ABSTRACT

For over a century, contact tracing has been an integral public health strategy for infectious disease control when there is no pharmaceutical treatment. Contact tracing for the coronavirus disease COVID-19 introduced a variety of automated methods deployed across several countries. The present paper examines privacy risk to infected persons and their physical contacts in contact tracing systems. Automated contact tracing systems implemented during the early months of COVID-19 are compared to conventional manual methods. Solove’s taxonomy of privacy is applied to examine privacy risks in both conventional and automated contact tracing systems. As a method of epidemiological surveillance, all contact tracing systems inherently incur privacy risk. However, compared to conventional methods, automated contact tracing systems amplify privacy risk with pre-emptive data collection on all app users, regardless of exposure to an infectious disease; continuous, granular data collection on all users’ location and proximity contacts; insecurities in proximity app technologies and interconnectivity; and in many cases, the use of centralised systems. Reducing these risk factors can reduce privacy harms, such as identification, distortion, secondary use, stigma, and social control.

摘要

一个多世纪以来，在没有药物治疗的情况下，接触者追踪一直是传染病控制不可或缺的公共卫生战略。冠状病毒疾病 COVID-19 的接触者追踪引入了在多个国家/地区部署的多种自动化方法。本文研究了接触者追踪系统中感染者及其身体接触者的隐私风险。将在 COVID-19 的最初几个月实施的自动接触者追踪系统与传统的手动方法进行了比较。Solove 的隐私分类法用于检查传统和自动联系人跟踪系统中的隐私风险。作为一种流行病学监测方法，所有接触者追踪系统都固有地存在隐私风险。但与传统方法相比，自动接触者追踪系统通过对所有应用程序用户进行先发制人的数据收集来放大隐私风险，无论是否接触过传染病；对所有用户的位置和邻近联系人进行持续、精细的数据收集；邻近应用程序技术和互连性的不安全性；在许多情况下，使用集中式系统。减少这些风险因素可以减少隐私危害，例如身份识别、歪曲、二次使用、污名化和社会控制。