Thursday9 April 2020 ★ FINANCIAL TIMES 15

FT BIG READ. CORONAVIRUS

European politicians want to use location data from smartphones to track the spread of the pandemic.

But the idea has raised questions about privacy and the growing reach of state surveillance.

By Nic Fildes and Javier Espinoza

rights. “Governments and regulators

should find a proper balance between

privacy and public interest,” he says.

Opting in

Many of these issues come to a head

with the health apps which have been

widely used in Asia and are gradually

being introduced in Europe to track an

individual’s health status.

Germany’s Robert Koch Institut has

introduced an app, developed with Ber-

lin digital health group Thryve,which

links to fitness bands and smart-

watches. It says the app will help it map

the spread of Covid-19 by monitoring

anonymised data for signs of infection

including a user’s resting pulse, sleep

and activity levels, which tend to alter

significantly in the case ofacute respira-

tory problems. The data drawn from

such apps can both track individual suf-

ferers and people they have encoun-

tered via contract tracing methods to

create a deeper data set for governments.

In Singapore, the government has

asked citizens to opt in to its system and

European governments including Ger-

many have stressed that the use of

tracking and tracing apps must be done

on a voluntary basis.

“This is nowhere near the South

Korean or Chinese or Israeli model

where they have the power to track you,

know you have the disease and who you

know,” says Enrique Medina, chief pol-

icy officer for Telefónica, which is work-

ing with the Spanish government.

The European Commission is work-

ing on guidelines on the use of tracing

apps. Vera Jourova, vice-president for

values and transparency, says citizens

must be able to give informed consent.

“There must not be a hidden purpose

or something I as a citizen don’t know,”

she says. “People entering such a system

[must] know what they are doing.”

The scientific community has created

a body called the Pan-European Priva-

cy-Preserving Proximity Tracing coali-

tion in Switzerland, led by Germany’s

Fraunhofer Heinrich Hertz Institute, to

create standards for apps being devel-

oped that adhere to European privacy

laws. The GSM Association, the mobile

telecoms trade body, has alsopublished

a blueprint or best practice in howf data

gathered through apps is handled.

Juan Rio, who specialises in analytics

at telecoms consultancy Delta Partners,

says there will always be a trade-off

between the common good and civil lib-

erties in a time of crisis but questioned

the efficacy of governments forcing citi-

zens into using apps, as they may rebel

and stop using their phones.

“With the invasive way, you are

affecting the experiment. You change

the behaviour of people and you cannot

trust the results,” he says.

Additional reporting by Edward White in

Seoul and Sam Fleming in Brussels

W

hen the World Health

Organization launched

a 2007 initiative to

eliminate malaria on

Zanzibar, it turned to an

unusual source to track the spread of

the disease between the island and

mainland Africa: mobile phones sold by

Tanzania’s telecoms groups including

Vodafone, the UK mobile operator.

Working together withresearchers at

Southampton university, Vodafone

began compiling sets of location data

from mobile phones in the areas where

cases of the disease had been recorded.

Mapping how populations move

between locations has proved invalua-

ble in tracking and responding to

epidemics. The Zanzibar project has

beenreplicated by academics across the

continent o monitor other deadlyt

diseases, including Ebola in west Africa.

“Diseases don’t respect national bor-

ders,” says Andy Tatem, an epidemiolo-

gist at Southampton who has worked

with Vodafone in Africa. “Understand-

ing how diseases and pathogens flow

through populations using mobile

phone data is vital.”

With much of Europe at a standstill as

a result ofcoronavirus, politicians want

the telecoms operators to provide simi-

lar data from smartphones. Thierry

Breton, the former chief executive of

France Telecom who isnow the Euro-

pean commissioner or the internalf

market, has called on operators to hand

over aggregated location data o track t

how the virus is spreading and to iden-

tify spots where help is most needed.

Both politicians and the industry

insist that the data sets will be “ano-

nymised”, meaning that customers’

individual identities will be scrubbed

out. Mr Breton told the Financial Times:

“In no way are we going to track individ-

uals. That’s absolutely not the case. We

are talking about fully anonymised,

aggregated data to anticipate the devel-

opment of the pandemic.”

But the use of such data to track the

virus has triggered fears ofgrowing

surveillance, including questions about

how the data might be used once the

crisis is over and whether such data sets

are ever truly anonymous.

The debate over the use of location

data sets could be a forerunner to a

broader discussion about civil liberties

and surveillance in Europe and the US

as governments put in place plans to lift

at leastparts of the lockdowns.

The strategies for reopening an econ-

omy before a vaccine is developed could

involve monitoring the contacts of

newly infected people, which will raise

questions about how much curtailment

of privacy societies are prepared to take.

In South Korea, which is seen as a

benchmark ofhow to control infectious

diseases, the authorities can require

telecoms companies to hand over the

mobile phone data of people with con-

firmed infections to track their location.

The data has enabled the rapid deploy-

ment of a notification system alerting

Koreans to the movements of all

potentially contagious people in their

neighbourhoods or buildings.

China and Israel have also used

personal telecoms data to trace corona-

virus patients and their contacts. Gov-

ernments around the world are creating

apps to gather similar personal data.

Even the EU’s General Data Protec-

tion Regulation, which was adopted in

2018, has a clause allowing exceptions

for cases that are in the ublic interest.p

Vittorio Colao, former Vodafone chief

executive now at General Atlantic, says

people should be willing to allow the use

of “pseudo-anonymised” data by health

services such asBritain’sNational

Health Service to respond to the pan-

demic. Originally from northern Italy,

he says citizens understand the need to

trust authorities to handle their data.

“It’s not a question of spying on every-

one forever but of saving lives for a time

that demands temporary rules,” he says.

“We trust Uber to know everywhere we

go, we trust Gmail with everything we

write. If we don’t trust the NHS with our

health data then who do we trust?”

Vincent Keunen, founder of app

developer Andaman7 in Belgium who

works on ways to securely share health

data, says citizens have legitimate con-

cerns about vast amounts of data being

used to track them individually. But he

says it is a tricky balance to strike

between using technology to help tackle

health crises and safeguarding privacy.

“The use of technology should end as

soon as the health of the people is guar-

anteed. We must be vigilant,” he says. “If

you go to one extreme, you’ll have

Norwegian cities dropped 65 per cent

after restrictions were applied.

“Knowledge about a population’s

travel pattern is vital to understanding

how an epidemic spreads throughout a

country,” he says.

Telefónica, Spain’s national carrier

which owns networks across Latin

America, has developed expertise

working with companiessuch asFace-

book o use data to deal witht events such

as earthquakes and epidemics.

Vodafone has a researcher paid for by

the Bill & Melinda Gates Foundation

embedded in its data team at the com-

pany’s London headquarters, to work

on data sets providing insights to

academics tracking a variety of diseases.

We have seen how aggregated data“

can check the spread of disease in

Africa. We’re now using the same

insights to understand and combat the

spread of Covid-19 in Europe,” says Nick

Read, Vodafone chief executive.

Mass surveillance’s moment

European telecoms companies remain

adamant that the information provided

to governments is anonymised and

aggregated. That means it cannot be

traced to any specific individual or

phone. The process of scrubbing the

data usually takes between 24 and 48

hours before it is available in data sets

that can then be used by governments.

The industry insists that data about

users is of little use for big data analysis

of the contagion: the best way to track

the spread of the pandemic is to use

heatmaps built on data of multiple

phones which, if overlaid with medical

data, can predict how the virus will

spread and determine whether govern-

ment measures are working.

Telecoms companies say they are

frustrated with the confusion between

the kind of group data they are provid-

ing and the personal data that can be

gleaned from apps on mobile phones. In

Europe, personal information, such as

whether someone has coronavirus and

has shared that on social media or

searched on Google for symptoms, is not

legally accessible under GDPR by a

telecoms provider.

Still, assurances from officials and

industry executives have done little to

appease anxiety that privacy rights

could be brushed aside as governments

seek to use tools of mass surveillance in

their efforts to combat the virus. The

concerns about political use of data have

been aggravated by the fact that the

European Commission wants the tele-

coms companies to provide the actual

aggregated data, not just access to

insights from that information.

Latvia, for example, has exercised its

right to be exempted from certain

obligations in the European Convention

of Human Rights, which grants citizens

privacy and data protection rights.

Slovakia passed a law last month to use

telecoms data to ensure people abide by

quarantine laws.

Some researchers are not convinced

by the claim that such data sets are com-

pletely anonymous. A 2019 study by

researchers at Imperial College London

and Belgium’s Catholic University of

Louvain revealed there is a way to

re-identify 99.98 per cent of individuals

with just 15 demographic characteris-

tics using location data. Other studies

have come to similar conclusions that

individuals can be identified based on

aggregate data sets with relative ease.

Spain’s far-right Vox party has urged

people to turn off their mobile data,

reflecting the anger over government

intrusion on their privacy.

Austrian data privacy activist Max

Schremswarns citizens should be care-

ful of the rights they are giving away at a

time of global panic. “I am worried that

we will accept state surveillance during

the health crisis but that it will then take

years in court to get rid of it.”

However, he says there are apps that

help citizens choose which data they

share, leading to a more efficient track-

ing of the virus. “If people can decide

themselves if they want to participate or

not, then we have privacy-friendly

alternatives. That’s a game changer.”

Some analysts worry that the data sets

could be put to other uses in the future.

“They need to demand reassurances

from governments [that the data] won’t

be repurposed. The last thing they want

is to wake up after Covid-19 and find

that the data is still being used for other

purposes. How do you police who is

using it?” asks one industry executive.

“There has to be a sunset clause.”

The telecoms industry has had to

tread a fine line on the use of data or face

punitive action. In the US, he Federalt

Communications Commission last

month fined the four largest industry

players a combined $208m over the his-

toricsale of location data to third parties

without the explicit consent of users.

Francisco Montalvo, Telefónica’s chief

data officer, argues that governments

need to combine the need to use the

data without endangering privacy

super-high privacy but then you die and

it becomes useless to have privacy. It’s a

very delicate balance to reach.”

Epidemic experience

The use of location data to track the

disease has been applied in Italy, Spain,

Norway and Belgium, with the UK,

Portugal and Greece set to follow.

In cities such as Madrid and Milan,

telecoms operators have created heat

maps that show how restrictions on

movement are working and what effect

the presence of police on the streets is

having on behaviour.

Telecoms companies in Spain were

able to show that the movement of peo-

ple in one city dropped 90 per cent dur-

ing the first week of the lockdown and a

further 60 per cent of the remainder in

the second week, while in Italy the lock-

down was largely ignored for the first

week, with between 800,000 and 1m

people stilltravelling to and from Milan.

In Belgium, the data showed that long

distance trips of more than 40km

dropped 95 per cent after confinement

measures were introduced. Belgians are

spending 80 per cent of their time

within their home postal area, with

mobility down 54 per cent. The data can

show if large numbers of people in cities

have fled for their second homes, as was

the case in France.

The insights that telecoms companies

can derive from these data sets build on

their experience of working with epide-

miologists to track infectious diseases in

the developing world.Telenor, the Nor-

wegian company, has participated in big

data projects to predict the spread of

dengue fever in Pakistan and malaria in

Bangladesh. Kenth Engo-Monsen, a sen-

ior researcher at Telenor, says it was

able to show that movement between

‘We trust Uber to know

everywhere we go. If we

don’t trust the NHS with

our health data then who

do we trust?’

‘I am worried that we will

accept state surveillance

during the health crisis

but that it will take years

in court to get rid of it’

Why data

protection

is on hold

1m

Upper range of

estimate of people

that were found to

be travelling in and

out of Milan when

Italy was supposed

to be on its first

week of lockdown

80%

Proportion of time

Belgians are

spending within

their postal area

after confinement

measures were

introduced

99.98%

Percentage of

individuals that one

study found could be

re-identifed with 15

demographic

characteristics, even

when their data was

anonymised

In cities such as

Madrid, right,

telecoms

operators have

created heat

maps that show

governments if

restrictions on

movement are

working. Below:

Thierry Breton.

The European

commissioner

has attempted

to assure EU

citizens that ‘in

no way are we

going to track

individuals’ with

the use of

anonymised

data —FT montage

APRIL 9 2020 Section:Features Time: 8/4/2020- 18:16 User:alistair.hayes Page Name:BIGPAGE, Part,Page,Edition:USA, 15, 1