Contact-tracing Apps and Human Rights

The Covid-19 pandemic engages the full spectrum of states’ human rights obligations. In addressing the virus itself, states are required to protect the rights to life and the highest attainable standard of health (right to health) and ensure that no-one suffers discrimination in access to and the nature of healthcare. States’ (in)action in meeting their obligations to fulfil the rights to health and life has direct consequences for the enjoyment of all human rights, including the rights to liberty and security, education, food, work, housing, privacy and freedom of movement, association and expression. States therefore have to take proactive measures to prevent the spread of Covid-19 in order to protect life and health. However, as human rights are indivisible and inalienable, they must only do so in ways that do not violate absolute rights, such as the prohibition of torture, and only limit other rights in ways that are lawful, necessary and proportionate.

In this blog, I examine the role of contact-tracing apps as central to many states’ strategies to track the spread of Covid-19 and end ‘lockdown’, which would alleviate the pressure on many other human rights. Some contact-tracing apps have already been rolled out, such as Singapore’s TraceTogether app and others are under development, including in the UK and France. Many concerns have been expressed about the use of contact-tracing apps due to the significant risks they pose to human rights and their potential contribution to a dramatic new era of surveillance. Given these risks, I argue that states need to be able to answer three questions, if they are to consider introducing – or continuing – with their use of contact-tracing apps. These questions are:

1. Is there scientific justification for the use of contact tracing apps as a means to fulfil states’ obligations to protect the rights to health and life?
2. If there is, does the design and deployment of contact tracing-apps meet the tests of legality, necessity and proportionality?
3. Has the state put in place measures to prevent harm to human rights in the future, by preventing mission creep and the normalisation of contact-tracing apps?

1. Is there scientific justification for the use of contact tracing apps as a means to fulfil states’ obligations to protect the rights to health and life?

Contact-tracing apps may be seen as a means to fulfil states’ positive obligations to protect the rights to health and life. However, it is not enough for states to simply assert that the apps are aimed at protecting the rights to life and health; rather they must be ‘scientifically justified’. Contact-tracing is a common technique in public health surveillance. It is used to identify people who may have been in contact with someone diagnosed with a virus in order to provide them with information about prevention and treatment. At this stage in the Covid-19 pandemic, contact-tracing by humans is considered to have many limitations due to the labour required, limited available testing and the spread of the virus. While presented as an alternative to human contact-tracing, it is unclear whether contact-tracing apps are capable of fulfilling this role, particularly in the absence of widespread testing. This has led to some commentators asking whether contact-tracing apps are just another example of techno-solutionism or as Ross Anderson has suggested, ‘do-something-itis’.

A number of commentators, including Anderson, the Ada Lovelace Institute and Privacy International, point out that if voluntary, there is likely to be a low-level of buy-in (in Singapore, reports suggest only 17% of the population use the app although Oxford researchers predict a much higher rate in the UK and argue that while a 60% take-up would work best, a lower rate of engagement could still contribute to a reduction in cases). With both voluntary and mandatory contact-tracing apps, the risk of denial of service attacks and abuse are high as is the likelihood of failing to report symptoms or diagnosis or reporting false information. This risk increases if adverse consequences attach to self-reporting, such as extended lockdown, inability to work or access public spaces. These observations suggest that contact-tracing apps are unlikely to have general scientific justification and thus require states to make a clear scientific case for how, and, in what way, the specific contact-tracing app being proposed could contribute to protecting the rights to health and life.

In protecting the rights to health and life, it is also critical that states do not overly focus on one particular solution, such as contact-tracing apps, as the fulfilment of these obligations requires complex and multi-layered strategies and resource. Lisa Forman argues that the failure of many states to act quickly to address Covid-19 through ‘wide-spread testing, contact tracing, and more adequately preparing health care settings for COVID-19 patients’ has meant that ‘[h]ealth care systems throughout Europe and North America are already struggling to mount adequate public health and clinic responses, with facilities overwhelmed, basic testing and protective gear in short support, and care triaged to those with the best chance of survival’. Javier Ruiz also argues that ‘access to testing, treatment and vaccines once they appear’ should be the ‘real priority’. Even if contact-tracing apps present part of the solution, as Anderson notes ‘[w]e must not give policymakers the false hope that techno-magic might let them avoid the hard choices’ of resource allocation to public health.

2. If there is scientific justification, does the design and deployment of contact tracing-apps meet the tests of legality, necessity and proportionality?

If states are able to make the scientific case that contact-tracing apps, on their own or in combination with other measures, can contribute to protecting the rights to life and health, the question then becomes whether the use of such technology impacts other rights and if so, whether the limitations are lawful, necessary and proportionality.

        a. The Impact of Contact-Tracing Apps on Human Rights

Contact tracing apps take different forms; as does the nature of their implementation. All forms impact human rights in some way, although varied in scale and extent.

Yuval Noah Harari has warned that resort to surveillance technologies, such as contact tracing apps, in response to the Covid-19 pandemic constitutes ‘an important watershed in the history of surveillance … signif[ying] a dramatic transition from “over the skin” to “under the skin” surveillance’. The concern is not only that contact-tracing apps could introduce an unprecedented level of surveillance during the pandemic, but that through mission creep and normalisation, we may not be able to ‘go back to normal’ and could see such technologies being deployed in other areas of life, during and after the pandemic.

These risks are particularly acute where contact-tracing apps are mandatory. This not only facilitates wide-scale surveillance but also puts people who do not own smart phones at risk of punishment, the drawing of adverse and discriminatory inferences, and unequal access to health information. Even if ostensibly voluntary, the use of contact-tracing apps could become de facto mandatory for some people, if access to work or public spaces and services is conditioned upon use of the app.

The way the app functions also has significant implications for human rights. If the app means that a person is placed under constant surveillance, this could potentially be interpreted as a restriction on freedom of movement and even, a de facto form of deprivation of liberty. They also pose significant implications for other human rights, including privacy, particularly if they reveal location data and other identifiable information; data are held centrally rather than localised on a person’s phone; data are retained rather than deleted beyond the isolation period; and are deployed by or are accessible to private companies and law enforcement or intelligence agencies (whether by design or by governments compelling health authorities to share data) with the risk that the data and technologies are repurposed, now or in the future. As discussed below, many of these issues can be overcome in the design of the apps and the legal framework put in place to oversee their use. However, it is never possible to fully remove the risks to privacy, even where data are anonymised, and the risk of mission creep and normalisation of such technology will remain high.

        b. Legality, Necessity and Proportionality

As noted at the outset, international human rights law recognises that certain rights can be limited, like the right to privacy. The 1984 Siracusa Principles foresee response ‘to a pressing public or social need’ such as public health as a possible ground for the limitation of rights. However, they also require that the essence of the right must not be undermined and the limitation must be prescribed by a ‘clear and accessible’ law, pursue a legitimate aim, be necessary and proportionate and ‘adequate safeguards and remedies’ put in place. The measures must also be timebound and purpose-limited to the specific aim of ‘preventing disease or injury or providing care for the sick and injured’.

The jurisprudence of the European Court of Human Rights establishes that states must provide ‘relevant and sufficient’ justifications for limiting a right, which ties back in with a requirement for a scientific justification for contact-tracing apps. Moreover, even if scientifically justifiable, to constitute a proportionate measure, the Siracusa Principles (and international and regional jurisprudence) set out that states must ‘use no more restrictive means than are required for the achievement of the purpose of the limitation’. Thus, the burden lies with states to show that they cannot achieve the goal of preventing the spread of Covid-19 by ‘less-restrictive-means’, including non-technological. 

The least restrictive means test also provides strict parameters for the form and nature of contact-tracing apps in order to minimise their impact on human rights. As discussed above, design options to minimise the impact on rights include avoiding centralised databases, not using location or identifying proximity or interaction data, and data deletion. Tech companies, non-profits,civil society, and academics are actively investigating how apps could be designed to minimise the impact on privacy.

The purpose-limitation requirement as well as the least restrictive means test also prevent the repurposing of data by other state agencies (such as law enforcement or immigration authorities) as well as private companies for commercial purposes. Where other agencies are involved, it is critical that this limitation is enshrined within transparent data sharing agreements. These agreements should be made public, and as argued in a Joint Civil Society Statement by over 100 organisations in relation to businesses, they should contain ‘sunset clauses, public oversight and other safeguards by default’, including ensuring that ‘any intervention is firewalled from other business and commercial interests’.

To fully minimise the impact on human rights, further safeguards are needed to assess whether the involvement of other state agencies beyond public health and private companies is necessary and proportionate. This should include a presumption against involvement; independent oversight and assessment of the rationale for their involvement; temporary use of the apps; minimisation of the categories of data collected and processed through the apps;  and due diligence, vetting and scrutiny of the risks of involving other bodies, particularly private companies, based on their human rights records, including in digital surveillance. Vetting should include the possibility of external organisations, such as civil society, submitting evidence on such records.

 3. Has the state put in place measures to prevent harm to human rights in the future, through mission creep and the normalisation of these apps?

Finally, even if states can develop a framework to ensure the least intrusion into the enjoyment of other human rights, concerns about the risks of mission creep and the normalisation of the use of contact-tracing apps by states cannot be lost. As Harari observes,

You could, of course, make the case for biometric surveillance as a temporary measure taken during a state of emergency. It would go away once the emergency is over. But temporary measures have a nasty habit of outlasting emergencies, especially as there is always a new emergency lurking on the horizon.

In the future, therefore, it is foreseeable that states could make the case for the use of contact-tracing apps in other contexts, in order to surveil particular individuals or groups in society. Once such apps have been used in one context, their introduction in other areas, even if previously inconceivable can seem less radical. As part of their obligations to prevent harm to human rights, states therefore need to be proactive in fully recognising the impact these technologies have on human rights and make clear commitments to never use such technologies where alternatives exist. They also need to ensure a strong multilateral and multistakeholder accountability and review framework in order to hold each other to account where the use of contact-tracing apps fails to meet the requirements of international human rights law.  

Conclusion

It is critical that states meet their obligations to fulfil the right to health and life in the Covid-19 pandemic. However, they do not have free rein in how they do this. They must also avoid overly relying on one solution. Protecting the right to health and life requires complex and multi-layered strategies and investment in public health and cannot be fulfilled. Contact-tracing apps pose serious risks to human rights, now and in the future. While there may be ways to minimise the impact on human rights in the implementation of specific apps, no app will be able to fully remove the risks to human rights. Given these risks, states must demonstrate why contact-tracing apps are relevant and justified in meeting the goal of preventing the spread of Covid-19, particularly once lockdown is lifted, using scientific evidence and show that no less rights-invasive solutions are available. Unless they can make this case, contact-tracing apps should not be introduced and where they have already been rolled out, they should be withdrawn.

Photo by engin akyurt on Unsplash.