Tech, data and the pandemic: Reflecting for next time

Tech, data and the pandemic: Reflecting for next time

Introduction

Responding to a pandemic is more than just the mobilisation of the health system and adaptation of scientific research; the response is also a creature of the tools and measures available to respond.

Governments and companies chose to use this pandemic to test a series of new and innovative measures alongside the traditional ones. A pandemic is an extraordinary time and using available tech capabilities and data is common but can also be extra-ordinary. They can also provide the rubric for a post-pandemic future, institutionalising some practices and infrastructure for the next public health response, or the next emergency, or the “new normal” normalising surveillance and control of people and communities.

Context matters: A slightly different pandemic

Every virus and so every pandemic is unique. And the SARS-CoV-2 or “COVID-19” was indeed novel. Some of its unique aspects are worth noting.[1]

While public health experts may find better terminology for capturing these, in our understanding these considerations help to explain the challenges of this particular pandemic:

• The virus was primarily airborne.
• You could be asymptomatic and still transmit the virus.
• You could be vaccinated and still transmit the virus to others.
• You could repeatedly become infected.
• The virus mutated in ways that could escape some elements of the deployed vaccines.
• Elements of the vaccines’ effectiveness may reduce over time.
• Booster vaccinations could be used to increase the body’s defences against the virus.

It’s also worth noting that none of this was known when the pandemic began, and it trickled in over the course of the pandemic. Whether through a lack of transparency, or the length of time scientific knowledge takes to develop and permeate, or the evolving nature of the virus itself, public health professionals and governments had to take decisions in the absence of complete knowledge. This is entirely understandable, and it was commendable that innovative solutions were sought.

However, as the pandemic became better understood, and now that we can begin to see its full nature, we must reflect on whether “innovative solutions” were sought because the underlying fabric of public health and welfare was so frayed from decades of under-investment and if there was an over-investment in shiny “innovative solutions” rather than sustainable, systemic, fair and people-centred solutions.

To a degree you can track some tech and data responses alongside the available knowledge of the time and see that the best available knowledge was used to decide the best available responses. Some responses, however, became disassociated with the emerging knowledge. Regardless, too many crossed the lines of ethics, the law and good tech practice into opportunism, repression and tech-solutionism.

A typology of responses

By reflecting on the implications of some of the measures deployed by governments, industry and other third parties,[2] we can begin to assess the scale of data processing activities that took place and continue today.[3] This assessment can help us to understand the magnitude of the challenge we face and will continue to face to protect people and their rights.

Measures adopted by governments and enabled by industry

The decisions made by governments around the world varied as the pandemic evolved and was experienced in different ways at different stages. Nonetheless there were some common approaches and tactics.

Quarantining and lockdown enforcement

Quarantining was a top first response by governments. Once someone could be identified as having symptoms relevant to COVID and once tests were developed to identify someone as having COVID, governments would move them to quarantine.[4] Eventually the virus spread, so governments reached to lockdowns as a public health response. Even after lockdowns ceased, quarantine requirements were imposed on individuals and groups following exposure (often arising from contact tracing), or upon the development of symptoms (which led to contact tracing) or for people who travelled. These sustained measures had tragic implications for people in vulnerable situations.[5]

In all these cases data and tech could be used, and in many cases, were used for quarantine enforcement. First, telecommunications data was sought from telcos to identify if someone was moving around when they did not have authority to do so due to quarantine or lockdown.[6] A leading example of this was Israel, where the government tasked the Israeli security service Shin Bet to track mobile phones to curb the spread of the virus.[7] Similar attempts were made in Kenya,[8] South Africa[9] and Mexico.[10] Other data sources were proffered by industry, including data held by data brokers and other data aggregators based on smart phone apps, leaking data to assess the extent to which there was public adherence to caution and lockdowns.

Governments then started check-ins (done by government contacting individuals or individuals reporting to authorities) and used police powers of generalised monitoring (e.g. CCTV, facial recognition, drones)[11] or stop and search powers to ensure that individuals were complying with orders.

Apps were sometimes used for quarantine enforcement, for example, in Abu Dhabi[12] and Myanmar.[13] These could disclose location data through GPS or other automatic means, or compel an individual to report their location data manually.

Contact tracing

Contact tracing can be an essential public health surveillance response to a transmissible virus.[14] If someone tests positive, contact tracing allows the ability to identify individuals who may have been exposed to that individual while they were contagious.

In this pandemic, particularly in the early stages when it was unclear how the virus was transmitted, governments scrambled to use vast amounts of data to undertake contact tracing.[15] Some governments would search data stores in geographic locations where a COVID-positive person was known to have been (e.g. CCTV, restaurant billings, and other data sets stored more centrally, such as financial transactions or transport data).[16]

Mobile phone apps were also developed.[17] These apps could use mobile phone data to detect proximity with other individuals. Bluetooth was eventually the selected technology in most countries’ apps, alongside a decentralised infrastructure using pseudonymised data.[18]

Concerns about the effectiveness of proximity tracing using Bluetooth technologies were coupled with longstanding privacy concerns of using telecommunications data to track individuals.^[19] Reports of the repurposing of contact tracing apps for law enforcement goals have emerged in Australia,^[20] Germany^[21] and Singapore.^[22] There were also examples of function creep with contact tracing apps used to enforce lockdown measures and control crowds.^[23]

Furthermore, organisations around the world documented the lack of privacy safeguards built into the design and implementation of contact tracing apps, including our global partners in Colombia,^[24] the Philippines,^[25] Chile[26] and Peru,[27] while others reported a disproportionate negative impact on marginalised groups including women and minority groups, and the criminalisation of communities leading to discrimination and stigma.^[28]

Border management

Governments started closing borders in March 2020 when the World Health Organization (WHO) declared COVID-19 a pandemic;[29] and when they slowly reopened, surveillance was embedded in new processes for travellers. It is important to note that these additional measures were added to an already vast surveillance infrastructure at the border and beyond to monitor travellers.[30]

Quarantining was often required for travellers. The use of “testing for release” became more commonplace as testing infrastructure improved. Testing prior to travel meant that government agencies and a myriad of private sector firms were starting to be custodians of vast amounts of personal data about travelling families, including custodians of their test samples and results. The travel industry also began to gain access to vast amounts of new sources of data on travellers, including their detailed biographical and family documentation (e.g. marriage certificates, birth certificates) to prove family composition to travel to some locations depending on restrictions.[31]

Certification

There was limited global harmonisation in the approach to both the use and purpose of COVID-19 certification documentation. The uses of the certificate varied considerably across the globe. The certificates could identify “immunity”, meaning that someone had previously been infected, or “vaccination” if they had received a vaccine, or if they had been tested recently.

Some governments, including Israel,^[32] France^[33] and Italy,^[34] among others,^[35] required the mandatory provision of a certificate to allow access to public life and activities such as public venues like restaurants or cultural events. While others never fully developed a policy on their use,^[36] and with the pandemic having evolved, other pending plans for certification have been dropped,^[37] including for international travel in some instances.^[38]

In particular, the mandatory approach to COVID-19 certification raised some serious concerns in terms of discrimination and the impact on already marginalised communities in contexts where access to vaccination was unequal and remained problematic in many parts of the world.^[39] These risks and harms were also highlighted by the WHO in its guidance and aligned with its position that such mandatory requirements should not be introduced, at least in the context of international travel, “given that there are still critical unknowns regarding the efficacy of vaccination in reducing transmission.”^[40]

As time went on and boosters became deployed, some countries decided to extend the nature of the proof required. That is, your vaccine passport lost some of its “passport” capacity if you had not received more recent boosts. This was in theory to induce people into getting a third or fourth vaccination. But with equitable access to vaccination still being of concern, requiring certification of boosters remained highly controversial.[41]

Mass monitoring

Public health surveillance may involve wide-scale monitoring.[42] Usually this is done with the knowledge and the consent of the patients, but rarely with people one level removed from them (i.e. contacts or others in proximity).

In this pandemic public health surveillance expanded in some new ways. Temperature checks on people entering buildings became more common.[43] This was a surprising development considering not everyone who had COVID necessarily was symptomatic, and not everyone with a temperature was necessarily carrying COVID.[44]

Governments also sought to use and expand their existing mass surveillance tools for this pandemic.[45] This entailed population-level or geographic analyses using metadata, CCTV, and eventually drones[46] and facial recognition[47] to identify the movement of people.[48] The private sector has been instrumental in instigating and pushing for many of these tools, as it already did before COVID-19.[49]

The private sector embeds itself further into our lives

Building on years of lobbying and investment, and a propensity to identify opportunities to sell its products, industry was quick to identify this global pandemic as yet another hook to push up their sales, and reinforce their influence in many areas of our lives from our work to our education to intimate spaces such as our health needs.

The pandemic challenged the momentum that had been building as a result of a decade of policy making around the world aimed at reining in the power and dominance of industry. The result was worse than mediocre.[50] Below we outline various sectors where industry entrenched itself further as a result of the pandemic, with little scrutiny, transparency or accountability.

Education

While prior to the COVID-19 pandemic, there was already growing investment in the provision of information and communication technologies in the educational sector, known as “edtech”, particularly by the private sector, this expanded drastically during the pandemic to enable children and adults to pursue their education online for various periods of time over the course of the pandemic.

Primary, secondary and tertiary education across the world adopted emergency remote learning measures with the uptake of education technologies – extending into homes during closures, into classrooms when reopened, and beyond.^[51] This urgency of the demand for remote learning tools opened an opportunity for private companies to sweep in and offer their solutions with limited or no due diligence mechanisms to consider and respond to the impact of their adoption. Some countries expanded pre-existing infrastructure, but for many such infrastructure was not in place.^[52] We saw the rapid uptake of virtual platforms like Zoom^[53] and Blackboard,^[54] the expansion of initiatives provided by companies like Google^[55] as well as the use of open-source platforms such as Moodle and Canvas.

In addition to privacy concerns, this has raised concerns in terms of ensuring the right to education with the entrenchment of existing socioeconomic inequalities associated with an increased reliance on technologies which are not only unequally distributed, but distributed with uneven quality of access.^[56]

Health care

The data and tech industry had identified the health sector as a fertile ground for data exploitation well before the COVID-19 pandemic.^[57]

Since the start of the pandemic, companies all over the world have pitched data products, services and solutions to COVID-19 – from big tech to companies that might not be household names. Well-known software companies like Palantir invested in a COVID-19 response by offering health data management solutions to countries across the globe.^[58]

Furthermore, with the need at certain points in the pandemic to limit in-person interactions and limitations in reaching those in diverse geographic locations as a result of restrictions on movement, telemedicine experienced a global boost.^[59] Diverse tools have been used, from real-time, video-based health consultations and advice, to health monitoring apps/software and sensor-based systems, among others.^[60] As few governments develop their own software and hardware or infrastructure, industry has already played different roles, from providing digital health initiatives such as mass, centralised databases for patient management to the use of applications and other digital tools for the delivery of care.

While they have the tools and resources, with many having shaped their business models around data exploitation and surveillance, we need to ensure that whatever contributions companies make in the health care sector improve access to and quality of care while protecting people and their rights.[61]

Employment

Employees and workers were dramatically impacted by this pandemic, and then by government and employers’ responses. The private sector swept in with their products, with many being deployed with very limited or no consideration for the risks associated with them for workers, their rights, and their well-being.^[62]

Remote working forced employers to expand or adopt a new digital infrastructure to enable their employees to work using online platforms for communication, and cloud solutions to share documentation and information, among other tools to enable the day-to-day operations of their businesses.^[63] As this evolved and grew, we saw a shift that led to measures focused on surveillance and constant monitoring of workers to keep track of performance and efficiency.^[64]

Another result of lockdown measures and other limitations on movement has been the boom in home delivery applications and other gig economy sectors such as transportation.^[65] This is a sector where there has been unprecedented surveillance that gig economy workers are facing from their employers. We are all coming to finally recognise and listen to concerns around the labour rights of the gig economy workforce and how the experience of these workers is being shaped by platforms they have little or no control over.^[66]

Future proofing

We all experienced this pandemic, and we all have our own set of reflections about what worked or didn’t. At Privacy International we worked with partner organisations across the world, engaged with governments, and worked with international organisations and industry as we all struggled through appropriate responses. Throughout we can say that much was missing: adequate public health resources and infrastructure, fairness in access, equality in rights and capability, trust and confidence. And yes, data about the virus.

Now, looking back from wherever we are within this pandemic, we are very concerned that governments and industry are only focusing on the problem of inadequate data. If that is the only lesson, then the calls for more data and tech will follow – which means more tech sector in our health care, more data sharing, and more exploitation. That will all come at the cost of increased social protection. And it will predicate future responses, arming public health responses to prioritise strict quarantine enforcement rather than helping people to care for themselves and others; coercion and compulsion over public educational programmes; profiling, identification and rationing over open access to public health services.

In addition to the direct measures deployed to respond to the health crisis, there is a need to scrutinise what shifts occurred across sectors, from the delivery of health care, to employment settings and remote learning, in a moment of panic and urgency with few measures subject to the necessary deliberations. This is necessary before current problematic practices become the foundation of our day-to-day lives in which industry has been let in, but should now be showed the way out or at least put back in its place.

The COVID-19 pandemic showed how fragile our protection framework is when it comes to protecting people, their rights and data. Governments and companies were too easily able to deploy digital initiatives with little scrutiny, limited transparency, and weak accountability.

Starting now and going forward, we must reflect on these lessons to identify where and how we must spend our energy to strengthen the protection of people and their data, and to hold governments, companies and other third parties to account across the human rights protection framework. This is critical in advocating for people’s fundamental rights and freedoms, from privacy to the right to health, education, fair working conditions, non-discrimination, and freedom of movement, among others. There will be future emergencies. We must be ready.