THE HAGUE--Tracker apps have been identified as a key part of the Dutch government’s strategy to lift the coronavirus restrictions after April 28, but the prospect of people’s medical details being collected and shared has raised concerns about the implications for privacy.
Prime Minister Mark Rutte said on Tuesday the government was studying two possible types of app – one to alert people if they had been in contact with someone who was later diagnosed with COVID-19, and another to keep potential patients in touch with doctors.
Rutte and Minister of Public Health, Welfare and Sport Hugo de Jonge stressed that guaranteeing privacy was a precondition of any technological approach to tackling the virus and said that people’s consent would be sought. However, the government has not ruled out that using the apps would be compulsory.
Head of the Netherlands Data Protection Agency (DPA) Aleid Wolfsen said the technology included a real risk of intruding into people’s personal lives.
“What we are seeing now is exceptional and historic. I admire the way people have adapted surprisingly quickly to the new situation. Measures have been widely adopted and that’s fantastic,” he told the Algemeen Dagblad (AD) newspaper. “At the same time, it makes sense for us to think about the consequences, such as tracking people. The real art is to maintain the balance between privacy standards and the changing circumstances,” he said.
Wolfsen said sharing details about people’s whereabouts using technology such as Bluetooth, which can track if people’s mobile phones have been in close proximity, was potentially very intrusive.
“Data can only be shared if you have given permission or when it’s anonymous. A measure like that has to be clear, proportionate to its aim and include sufficient safeguards. We will be checking these points carefully if any such law is proposed.”
Chairman of the managing board of chemicals company DSM Feike Sijbesma, who is one of the government’s special envoys on coronavirus, said the Netherlands was already studying apps used in other countries that allowed data to be shared anonymously.
“In those countries where it’s being used people are pleased that they know when they’ve been in contact with a patient,” he said in Het Parool newspaper. “The details aren’t shared on the basis of your name. It just says: somebody was in your vicinity.”
Anonymous codes
Technology expert Ronald Prins, who set up cybersecurity company Fox IT, told AD that privacy could be protected using anonymous codes. Users of the app would be traced via a number that was kept separate from their personal details and their location details would not be stored – only information about who they had been in contact with.
Prins said a tracker app could be an effective means of containing the virus even if not everybody used it. “Even if only 70 or 80 per cent install the app, it will be a huge help to those fighting the virus. I think there will be plenty of support for it.”
Prins’ main concern was that the speed at which the app would need to be rolled out could leave it vulnerable to hackers or security breaches. “Apps like these can be made with good intentions, but mistakes can be made in programming. Normally you would spend months testing them and let hackers try to break into them, but there isn’t much time for that here.”
Legal issues
Legal expert Christiaan Alberdingk Thijm said the government could run into difficulties if it tried to make the use of tracker apps compulsory, even if it used the justification of protecting public health.
“The basic principle is that medical details can only be distributed with somebody’s permission. It is possible to share information without permission in the interest of public health. But it would have to be absolutely necessary to use such an app. They would have to prove that there is no other way to protect public health. I seriously question whether the government would be able to do that.”
Wolfsen said people’s need for safety should not blind them to the risks of the government or employers encroaching on their private lives. He told AD he had received calls from employers asking if they were entitled to check their workers’ temperatures at the office.
“Employers cannot play doctor,” he said. “People decide for themselves what they share about their illness and that hasn’t changed. Employers do have a duty to create a safe environment for their employees and can give instructions such as keep your distance and stay home if you’re ill.
“At times like this we need to be extra alert,” Wolfsen said. “Once the crisis is behind us, you can say to your employer: ‘I shared this with you under these circumstances, but I don’t want that information to be stored or used.’ It’s like the right to be forgotten on Google. I’d advise everyone to look back later and see if they didn’t share too much information. The essence of it is: you’re the boss.”
