Privacy versus Public Health? A Reassessment of Centralised and Decentralised Digital Contact Tracing

Abstract

At the beginning of the COVID-19 pandemic, high hopes were placed on digital contact tracing. Digital contact tracing apps can now be downloaded in many countries, but as further waves of COVID-19 tear through much of the northern hemisphere, these apps are playing a less important role in interrupting chains of infection than anticipated. We argue that one of the reasons for this is that most countries have opted for decentralised apps, which cannot provide a means of rapidly informing users of likely infections while avoiding too many false positive reports. Centralised apps, in contrast, have the potential to do this. But policy making was influenced by public debates about the right app configuration, which have tended to focus heavily on privacy, and are driven by the assumption that decentralised apps are “privacy preserving by design”. We show that both types of apps are in fact vulnerable to privacy breaches, and, drawing on principles from safety engineering and risk analysis, compare the risks of centralised and decentralised systems along two dimensions, namely the probability of possible breaches and their severity. We conclude that a centralised app may in fact minimise overall ethical risk, and contend that we must reassess our approach to digital contact tracing, and should, more generally, be cautious about a myopic focus on privacy when conducting ethical assessments of data technologies.

Digital Contact Tracing Solutions: Promises, Pitfalls and Challenges

“…1) Effectiveness: Although GAEN-based apps have been deployed in many countries since 2020, their contributions with regard to confining the spread of the pandemic have been heavily disputed. Indeed, several existing studies raise serious questions concerning the effectiveness of GAEN-based apps [8], [33], [34] as well as the trustworthiness of the self-reported effectiveness of some GAEN-based apps. For example, a report of Wymant et al [2] states that 6,1% of users who got notified via the NHS Covid-19 App were eventually tested positive.…”

“…Vaudenay et al, [29] x x x x x GAEN DP3T PEPP-PT Wen et al, [43] x Data collection 41 apps White et al, [8] x x x x DCT White et al, [33] x To establish an 𝐸𝑇, the device need to send and receive an AM and 𝑄 that are 192 + 520 = 712 (bits) or 712 *2 = 1,424 (bits) for both sending and receiving. In the worst case, the BLE bandwidth is 125 (kbit/s) that means the app can establish 125,000/ 1,424 = 175 𝐸𝑇s per second.…”

Digitizing health data for public health protection in the context of European and international coordination

“…Intuitively, and subject to the premise of sufficient participation, the centralized option with fewer guarantees should make a significant contribution to the fight against the pandemic, greater than that produced by the decentralized option, and some researchers [13] believe that the mistake was not to bet on the centralized system, flanked by public communication designed not to instil fear in citizens and to clarify the advantages in terms of health.…”

Evaluating the Dynamics of Bluetooth Low Energy Based COVID-19 Risk Estimation for Educational Institutes

“…However, the users have privacy concerns as centralized model can result in mass population surveillance. Decentralized model gives the contact update authority to the user lowering privacy concerns while slowing the pace of contact tracing due to user unwillingness to share data [ 17 , 30 ].…”