VIEWPOINT The Human Rights Challenges of Digital COVID-19 Surveillance
Volume 22/2, December 2020, pp. 79 – 83
Akarsh Venkatasubramanian
Digital technologies offer huge potential to improve the accuracy, breadth, reliability, and speed of contact tracing and other public health surveillance measures. However, in the absence of appropriate global governance frameworks, the usage of digital technologies during health emergencies presents multidimensional challenges. The article by Sharifah Sekalala and colleagues in this issue analyzes the human rights implications of tools used for outbreak surveillance and suggests concrete recommendations to mitigate risks to human rights.
This commentary discusses the technological and governance challenges associated with their recommendations. It incorporates a technological feasibility viewpoint into some of the recommendations and proposes one additional recommendation to strengthen the governance and accountability of technology developers, regulators, and evaluators.
Digital tools for public health surveillance
As Sekalala and colleagues note, several countries now use digital COVID-19 surveillance technologies for symptom tracking and contact tracing to enable rapid case identification and integration into public health databases.[1] Most technologies use location or GPS services (for example, China’s Health Code and Ghana’s COVID-19 Tracker) or Bluetooth (for example, France’s TousAntiCovid and Singapore’s TraceTogether). Many use a decentralized exposure notification system that aims to protect privacy, which was jointly created by Google and Apple (for example, Switzerland’s SwissCovid and Japan’s COCOA), while others use hybrid solutions (for example, Germany’s CoronaWarnApp and India’s Aarogya Setu).[2]
As discussed below, recent innovations also support privacy protection during public health surveillance, such as by using the data produced by such tools for disease modeling and epidemic dashboards, informing health decisions through technology-driven disease testing, or using technology to counter health-related discrimination. Each of these innovations comes with technological strengths and limitations, ethical challenges, and even threats to human rights. But there are potential solutions.
Evidence-based measures
Sekalala and colleagues recommend that countries proactively ensure evidence-based decision-making by utilizing existing legal standards, such as the Siracusa Principles, to assess the necessity and proportionality of digital surveillance technologies.[3] The Siracusa Principles provided an important legal basis for the strengthening of the World Health Organization’s International Health Regulations in 2005, emphasizing the importance of respect for human rights in an outbreak response.[4] Digital surveillance technologies can easily be disproportionate vis-à-vis public health needs, and when employing such technologies, countries should not only examine these tools’ necessity, legality, and proportionality but also their situational acceptability and their methods of data collection, storage, access, and analysis.
Along these lines, the debate over centralized versus decentralized approaches to digital contact tracing—such as the debate over Europe’s PEPP-PT (centralized) versus Switzerland’s DP3T (decentralized)—highlights how technological innovations could help uphold human rights.[5]
Decentralized approaches, with personal data saved only on an individual’s device, are less intrusive than centralized approaches, with data stored on a single database. Centralized data creates greater risks and therefore a greater need to consider the legality, necessity, and proportionality of the approach. Leaky data architectures of unregulated centralized approaches may allow the exploitation of sensitive health data to unlawful effect, such as the tracking of individuals’ personal movements.[6] Security, safety, interoperability, and consent concerns also remain, as highlighted by Morocco’s experience: a widely used centralized contact tracing app, Wiqaytna, developed by the Moroccan Ministry of the Interior interprets national regulations to allow authorities to disproportionately access and process personal data without individuals’ informed consent.[7]
In comparison, decentralized approaches generally offer greater privacy, anonymization, confidentiality, and ownership of health data.[8] An example is the exposure notification system jointly created by Apple and Google, which allows countries to prioritize privacy-preserving contact tracing.[9] For this purpose, the tech giants leveraged application programming interfaces (APIs), which are software technology protocols that enable smooth data transmission between multiple interacting applications.[10] This system is more expensive than conventional centralized approaches, meaning that certain countries may not see financial advantages to this public-private partnership. However, this decentralized example offers an added defense against data exploitation and human rights violations.
But at the same time, neither system is foolproof. Mobile-phone-based contact tracing for COVID-19 works provided that the devices are switched on, the phones’ Bluetooth or location sensors are turned on, the devices are within 1.5 meters of each other, and they stay that way for at least for 15 minutes. Virus transmission with just one of these conditions unmet can produce false negatives. Equally concerning, two mobile phones may contribute data to contact tracing pools without detecting the fact that people are separated by walls or solid surfaces (assuming no robust proximity sensors), giving false positives.[11]
While a consideration of the legality, proportionality, and necessity is clearly key in selecting an approach to contact tracing, countries must also factor into their selection the real-world compromises required by technologies that are rapidly evolving.
Integrated public health measures
Sekalala and colleagues encourage countries to ensure that symptom tracking and contact tracing tools are integrated into countries’ public health systems. They do not address how health systems may be further strengthened by using data produced by contact tracing to inform population-level digital health tools, such as epidemiological modeling for disease surveillance and remote testing technologies; but these deserve reflection as well.
Outbreak surveillance tools such as the World Health Organization’s Go.Data do aid the discovery of disease transmission dynamics and pandemic response.[12] So do epidemiological modeling and disease dashboards like that hosted by Johns Hopkins University.[13] Digital health technologies such as geospatial maps also show promise in disease surveillance by enabling epidemiologists to understand the community transmission dynamics of malaria and hemorrhagic fevers.[14] Predictive nowcasting, in which models help predict the current value of observable data, can help countries choose policies that uphold and respect human rights, by tailoring their responses to specific needs and current trends.[15] However, to make these models effective and to inform good decision-making requires more cross-sector and interdisciplinary collaborations that bring together policy makers, epidemiologists, engineers, technologists, health professionals, and scientists in trusted spaces to communicate about the models and to understand human aspects of pandemics.
Such decision-making tools could be further enhanced by data produced by remote testing technologies, such as remote cough-audio-based testing.[16] These approaches offer promise in the future, though currently data are not always transferable without loss or manipulation between systems (for example, among older systems such as in France or India).[17] Continuous data integration may also threaten security, as in Norway or in Qatar, whose digital surveillance failed to preempt data leaks.[18] Newer public health systems in Estonia and Rwanda have demonstrated that interoperability can be achieved while building or strengthening public health systems and can result in more effective data sharing to inform national-level outbreak surveillance, ultimately resulting in health policy decisions that improve the accessibility and acceptability of health services.[19]
Furthermore, when integrating digital contact tracing and surveillance into health systems, it is crucial to bear in mind that technology can only complement human expertise and experience, not replace it. Training is imperative for community health workers to effectively use tech tools for contact tracing. An example of this is TdH’s IeDA project, which offers an integrated e-diagnostic model to strengthening rural primary health care.[20] Its encouraging success underscores the importance of integrating learning for digital health policies from effective HIV/AIDS responses in sub-Saharan Africa and elsewhere.[21]
Nondiscrimination
Sekalala and colleagues rightly note the risk of discrimination linked to the collection and storage of data that do not mask identifying characteristics, and note that excluding populations in areas without mobile phone coverage can heighten health inequalities. This is certainly true, but beyond data misuse, incomplete data collection can create missing chunks of health data, while deliberate or inadvertent non-usage of important available health data can be a form of missed data. Both of these also present direct avenues to discrimination against already marginalized groups.
Poor, adolescent, and elderly populations typically have less access to the mobile phones used for contact tracing. The Global System for Mobile Communications Association estimates only about five billion owners of mobile phones worldwide (~65%), with half that number having smartphones.[22] Of these, just over half have internet access, including a mere half of Latin America’s population and a quarter of sub-Saharan Africa’s population. About two billion mobile phone users cannot use Bluetooth or API-enabled tracing tools. Vulnerable communities often have family mobile phones, owned by the breadwinner and used by all family members.
This lack of access to data can cause discrimination by presenting misleading and inaccurate health data for dissemination and analysis, further widening existing inequalities and resulting in poorly informed decisions that ultimately undermine the right to health.
Stronger governance frameworks
Sekalala and colleagues identify United Nations human rights mechanisms as one way to ensure the transparency and accountability of data management.[23] While this commentary seconds this recommendation, we may need to go much further to ensure the accountability not just of data holders (such as states) but also of technology developers and evaluators. While the courts may provide oversight based on existing legislation (as the authors observe in Slovakia), we are in the middle of an industrial revolution, and laws may quickly become outdated, as seen in Algeria.[24]
A rights-based, multisectoral, and geographically equitable global governance structure should set relevant standards to promote accountability for technology developers by monitoring a sectoral cycle of incentivization. Through such a structure, technology developers could incentivize external evaluators (for example, research institutes) to ensure that their products satisfy accepted human rights standards and may in turn be incentivized by governments that regulate the availability of developed products in the market.
Regulating technology developers may require new regulations. The United Nations Guiding Principles on Business and Human Rights guide technology firms to be duty holders, but these principles are nonbinding, and violations may go unsanctioned.[25] There is a clear need for global regulation of health data, perhaps through the creation of registers or indices similar to the Access to Medicines Index.[26]
It is concerning that there are currently no global benchmarks or governance mechanisms that can effectively regulate digital health. COVID-19 offers an opportunity to build and strengthen a global rights-based, equitable, inclusive governance structure, such as an international health data regulation, that is designed with geographical and sectoral representation and that promotes responsible and appropriate digital health surveillance during and beyond emergencies.
Robust data remain the functional life force of all digital surveillance technologies. Hence, new governance mechanisms must build new and strengthen existing global data governance frameworks, and institutionalize innovative, trustworthy, and equitable international health data regulations with, for instance, a POSSICA protocol (guidelines on privacy, ownership, security, safety, interoperability, consent, and anonymization). Such regulations would engender multisector collaboration that respects human rights advocacy and action and could drive global, regional, and national representations of standards, benchmarks, and transparent regulatory mechanisms for digital contact tracing tools utilizable and evaluable in health emergencies. This would ultimately help build multistakeholder trust, which is essential for all health systems to function.
Further research and literature should amplify this call for building and strengthening stable global health data and technology governance frameworks to assist digital surveillance for COVID-19 responses and overall health systems strengthening. The appropriate institutionalization of such a rights-based framework would enhance trust, longer-term geographical equity, and comprehensive health and care.
Akarsh Venkatasubramanian is a global health researcher and biomedical engineer who focuses on strengthening global governance frameworks to enable equitable and responsible technology innovation for the attainment of universal health coverage.
Please address correspondence to the author. Email: akarshv@gmail.com.
Competing interests: None declared.
Copyright © 2020 Venkatasubramanian. This is an open access article distributed under the terms of the Creative Commons Attribution Non-Commercial License (http://creativecommons.org/licenses/by-nc/4.0/), which permits unrestricted non-commercial use, distribution, and reproduction in any medium, provided the original author and source are credited.
References
[1] J. Budd, B. S. Miller, E. M. Manning, et al., “Digital technologies in the public-health response to COVID-19,” Nature Medicine 26 (2020), pp. 1183–1192.
[2] “A flood of coronavirus apps are tracking us. Now it’s time to keep track of them,” MIT Technology Review (May 7, 2005). Available at https://www.technologyreview.com/2020/05/07/1000961/launching-mittr-covid-tracing-tracker/.
[3] Siracusa Principles on the Limitation and Derogation Provisions in the International Covenant on Civil and Political Rights, UN Doc. E/CN.4/1985/4 (1984), part. I, para. 25.
[4] World Health Organization, International health regulations, 3rd edition (Geneva: World Health Organization, 2005).
[5] “How Europe splintered over COVID-19 apps,” Financial Times (May 10, 2020). Available at https://www.ft.com/content/7416269b-0477-4a29-815d-7e4ee8100c10.
[6] International Covenant on Economic, Social and Cultural Rights, G.A. Res. 2200A (XXI) (1966), arts. 1, 12.
[7] Access Now, COVID-19 contact tracing tools in MENA (June 18, 2020). Available at https://www.accessnow.org/covid-19-contact-tracing-apps-in-mena-a-privacy-nightmare.
[8] Twitter, Michael Veale. Available at https://twitter.com/mikarv/status/1250851295520600066?s=21.
[9] Apple, Privacy-preserving contact tracing. Available at https://covid19.apple.com/contacttracing.
[10] RapidAPI, What is an API? (2020). Available at https://rapidapi.com/blog/api-glossary/api/.
[11] A. Soltani, R. Calo, and C. Bergstrom, “Contact tracing apps are not a solution to the COVID-19 crisis,” Brookings (April 27, 2020). Available at https://www.brookings.edu/techstream/inaccurate-and-insecure-why-contact-tracing-apps-could-be-a-disaster.
[12] World Health Organization, GO.DATA user guide (March 31, 2020) p. 11. Available at https://apps.who.int/iris/bitstream/handle/10665/332255/WHO-2019-nCoV-Go.data_manual-2020.2-eng.pdf.
[13] Johns Hopkins University, Coronavirus resources. Available at https://coronavirus.jhu.edu/.
[14] G. C. Kelly, E. Hale, W. Donald, et al., “A high-resolution geospatial surveillance-response system for malaria elimination in Solomon Islands and Vanuatu,” Malaria Journal 12 (2013).
[15] S. F. McGough, M. A. Johansson, M. Lipsitch, and N. A. Menzies, “Nowcasting by Bayesian Smoothing: A flexible, generalizable model for real-time epidemic tracking,” PLoS Computational Biology 16/4 (2020).
[16] University of Cambridge, Covid-19 Sounds App. Available at https://www.covid-19-sounds.org/en/.
[17] INSERM, Health research databases. Available at https://www.inserm.fr/en/professional-area/health-research-databases.
[18] “Qatar makes COVID-19 app mandatory, experts question efficiency,” Al Jazeera (May 26, 2020). Available at https://www.aljazeera.com/news/2020/5/26/qatar-makes-covid-19-app-mandatory-experts-question-efficiency.
[19] R. Crichton, D. Moodley, A. Pillay, et al., “An architecture and reference implementation of an open health information mediator: Enabling interoperability in the Rwandan health information Exchange” (paper presented at International Symposium on Foundations of Health Informatics Engineering and Systems, January 2013).
[20] Terre des Hommes, IeDA. Available at https://www.tdh.ch/en/ieda.
[21] UNAIDS, 2 million African community health workers: Harnessing the demographic dividend, ending AIDS and ensuring sustainable health for all in Africa (Geneva: UNAIDS, 2017).
[22] GSMA, Connected society: The state of mobile internet connectivity 2019 (London: GSMA, 2019).
[23] S. Sekalala, H. Masud, and R. T. Bosco, “Human rights mechanisms for anti-corruption, transparency and accountability: Enabling the right to health,” Global Health Action 13 (2020).
[24] Access Now (see note 7).
[25] Office of the United Nations High Commissioner for Human Rights, Guiding principles on business and human rights (New York: United Nations, 2011).
[26] Access to Medicine Foundation, Access to Medicine Index 2018. Available at https://accesstomedicinefoundation.org/access-to-medicine-index.
Sekalala et al. respond
We welcome Akarsh Venkatasubramanian’s helpful commentary, which locates the different digital technologies that operate within public health surveillance systems, supporting our argument that countries should employ the technology that is least restrictive of human rights. We have two comments: First, it is correct that we do not specifically acknowledge how health systems might be strengthened by using data produced by contact tracing to inform population-level digital health tools, and instead we focus on data for health uses, such as enforcing quarantines or isolation. However, we argue that data for outbreak surveillance tools are no different from other data for health uses. We think that the tests of necessity and proportionality should be used to gauge whether the data being collected are really necessary for the health objective, and the risk to individuals is proportionate. Secondly, Venkatasubramanian’s commentary challenges us to think about accountability beyond the United Nations system. Soft-law standard setting can be useful in complex and specialized issues where we need actors to respond quickly, which is ideal for rapidly changing health technologies.1 However, we are unsure whether this would entail shifting the governance of technological health surveillance outside the United Nations and the World Health Organization system of global governance. If that is the proposition, we would be concerned that this could further fragment human rights in global health governance. We need to ensure that any efforts to create new accountability measures are consonant with existing human rights mechanisms. As the current COVID-19 crisis has shown, there is an imperative for coordinated efforts in managing global health crises, and we must ensure that the World Health Organization retains its legitimate mandate under the International Health Regulations (2005) to coordinate global health efforts in this area.
Final comment from Venkatasubramanian
I thank the authors for their clear and concise comments. In response to their second comment, I believe cross-sectoral accountability in health technology innovation for outbreak surveillance and beyond is essential, through trusted multi-stakeholder platforms such as WHO, and that global governance must not shift out of WHO’s (or the UN’s) mandate. Instead, I recommend that governments (tech regulators), for-profits (tech developers), research/academia (tech evaluators) and civil society must proactively and appropriately collaborate to ensure global governance frameworks and instruments within WHO (both existing, such as the International Health Regulations and new, such as potential international health data regulations) are strengthened and stabilised. As the authors say, we must maintain the overarching legitimacy of WHO.
Akarsh Venkatasubramanian
1 S. Sekalala, Soft Law and Global Health Problems: Lessons from responses to HIV/AIDS, malaria and tuberculosis’ (Cambridge University Press, 2018).