Balanced mobile data initiatives are vital in the COVID-19 fight

Data-powered decisions

As more governments introduce nationwide lockdowns to prevent the spread of coronavirus, what data are – and should – they be analyzing to inform vital decisions about public health? Following World Health Organization recommendations to ‘test, test, test’, one key source of data comes from test results*, helping officials measure confirmed cases and track the treatment of those already classified as infected. Politicians then vary their public health measures according to the geography and demographics of infected populations.

But most of these measures are reactive, catching up with infection at a comparatively late stage. Officials are taking some precautionary measures, such as isolating higher-risk individuals and requiring citizens to stay at home, but they may only be able to enforce these measures for a limited time.

As governments attempt to ‘flatten the curve’ longer-term, what data other than test data can they can examine and exploit? Several governments have tried to analyze other countries’ actions in this area to assess what worked and what didn’t. But acting on this information is not necessarily straightforward. While the ultimate goal across regions is the same – to delay and defeat the virus – regulatory room to maneuver will differ.

Location data: panacea vs. privacy

One key strategy in fighting the virus is to stay ahead of it using real-time information, and to act as quickly as possible to control the spread and manage available resources, such as hospital beds and ventilators. According to scientists at the Big Data Institute at Oxford University, mobile phone location data is the best source of data governments can use to control the epidemic. Research shows that people can spread the virus more before they exhibit symptoms, so knowing where they have been before they were classified as infected can be a vital factor in containing the spread.

Governments in countries such as China, South Korea, Taiwan and Singapore are using mobile location data to track infected individuals and those they may have been in contact with, and then immediately quarantining them. According to some reports, officials in the UK and the US are already discussing similar initiatives with telecommunication providers.

In these and other regions, however, the use of mobile data has privacy implications. In Europe, the European Data Protection Board (EDPB) has released a statement explaining that – in the public interest – GDPR allows the processing of personal data during epidemics without the need for consent. Nonetheless, the EDPB also emphasizes that other rules are in place to cover the processing of mobile location data. The European Union’s ePrivacy Directive states that operators can use location data only when it’s been anonymized, or with individuals’ consent. When this is not possible, the directive allows countries to introduce new measures to protect public safety (and share data in such a way that individuals can be identified), provided safeguards are in place (such as granting people the right to ‘judicial remedy’ and legal recourse**).

Both options can have problematic consequences. Governments (like those in Italy and Austria) analyze aggregated data, to get a general idea if people are self-isolating, but this compromises the depth of insight they can achieve. Alternatively they can draft emergency bills (with possible safeguards) that help them pull in better quality data, but with the potential for many complaints over privacy breaches and even years of legal action.

Strike a balance, now

Many European governments could baulk at the second option, given its potential timescale and cost. Assuming they do, they have two alternative routes they could take if they want to use individuals’ location data to slow the spread of coronavirus:

• Take the lead from countries like Singapore, which has released an app via which people can give consent for their location data to be shared as part of the fight against the virus (something similar is being worked on in the UK). With the right campaign, governments could encourage millions to participate. However, in some European countries limited smartphone ownership could reduce the overall effectiveness of app-based data, and the penetration of smartphones is significantly lower in older, higher-risk groups***. Similarly, those in poorer areas are likely to be higher-risk but less likely to have smartphones – potentially skewing the data, and any remediation attempts, toward better-off areas.
• Consider anonymizing data by either encrypting it or removing identifiable information. Techniques such as character masking and pseudonymization**** could offer anonymity and enable researchers to track movement in something close to real time, and data need only be stored for a limited time (two or three weeks, for example). Some initiatives along these lines are emerging, such as Private Kit: Safe Paths in the US, or ProteGO Safe in Poland. So far, however, as with the app approach, all these ideas rely on the assumption that people have access to smartphones.

An alternative is a combination of these two approaches, which the government in Slovakia may already be putting into practice. The country has passed a bill that establishes a monitoring system for people in quarantine (those already infected and visitors from abroad), with their consent. The data will be stored in the system for up to six hours and will only be available to Slovakia’s Public Health Authority. The bill can be enacted if the country declares a state of emergency, and will be in force until the end of 2020.

While governments focus on reducing the number of infections by introducing lockdowns, dedicated specialists should work on a digital-tracking approach that reaches as many people as possible while protecting their privacy at the same time. As some officials have pointed out, digital tracking is a lower priority in most countries while people are confined to their homes – but its value will increase significantly when lockdown measures are lifted, helping to prevent a second wave of infection like that happening in China and Singapore.

An increase in digital tracking also means that technology-related risks could rise, making this a crucial time for risk technology experts. Once developed, tracking models will have to be validated and stress-tested, and data must be protected against breaches (which have already increased since the coronavirus outbreak). Researchers must be able to audit data to track changes in the system, and edit it to correct errors that might mistakenly flag individuals as at-risk or healthy. The scale of the project could make this a data integrity and control challenge unprecedented in terms of size and speed. Building a resilient system takes time, but the urgency of the situation means that governments must act now to find ways to access and analyze near- to real-time data.

_{* To some extent, however, this depends on how much testing is going on. Usually, the more testing taking place, the more confirmed cases there are.}

_{** '...[t]he manner in which a right is enforced or satisfied by a court when some harm or injury, recognized by society as a wrongful act, is inflicted upon an individual.'}

_{*** According to estimates, 96% of adults in the UK used a mobile phone in 2018, whereas 79% of UK adults had smartphones in 2019. Usage decreases with age after the age of 34.}

_{**** The technique of replacing an identifier with an unrelated but unique value (replacing 'Jane Doe' with '873410578', for example).}

Further reading

• Spotlight on GDPR
  (May 2018, Chartis Research)
   
• Data Integrity and Control in Financial Services; Market Update 2018
  (March 2018, Chartis Research)
   
• Coronavirus is testing op risk managers to the limit
  (March 2020, Risk.net)
   
• On the Rise of SaaS, Cloud & Chaos: BCP in an Unknown World
  (March 2020, WatersTechnology)