards for children, and in particular respect for their rights
to privacy and the protection of their personal data. Discrimination
due to the digital divide should be avoided. Furthermore, data protection
authorities must be involved in the development, oversight, and
audit of digital contact tracing systems.
6. The effectiveness of such digital technologies largely pertains
to the technical designs, implementation methods and the level of
public trust. Therefore, the Assembly considers that the lack of
citizens’ involvement in the debate may explain the low adoption
rates of the available applications in many Council of Europe member
States. In this respect,
Resolution
2333 (2020) and
Recommendation
2176 (2020) “Ethics in science and technology: a new culture of
public dialogue” highlighted that it is essential to involve the
general public in decisions which highly impact on their lives,
especially during crises.
7. Digital epidemic surveillance is – and should only be – intended
to prevent forward transmission and break the chains of infection.
However, to date substantial scientific evidence of CTAs’ impact
and effectiveness remains relatively limited.
8. CTAs which have been developed in most European countries
do not collect identifiable health data, at least not without explicit
consent; moreover, sensitive health-related information, including
when collected via manual contact tracing (for example in testing
centres) cannot be shared with third parties, including the scientific
community, without consent. As with other, particularly digital,
forms of data processing, it is important that consent is freely
given, specific, informed and unambiguous.
9. While this approach serves the purpose of protecting privacy,
the fact that contact tracing and testing datasets cannot be processed
and combined without citizens’ consent may hinder the ability of
governments to analyse aggregated data, including user demographics
or temporal, spatial and public health impact trends of CTA usage
and exposure notifications.
10. The Assembly stresses that a timely and accurate assessment
of the CTAs’ public health impact is a key prerequisite of an effective
public health policy. A continuous quality improvement of public
health processes and interventions is essential. In particular,
digital epidemic surveillance must respond to an evolving situation, taking
into account the changing transmission and immune-evasion properties
of a virus.
11. Data protection standards must be considered as an advantage
in conditions of uncertainty such as a pandemic. However, these
standards must be applied in a way that allows for the collection
and use of sufficiently detailed data when this is necessary for
the public health objectives, and provided that the appropriate
safeguards are present. The right balance between data protection
standards and public health objectives must be struck not only to
help fight the current pandemic but also to design future technology
aimed at tackling future health crises.
12. The Assembly believes that technology can make a significant
contribution to the promotion of public interests only by ensuring
a careful balance of all interests at stake and by carrying out
an in-depth assessment of the risks posed to human rights and fundamental
freedoms in a democratic society.
13. To that end, the Assembly calls on Council of Europe member
States to:
13.1 ensure that recourse
to digital public health technologies is part of a comprehensive
national epidemiologic strategy, articulated in different tools,
balancing all interests at stake and based on an appropriate evaluation
of its real impact and effectiveness;
13.2 monitor the implementation of these new technologies as
well as their compliance with data protection standards, and ensure
that the collection and processing of personal and health data are justified
by legitimate public health objectives and are adequate and proportionate
to achieving the intended goal; this also implies that such data
is only retained to the extent and for the duration necessary for
those objectives;
13.3 consider the possibility of voluntary data donorship for
contact tracing applications or other future technologies, which
includes an opt-in for users who would like to consent to have their
personal data anonymised and processed to collect evidence for scientific
research and impact assessment, with appropriate safeguards to preserve
privacy and to ensure consent is freely given, specific, informed
and unambiguous;
13.4 keep the public well informed about public health interventions,
in particular regarding the impact and effectiveness of new digital
technology, including via parliamentary hearings and public information campaigns,
with a view to raising citizens awareness, building citizens’ trust
and strengthening the effectiveness of new technology;
13.5 counter negative attitudes or low interest in the population
through systematic, targeted information campaigns, both through
the media and with civic initiatives in schools, that are context-specific,
based on science, address doubts and concerns raised, debunk disinformation
and highlight individual and collective responsibility for one’s
own health as well as other people’s health;
13.6 encourage voluntary access to CTAs in resource-limited
settings, for example through reduced mobile data costs, higher
availability of and compatibility with low-cost devices and conditions
facilitating the use of CTAs such as a help function, a tutorial,
or testimonials of other users;
13.7 initiate, if not done yet, and promote globally the signature
and ratification of the Convention for the protection of individuals
with regard to automatic processing of personal data (Convention
108) and its Protocol (Convention 108+) which certainly contributes
to the convergence towards a set of high-level standards in the
area of the protection of privacy and personal data.
14. The Assembly resolves to enhance co-operation with the Consultative
Committee established by the Convention 108 to share best practices
regarding the implementation of privacy and data protection principles and
rules in public interest areas, and to identify areas of possible
joint actions to raise awareness on, and enhance compliance with,
international standards in the field.
15. The Assembly also encourages the European Union to continue
developing co-ordinated solutions at European and international
levels, including beyond the European Union, to promote safe international
travel and global control of the Covid-19 pandemic as well as future
threats to public health.
