One month after the introduction of Italy’s national lockdown, the government’s bid to find data-driven solutions to limit the spread of the coronavirus has sparked a debate over privacy rights and data protection. In early April the Ministry of Innovation announced that it had assembled a multi-disciplinary task force of scientists and experts to select possible technological solutions it had received through a recent national open call.
The initiative prompted a deluge of proposed solutions from about 800 technology companies, nonprofits, and research institutions. It also came as scientists stressed the need not only to enforce social distancing, but also to trace and isolate those who have tested positive for COVID-19. The task force is expected to announce its decision imminently.
While the number of infections in Italy has flattened out in recent days, the country has recorded 21,645 deaths — just under a sixth of all worldwide COVID-19 fatalities. Experts have warned that Italy’s falling case numbers may be a result of a decline in daily testing, rather than any slowdown in the outbreak itself.
Even before the open call, a number of tech companies and research institutions were already at work on ways to track COVID-19 cases, including one solution that would analyze user data from Facebook to determine the mass movement of people. In an emailed statement, the social media platform confirmed that its Data for Good team has been sharing aggregated data collected from location tracking software on mobile phones with researchers at the University of Pavia. Another group in the task force is also analyzing ways to harness user data from Facebook’s GeoInsights portal.
While some kind of location tracking app seems likely, technology experts warn of a lack of provisions for privacy and data management. “Right now, everybody is thinking of the most obvious thing, meaning which app to use. But I don’t care which app is going to be used – what I care about is the model around analysis and management of the data,” said Matteo Flora, adjunct professor of corporate reputation at the University of Pavia and a cybercrime expert.
According to Flora, the taskforce, which includes over 70 scientists and technology experts, does not feature any cybersecurity specialists. Others argue that the scale of Italy’s coronavirus outbreak means that concerns about user privacy and data sharing should be temporarily put on hold. “To give up a very effective weapon in the fight against the virus out of vague concerns about privacy equals pure self-harm,” tweeted Roberto Burioni, one of Italy’s leading immunologists.
The government’s launch of a national task force mirrors regional initiatives to contain the spread of the coronavirus. An app designed by Lombardy’s government is already available, which asks users to fill out a questionnaire with their symptoms to build a map indicating the risk of contagion. The app retains information such as a phone’s IMEI code, the unique serial number that all smartphones carry, and the user’s IP address.
In the wake of the pandemic, the private sector has also developed location tracking apps. Last month, a web development and marketing company named Webtek released StopCovid19, which tracks user movement using GPS. Users are asked to connect their phone numbers to the app, which then feeds their location into a database. Health authorities can look up new COVID-19 cases and cross-check phone numbers in the database to determine who the carrier has crossed paths with. According to Webtek CEO Emanuele Piasin, only health authorities have access to the database of phone numbers, which is hosted on an Amazon server.
According to local media reports, two solutions are now on Prime Minister Conte’s table and will be approved by the beginning of May. One is an app that would record and trace COVID-19 cases. Its creators – who have insisted that any data gathered from users will be rendered anonymous – are part of the pan-European Pepp-Pt network, a consortium of technology experts and scientists. The other solution reportedly has the same functions. Any solution that is picked will be presented to citizens as a suggestion to be downloaded voluntarily, the Ministry of Innovation assured.
The European Commission recommends that member states should consider privacy rights while coordinating efforts to develop contact tracing solutions. The Italian Ministry of Innovation said that any technology projects selected by the task force would be subject to government approval and could require the drafting of an ad hoc law to regulate their use. The ministry also said that any data culled from the mobile phones of Italians would only be used for the duration of the pandemic and would later be disposed of.
Critics argue the anonymization of user data is not so simple.
“Something is not anonymous, just because you take out a phone number connected to it,” said Matteo Flora of the University of Pavia. “The technological anonymity of a dataset is something that is extremely difficult to obtain. Saying that we are going to gather data and then anonymize it before using it is a very dangerous thing, because you need to trust the gatekeepers, meaning those who are retaining this data.”
Online and offline surveillance measures designed to tackle the spread of COVID-19 have been introduced in a number of countries in the last month. According to one digital rights tracker, 28 countries have recently implemented some form of surveillance to tackle the outbreak. In India, people who test positive are given a hand stamp and are tracked using their phones. In Europe, authorities in Spain and Belgium have deployed drones to enforce lockdowns.
Stefano Piotto, a computational chemist at the University of Salerno, near Naples, is one of about 800 professionals who have submitted ideas to be considered by the task force. “As I see it, we should be quick in finding some form of digital containment,” he said. “We’ve got these devices for the first time in the history of humanity, not using them would be folly.”
Reproduced with permission. Coda Story is an investigative journalism non-profit organization based in Tbilisi, Georgia, and New York City. Cecilia Butini is a freelance journalist based in Berlin and Italy.
Common Crisis is a CEPA analytical series on the implications of COVID-19 for the transatlantic relationship. All opinions are those of the author and do not necessarily represent the position or views of the institutions they represent or the Center for European Policy Analysis.
Bandwidth is CEPA’s online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions are those of the author and do not necessarily represent the position or views of the institutions they represent or the Center for European Policy Analysis.
