Who Can Access Your Contact Tracing App Data?

Haven’t started using the local contact tracing app because you’re worried about data privacy? Don’t worry; you’re not alone. Many governments have rushed out digital contact tracing solutions without giving a second thought to how intrusive they could be.

Not sure whether the local app respects your privacy? This global contact tracing index from ProPrivacy should let you know how safe your data actually is. No need for in-depth research – just look up your country with the search function found above the table of contact tracing apps.

We go into more detail in the lines below. First off – what if there was no data to access in the first place?

Does Your Contact Tracing App Use Bluetooth?

Then you don’t have much to worry about in terms of privacy. Well, unless it’s a hybrid system that also collects GPS or telecom location data. In any case, Bluetooth on its own is one of the least invasive contact tracing solutions available. The only data that’s collected is a randomized identifier that changes every few minutes and is deleted every two weeks.

Moreover, these identifiers are only stored on other app users’ smartphones in an encrypted (i.e. garbled) format. If you test positive for Covid-19, you have the option of uploading a log of these identifiers to a cloud system – which then alerts every other user that came into close proximity. All this after a relevant health authority has green-lit the alert to prevent malicious false alarms, of course.

It does suffer from its own problems, such as:

• Unreliable signal (although Bluetooth Low Energy is much more efficient and accurate) 
• Being vulnerable to man-in-the-middle attacks 
• An increased risk of false positives, due to the fact that Bluetooth signals can pass through walls 

Other than that, Bluetooth-based contact tracing apps strike the best balance between privacy and preventing further Covid-19 outbreaks. There are some contenders out there (such as Sonar-X that uses ultrasonic technology) – but Bluetooth is more widespread at the moment.

1. Health Officials

If any data is collected at all (such as medical and travel info), it stands to reason that only a doctor or other health authority should have access to it. After you’ve given your consent, that is. In an ideal scenario, nobody would have access to this private data but you.

ProPrivacy considers this “the next best thing” in their scoring criteria. Apps that give you full control over your data receive two points. Meanwhile, if any health official can access your records (even if they require your consent) the app only receives one point. As you may have guessed, no points are awarded if the government or other third parties are involved.

A couple of decently-scoring contact tracing apps are COVIDSafe in Australia and Stopp Corona – with a rating of 7/10 each. They both lose points for collecting contact details and making them available to health officials.

2. The Government

China has made its “Alipay Health Code” app mandatory for all its citizens. Considering China’s past human rights violations, it’s unsurprising that the government and law enforcement would have unrestricted access to every bit of data the app collects.

However, government data collection through contact tracing apps is not limited to restrictive regimes. India has had its own problems with the Aarogya Setu app over the past months. Citizens have seen it switch from optional status to mandatory and back several times – a move some human rights officials have called “a cat and mouse game.”

3. Third Parties 

Think the government intruding on peoples’ lives (well, more than they currently do) wasn’t bad enough? Well, the developers of North Dakotan “Care-19” app have thought it fitting to share your location data with advertisers.

Meanwhile, the Bahrain-based “BeAware” app was the object of a game show called “Are You At Home?” App users have the chance to win 1,000 Bahraini dinars if, you guessed it, they obey the lockdown rules and stay at home. According to the BBC, this is supposed to be an incentive for people to download the app – though users may also opt out of sharing their location data with the show.

The Bottom Line

As you can see, your private and medical data may be restricted to a doctor’s eyes. Or, you could unintentionally find yourself on a game show.

Whatever the case is, you can always check ProPrivacy’s index for more info on your local contact tracing app. You may want to download the provided Excel file as well, for an in-depth look on what data each app collects. The table also contains further reading and resources on all apps (as they become available). Stay informed.