The rapid dynamics of COVID-19 calls for quick and effective tracking of virus transmission chains and early detection of outbreaks, especially in the “phase 2” of the pandemic, when lockdown and other restriction measures are progressively withdrawn, in order to avoid or minimize contagion resurgence. For this purpose, contact-tracing apps are being proposed for large scale adoption by many countries. A centralized approach, where data sensed by the app are all sent to a nation-wide server, raises concerns about citizens’ privacy and needlessly strong digital surveillance, thus alerting us to the need to minimize personal data collection and avoiding location tracking. We advocate the conceptual advantage of a decentralized approach, where both contact and location data are collected exclusively in individual citizens’ “personal data stores”, to be shared separately and selectively (e.g., with a backend system, but possibly also with other citizens), voluntarily, only when the citizen has tested positive for COVID-19, and with a privacy preserving level of granularity. This approach better protects the personal sphere of citizens and affords multiple benefits: it allows for detailed information gathering for infected people in a privacy-preserving fashion; and, in turn this enables both contact tracing, and, the early detection of outbreak hotspots on more finely-granulated geographic scale. The decentralized approach is also scalable to large populations, in that only the data of positive patients need be handled at a central level. Our recommendation is two-fold. First to extend existing decentralized architectures with a light touch, in order to manage the collection of location data locally on the device, and allow the user to share spatio-temporal aggregates—if and when they want and for specific aims—with health authorities, for instance. Second, we favour a longer-term pursuit of realizing a Personal Data Store vision, giving users the opportunity to contribute to collective good in the measure they want, enhancing self-awareness, and cultivating collective efforts for rebuilding society.

COVID-19 的快速动态要求快速有效地跟踪病毒传播链并及早发现疫情，特别是在大流行的“第二阶段”，封锁和其他限制措施逐步取消，以避免或尽量减少传染病卷土重来。为此，许多国家正在提议大规模采用接触者追踪应用程序。应用程序感知的数据全部发送到全国服务器的集中式方法引发了对公民隐私和不必要的强大数字监控的担忧，从而提醒我们需要尽量减少个人数据收集并避免位置跟踪。我们提倡去中心化方法的概念优势，在这种方法中，联系人和位置数据都专门收集在公民个人的“个人数据存储”中，单独和有选择地共享（例如，与后端系统，但也可能与其他公民），自愿，只有当公民对 COVID-19 测试呈阳性时，并且具有隐私保护的粒度级别。这种方法更好地保护了公民的个人空间并提供了多重好处：它允许以保护隐私的方式收集感染者的详细信息；反过来，这既可以追踪接触者，也可以在更精细的地理范围内及早发现爆发热点。分散的方法也可以扩展到大量人群，因为只有阳性患者的数据需要在中央级别处理。我们的建议有两方面。首先轻触扩展现有的去中心化架构，例如，为了在设备上本地管理位置数据的收集，并允许用户在需要时以及出于特定目的与卫生当局共享时空聚合。其次，我们赞成实现个人数据存储愿景的长期追求，让用户有机会以他们想要的方式为集体利益做出贡献，增强自我意识，培养重建社会的集体努力。