Contact tracing applications: ethical, cultural and educational challenges
- Author(s):
- Parliamentary Assembly
- Origin
- Assembly
debate on 25 January 2023 (5th sitting) (see Doc. 15648, report of the Committee on Culture, Science, Education
and Media, rapporteur: Mr Duncan Baker; and Doc. 15660, opinion of Committee on Legal Affairs and Human Rights,
rapporteur: Mr Vladimir Vardanyan). Text
adopted by the Assembly on 25 January 2023 (5th sitting).
1. The Parliamentary Assembly notes
that over the past two years data collection and processing by using digital
public health technologies, such as contact tracing applications
(CTAs), have been promoted worldwide by governments as well as private
companies to mitigate the Covid-19 pandemic, identify subjects at
risk of contamination or ensure compliance with lockdown rules.
2. In May 2020, the World Health Organization issued guidelines
for the use of such technologies and related ethical considerations.
The Consultative Committee established by the Council of Europe
Convention for the Protection of Individuals with regard to Automatic
Processing of Personal Data (ETS No. 108, “Convention 108”), the
Data Protection Commissioner and the Committee on Bioethics of the
Council of Europe also issued several statements, raising concerns
and providing useful guidelines. The Council of Europe 2020 data
protection report entitled “Digital solutions to fight Covid-19”
highlighted that, by adopting widely diverging systems, countries
have limited the efficiency of the measures taken and the influence
they could have exercised on those in the digital market.
3. CTAs are available in app stores; their ethical and legal
frameworks remain unclear, with risks related, inter alia, to unlawful interference
with the right to respect for private life, protected under Article
8 of the European Convention on Human Rights (ETS No. 5, “the Convention”),
as well as specifically through the guarantees set out in Convention
108 and its amending protocol (CETS No. 223, “Convention 108+”). Respecting
the confidentiality of health data is a vital principle in the legal
systems of all States Parties to the European Convention on Human
Rights. In particular, in order to respect the right to respect
for private life in Article 8 of the Convention, domestic law must
afford appropriate safeguards to prevent the inappropriate communication
or disclosure of personal health data.
4. In its
Resolution
2338 (2020) “The impact of the Covid-19 pandemic on human
rights and the rule of law”, the Assembly noted that “a lack of
public trust in such apps due to privacy-related concerns, resulting
in low levels of installation or use, would seriously undermine
their effectiveness”. Hence, these applications need to be carefully
evaluated and public authorities must monitor their implementation
to ensure compliance with the right to respect for private life
and with the data protection standards laid down by Convention 108
and its updated version, Convention 108+.
5. The Assembly stresses that the collection and processing of
personal and health data must be justified by legitimate public
health objectives and be suitable and proportionate to achieving
the intended goal. The data collected via these applications should
not be accessible to third parties that are not involved in public health
management. Data collection and processing must be transparent and
concise, and reader-friendly information on the purpose of data
collection, data storage and sharing must be easily available. Data
should only be retained to the extent and for the duration necessary.
Decisions on downloading and using applications must remain voluntary
and respect personal autonomy. Specific care must be taken in the
design and roll-out of these applications to ensure adequate safeguards
for children, and in particular respect for their rights to privacy
and the protection of their personal data. Discrimination due to
the digital divide should be avoided. Furthermore, data protection
authorities must be involved in the development, oversight and auditing
of digital contact tracing systems.
6. The effectiveness of such digital technologies largely depends
on the technical designs, implementation methods and the level of
trust the public has in these tools. Therefore, the Assembly considers
that the lack of citizens’ involvement in the debate may explain
the low adoption rates of the available applications in many Council
of Europe member States. In this respect,
Resolution 2333 (2020) and
Recommendation 2176 (2020) “Ethics
in science and technology: a new culture of public dialogue” highlighted
that it is essential to involve citizens in decisions which significantly
impact on their lives, especially during crises.
7. Digital epidemic surveillance is – and should only be – intended
to prevent onward transmission and break the chains of infection.
However, to date, substantial scientific evidence of the impact
and effectiveness of CTAs remains relatively limited.
8. CTAs which have been developed in most European countries
do not collect identifiable health data, at least not without explicit
consent; moreover, sensitive health-related information, including
when collected via manual contact tracing (for example in testing
centres), cannot be shared with third parties, including the scientific
community, without consent. As with other, particularly digital,
forms of data processing, it is important that consent is freely
given, specific, informed and unambiguous.
9. While this approach serves the purpose of protecting privacy,
the fact that contact tracing and testing data sets cannot be processed
and combined without citizens’ consent may hinder the ability of
governments to analyse aggregated data, including user demographics
or temporal, spatial and public health impact trends of CTA usage
and exposure notifications.
10. The Assembly stresses that a timely and accurate assessment
of the public health impact of CTAs is a key prerequisite of an
effective public health policy. Continuous improvement in the quality
of public health processes and interventions is essential. In particular,
digital epidemic surveillance must respond to an evolving situation,
taking into account the changing transmission and immune-evasion
properties of a virus.
11. Data protection standards must be considered as an advantage
in conditions of uncertainty such as a pandemic. However, these
standards must be applied in a way that allows for the collection
and use of sufficiently detailed data when this is necessary for
public health objectives and provided that the appropriate safeguards
are present. Therefore, the right balance between data protection
standards and public health objectives must be struck not only to
help fight the current pandemic but also to help design technology
aimed at tackling future health crises.
12. The Assembly believes that technology can make a significant
contribution to the promotion of public interests only by ensuring
a careful balance of all interests at stake and by carrying out
an in-depth assessment of the risks posed to human rights and fundamental
freedoms in a democratic society.
13. To that end, the Assembly calls on Council of Europe member
States to:
13.1 ensure that recourse
to digital public health technologies is part of a comprehensive
national epidemiological strategy, articulated in different tools,
balancing all interests at stake and based on an appropriate evaluation
of its real impact and effectiveness;
13.2 monitor the implementation of these new technologies as
well as their compliance with data protection standards, and ensure
that the collection and processing of personal and health data are justified
by legitimate public health objectives and are adequate and proportionate
to achieving the intended goal; this also implies that such data
are only retained to the extent and for the duration necessary for
those objectives;
13.3 consider the possibility of voluntary data donorship for
contact tracing applications or other future technologies, which
includes an opt-in for users who would like to consent to have their
personal data anonymised and processed to collect evidence for scientific
research and impact assessment, with appropriate safeguards to preserve
privacy and to ensure consent is freely given, specific, informed
and unambiguous;
13.4 keep the public well informed about public health interventions,
in particular regarding the impact and effectiveness of new digital
technology, including via parliamentary hearings and public information campaigns,
with a view to raising citizens’ awareness, building citizens’ trust
and strengthening the effectiveness of new technology;
13.5 counter negative attitudes or low interest in the population
through systematic, targeted information campaigns, both through
the media and with civic initiatives in schools, which are context specific,
based on science, address doubts and concerns raised, debunk disinformation
and highlight individual and collective responsibility for one’s
own health as well as other people’s health;
13.6 encourage voluntary access to CTAs in resource-limited
settings, for example through reduced mobile data costs, higher
availability of and compatibility with low-cost devices and conditions
facilitating the use of CTAs such as a help function, tutorials
or testimonials of other users;
13.7 initiate, if they have not yet done so, and promote globally
the signature and ratification of Convention 108 and Convention
108+, which certainly contribute to the convergence towards a set
of high-level standards in the area of the protection of privacy
and personal data.
14. The Assembly resolves to enhance co-operation with the Consultative
Committee established by Convention 108 to share best practices
on the implementation of privacy and data protection principles
and rules in public interest areas, and to identify areas of possible
joint action to raise awareness of, and enhance compliance with,
international standards in the field.
15. The Assembly also encourages the European Union to continue
developing co-ordinated solutions at European and international
levels, including beyond the European Union, to promote safe international
travel and global control of the Covid-19 pandemic as well as to
prevent future threats to public health.
