Seite - 273 - in VULNERABLE - The Law, Policy and Ethics of COVID-19

273Privacy, Ethics, and Contact-Tracing Apps individual’s contacts, which could enable surveillance by the state or a bad actor.22 The more rigorous the privacy protection, the less that data are available to public health authorities. Some governments want contact-tracing apps to also provide data that might be useful for modelling and understanding the spread of COVID-19. Thus, not all jurisdictions will opt for the least privacy-intrusive apps. A privacy impact assessment (PIA) carried out on the Australian COVIDSafe app23 raised several important issues relevant to all contact- tracing apps. These included a need for data minimization in the col- lection of registrant data, as well as in the sharing with authorities of data about the duration and proximity of encounters after a posi- tive test. The PIA recommended that if technically feasible, only those contacts of sufficient proximity and duration to create risk of infection should be reported. The PIA also recommended that the government provide assurances that the data collected would be deleted after the end of the emergency period. It also recommended obtaining free and informed consent not just at the time of registration for the app, but also at the point when authorizing public health officials to collect digital handshake data (for example, the exchanged Bluetooth tokens) after a positive test. The PIA raised concerns about obtaining appro- priate consent from users under the age of 16. Finally, it recommended clear communications about any future changes to the app beyond its original purpose to protect against “function creep.” AI-enabled contact-tracing apps will raise additional privacy concerns, particularly since one of their goals is to collect symp- tom data from users for analytics purposes. Potentially, researchers could use these data (in de-identified format) in other AI applica- tions. However, good privacy practice, requiring multiple consents (for sharing of information on registration; for sharing contact details 22. Danny Palmer, “Security Experts Warn: Don’t Let Contact-Tracing App Lead to Surveillance” (7 May 2020), online: ZDNet <www.zdnet.com/article/security- experts-warn-dont-let-contact-tracing-app-lead-to-surveillance/>. 23. “The COVIDSafe Application: A Privacy Impact Assessment” (24 April 2020), online (pdf): Australian  Government  Department  of  Health <www.health.gov. au/sites/default/files/documents/2020/04/covidsafe-application-privacy- impact-assessment-covidsafe-application-privacy-impact-assessment.pdf>. For a critique of Australia’s app, see Graham Greenleaf & Katharine Kemp, “Australia’s ‘COVIDSafe App’: An Experiment in Surveillance, Trust and Law” (30 April 2020), online (pdf): University  of  New  South  Wales  Law  Research  Series  <ssrn.com/abstract=3589317>.