Google and Apple are collaborating on contact-tracing technology that allows for better communication between the two operating platforms to help alert individuals that may have crossed paths with a confirmed COVID-19 case. The two companies noted in a joint statement issued earlier this month, “[W]e hope to harness the power of technology to help countries around the world slow the spread of COVID-19 and accelerate the return of everyday life.” Apple and Google have vowed to disable the exposure risk service once the outbreak is sufficiently contained. Key to the success of the technology will be the voluntary submission by the user of their positive COVID-19 diagnosis.
China, Singapore and Israel have already utilized contact-tracing applications (apps) that have reportedly been marred with concerns about invasive data collection. More than two million out of 25 million Australians have downloaded a government-made contact-tracing app, as of 27 April. In the US, some lawmakers are raising concerns with data collected from American citizens by such technology, while some local government officials are moving forward with plans to expand traditional contact-tracing programs to reopen their economies. In the European region, governments are also moving forward with contact-tracing apps, while defining some parameters for collected and stored data. This report touches on contact-tracing apps as a possible tool for helping to return employees to the workplace and provides an update on the trade negotiations between the UK and the EU.
US Contact-tracing Initiatives
As various US states are looking to reopen their economies, key to stemming a resurgence of COVID-19 cases is quickly identifying new infected persons and those with whom they had recent contact. On 22 April, New York Governor Andrew M. Cuomo and former New York City Mayor Mike Bloomberg announced a COVID-19 contact-tracing program using individuals to interview and trace infected persons to control the infection rate of the disease. The more traditional contact-tracing program would extend to the adjacent states of New Jersey and Connecticut and is envisioned to serve as a model that could be replicated across the nation. A disadvantage of the traditional approach to contact tracing is it takes time to conduct interviews with infected persons and notify others of their potential exposure to the disease; individual privacy is preserved, though the process is not voluntary for infected persons.
Technology could more quickly identify and trace infected persons, which in turn could help rapidly return employees to work. In their joint statement, Google and Apple noted their efforts would “enable the use of Bluetooth technology to help governments and health agencies reduce the spread of the virus, with user privacy and security central to the design.” In the United States, the Google-Apple initiative does not involve the U.S. Government, which some believe may be more reassuring to American citizens, given ongoing concerns with privacy in the aftermath of the 11 September 2001 terrorist attacks. It remains unclear whether Americans will embrace a contact-tracing app, or if the more traditional contact-tracing program will be the choice for helping reopen the US economy.
After the 2001 terrorist attacks, the US Congress passed the Uniting and Strengthening America by Providing Appropriate Tools to Restrict, Intercept and Obstruct Terrorism Act of 2001 (more commonly known as the PATRIOT Act), which allowed the Federal Bureau of Investigations (FBI) to search telephone, e-mail and financial records without a court order. It also expanded access of law enforcement agencies to business records, including library and financial records. While some provisions of the law were later found to be unconstitutional, subsequent action by Congress further enshrined the US Government’s ability to engage in wiretapping and roving wiretaps, searches of business records and conducting surveillance of potential lone wolf terrorist suspects.
While Americans may have been willing to cede some privacy rights to assist in deterring terrorist attacks, a number remain opposed to what they see as further infringement on their privacy rights. Lawmakers have therefore expressed privacy and security concerns with respect to the data collected via contact-tracing technology. Senator Richard Blumenthal (D-Connecticut) recently said, “I urgently want to know how Apple and Google will assure that consumers’ privacy interests are strongly balanced with the legitimate needs of public health officials during the coronavirus pandemic.” A spokesperson for the American Civil Liberties Union appeared to be cautiously supportive of the Google-Apple effort, while adding, “We will remain vigilant moving forward to make sure any contract tracing app remains voluntary and decentralized, and used only for public health purposes and only for the duration of this pandemic.”
Questions abound, such as how long should the data be stored, who has access to such data, where the data is stored and how it is secured. We anticipate there will likely be some congressional hearings to examine the contact-tracing technology apps and software in the coming weeks, particularly as Congress returns to Washington. It remains unclear whether legislative efforts will also seek to define data privacy parameters and limitations for this technology and more broadly for the technology sector. The Senate is scheduled to reconvene next week, while the House has postponed its return to Washington, citing concerns with the recent increased rate of COVID-19 cases in the nation’s capital.
European Contact-tracing Programs
At the early discussions of developing digital contact-tracing applications in Europe, many questioned whether such an approach would be legally allowed under EU law. However, the fact that European governments act on the premise of using one or another form of emergency legislation, provides them with ample legislative power to ensure that whatever they want to do is lawful, while guaranteeing compatibility with human rights legislation. The advantage with such an approach is that the emergency powers will lapse, when the emergency is over.
According to guidelines released by the Council of Europe, digital contact-tracing systems should rely on the processing and storing of data on devices rather than via cloud services. This comes as governments consider the use of contact-tracing apps to ease lockdown measures. The European Parliament and Commission has similarly advised using decentralized designs that store data on devices, and while Europe’s data protection authorities backed both systems, they have expressed a preference for device storage (European Data Protection Board guidelines available here). These guidelines caution that neither model will protect or prevent vulnerabilities or risks of identity theft. However, to ensure compatibility with the EU data protection standards, when such applications are developed they will most certainly come with consents built into their provisions.
Notably, the European Commission issued a Common EU toolbox for Member States on 16 April for mobile apps that support contact tracing in the EU’s fight against COVID-19, accompanied by a data protection focused guidance on the use of such apps. The Commission in collaboration with the e-Health Network developed the common EU toolbox. The related methodology is voluntary and fully compliant with European data protection and cybersecurity standards of anonymized data. If chosen as a methodology for contact tracing, it should be implemented and approved by public health authorities.
The German Government has moved away from its initial preference of a centralized approach and will instead adopt a decentralized approach to the operation of contact-tracing apps. This approach allows contact-tracing apps to collect anonymous data about nearby mobile phones using Bluetooth technology through tools such as the ones Apple and Google are devising. Once an infection is confirmed, that information is sent to a server; those using the app could learn if they had been in proximity to a confirmed infection without revealing the patient’s identity. Deutsche Telekom AG and software company SAP AE have teamed up to develop a contact-tracing app for Germany. The country is expected to roll out the voluntary scheme in the coming weeks. Germany reversed course after a group of six organizations urged the government to reassess plans for a smartphone app that did not do enough to protect user data.
By contrast, France has opted for a centralized approach and is developing the “StopCovid” app, with discussions ongoing and a debate and vote on the project due to take place before 11 May. A centralized approach allows individual’s contacts to be uploaded to government servers where authorities then decide who to inform of a possible infection.
The UK is also undertaking a centralized approach; its coronavirus contact-tracing app is expected to be ready for a localized trial in two weeks. Matthew Gould, CEO of NHSX, told Members of Parliament that his team is working on the software non-stop and they expect the app to be technically ready in two to three weeks for wider deployment, subject to trials. This will depend on the UK’s wider strategy of testing, tracing and isolating infected persons.
In Italy, a contact-tracing app developed called “Immuni” has been endorsed by the Italian Data Protection Authority, as it does not appear to be in breach of data protection principles. It is unclear whether the app will use a centralized or decentralized design for data storage.
Apple and Google have both pledged to bolster privacy as they work to make these apps easier to use on their platforms. The two companies have now started opening up their systems to early trials for national health authorities that are in the process of creating contact-tracing apps. It is unclear yet whether governments will use the technology offered by Apple and Google due to privacy concerns, or opt for their own digital tracking services. Either way, due to the existing civil liberties limitations the government is imposing within the lockdown measures, it is possible that privacy campaigners would not be pushing for an absolute adherence to privacy within these apps.
Finally, one of the many concerns and uncertainties regarding the usage of contact-tracing applications relates to whether employers would have any access to app data, or the ability to require employees to use them. One example in particular is whether monitoring temperatures of employees at the workplace would be compatible with national employment law. Considering that employers have “track and trace” equivalent obligations at the workplace, whereby they can convince employees to have their temperatures monitored, or ask them to wear personal protective equipment, one could argue that they could also compel them to use apps which can help to indicate the potential to be infectious. Therefore, some employers may be looking at putting in place their own apps to enable them to fulfil these obligations. For the employer, it is a fine balance between the duty of care for the workforce as a whole, and the duty of care for the individual within the workplace.
UK-EU Trade Talks
Following the second round of Brexit negotiations held between 20 and 24 April, Michel Barnier, the EU’s head of task force for relations with the UK, released a statement describing the negotiations as “surreal” and “out of touch.” Barnier said both parties need to be “realistic” about key deadlines that have been set by law (30 June 2020, when it will be decided whether the transition period should be extended, and 31 December 2020, the so-called “economic
Brexit”). Barnier also discussed being realistic in the context of the ongoing COVID-19 economic crisis and seeking an intelligent agreement that could limit the shock of the UK’s departure from the Single Market.
It has to be noted that the delay in the negotiations is exacerbated by a fundamental disagreement between the EU and the UK about the structure of the future relationship. The EU favors an overarching partnership agreement that will be the basis for the current negotiations, while the UK prefers a series of separate agreements with no common mechanisms between them.
In Barnier’s opinion, meaningful progress needs to be achieved by June in order to reach an agreement that honours the parties’ interdependence. He added the goal of achieving parallel progress in all areas is likely only to be partially attained, noting the UK is refusing to engage on some fundamental issues. According to Barnier, progress has been weak in key areas, including: (1) achieving a level playing field via a trade deal (the UK has stressed sovereign independence and has reportedly not engaged substantively); (2) addressing overall governance of the future partnership; (3) ensuring police and judicial cooperation in criminal matters (the UK has reportedly refused to provide firm guarantees on fundamental rights and individual freedoms); and (4) addressing fishing matters. With respect to the last issue, the UK has been clear that continuing the Common Fisheries Policy (as the EU prefers) is non-negotiable.
While the UK readout describe the talks as “full and constructive,” it also noted “limited progress was made in bridging the gaps between us and the EU.” With only two rounds of negotiations left, it appears tangible progress has yet to be made in the talks.
Looking ahead, the meeting of the Specialised Committee on the Protocol on Ireland/Northern Ireland is scheduled to occur on 30 April. The EU has made clear that it requires the UK to demonstrate it is advancing the introduction of agreed customs procedures for goods entering Northern Ireland from Great Britain.
Meanwhile, the head of the European Parliament’s Trade Committee has said the EU should prepare for a no-deal Brexit, suggesting the bloc organize its trade relations with the UK as it does with the US. On 28 April, AmCham EU released its position paper on the future relationship between the EU and the UK acknowledging that the uncertainty surrounding the negotiations in combination with the ongoing pandemic will almost certainly contribute to a period of economic downturn in Europe and beyond. They further argue an ambitious trade agreement with deep and comprehensive links, along with preservation of the Single Market, will remain key drivers for US investments in the region.
We have offices in Washington DC, Brussels, and London, and continue to track closely the transatlantic trade negotiations and regional trade-related developments. Please reach out to us if you have any issues of particular concern.