Background During the COVID-19 pandemic, contact tracing apps have received a lot of public attention. The ongoing debate highlights the challenges of the adoption of data-driven innovation. We reflect on how to ensure an appropriate level of protection of individual data and how to maximize public health benefits that can be derived from the collected data. Objective The aim of the study was to analyze available COVID-19 contact tracing apps and verify to what extent public health interests and data privacy standards can be fulfilled simultaneously in the process of the adoption of digital health technologies. Methods A systematic review of PubMed and MEDLINE databases, as well as grey literature, was performed to identify available contact tracing apps. Two checklists were developed to evaluate (1) the apps’ compliance with data privacy standards and (2) their fulfillment of public health interests. Based on both checklists, a scorecard with a selected set of minimum requirements was created with the goal of estimating whether the balance between the objective of data privacy and public health interests can be achieved in order to ensure the broad adoption of digital technologies. Results Overall, 21 contact tracing apps were reviewed. In total, 11 criteria were defined to assess the usefulness of each digital technology for public health interests. The most frequently installed features related to contact alerting and governmental accountability. The least frequently installed feature was the availability of a system of medical or organizational support. Only 1 app out of 21 (5%) provided a threshold for the population coverage needed for the digital solution to be effective. In total, 12 criteria were used to assess the compliance of contact tracing apps with data privacy regulations. Explicit user consent, voluntary use, and anonymization techniques were among the most frequently fulfilled criteria. The least often implemented criteria were provisions of information about personal data breaches and data gathered from children. The balance between standards of data protection and public health benefits was achieved best by the COVIDSafe app and worst by the Alipay Health Code app. Conclusions Contact tracing apps with high levels of compliance with standards of data privacy tend to fulfill public health interests to a limited extent. Simultaneously, digital technologies with a lower level of data privacy protection allow for the collection of more data. Overall, this review shows that a consistent number of apps appear to comply with standards of data privacy, while their usefulness from a public health perspective can still be maximized.

BACKGROUND The ongoing COVID-19 pandemic has resulted in the rapid implementation of data-driven innovation, as part of the efforts to curtail the spread of the virus. However, not all digital solutions have been launched expeditiously. A case in point is the adoption of contact tracing mobile applications, although they triggered a debate regarding the issue of data privacy. The objective of our study is to discuss the effective use of digital solutions that are in compliance with data privacy regulations. OBJECTIVE To address the question how to strike the balance between the data accessibility and data confidentiality to ensure the greatest benefit of contact tracing mobile applications. METHODS A systematic review of Pubmed, Medbase, and grey literature was performed. To ensure a standardised approach for reviewing contact tracing applications, two checklists assessing both effectiveness and compliance with data privacy were developed. Based on a scorecard comprising 16 criteria, the ranking of digital solutions was also conducted. RESULTS Overall, 18 applications were reviewed. While seven provided a definition of contact tracing, eight allowed for COVID-19 test result verification and only one defined the efficiency threshold. Explicit consent was requested in 15, and anonymisation techniques and data retention were provided in 14 and 13, respectively. Compliance with data minimisation in terms of Bluetooth was reported in seven cases. Principally, 10 applications collected additional information, of which six adopted anonymisation and/or aggregation for data sharing with a third party. The decentralised approach was identified in eight of 18 cases. With regard to ranking, COVIDSafe received the maximum score (15 of 16 points), while Alipay Health Code ranked last (-3 of 16 points). CONCLUSIONS The compliance with data privacy was the highest with respect to explicit consent and data retention while the lowest with respect to data minimization and sharing in anonymised and aggregated manner. There is still a room for improvement in terms of the usefulness of digital contact tracing in the compliance with data privacy regulations.