In brief
The government is reportedly seeking an exposure notification app based on venue QR codes. Drawing on New Zealand's experience, the article argues that clear explanation, minimal data collection and privacy safeguards are key to getting people to use it, and that promotion should start while infections are low.
A newspaper reported that the government has issued tender documents to some government IT suppliers and university institutions, seeking contractors to develop an app and support services to identify COVID-19 confirmed cases and their close community contacts, with a launch planned within this month. If everyone can share a little information about their daily movements, so that people around them become more alert and public health across Hong Kong is protected, that would not be a bad thing. To encourage public use, the government and app developers should strengthen assurances, including that the information will be used only to notify people who may have been in contact with suspected patients, and that a minimum amount of information is collected.
The New Zealand Example Is Worth Referencing
Before vaccines become widely available, the best way to resist the spread of COVID-19 is early testing, isolation and treatment. Citing sources, the newspaper said the tender requires the contractor to develop an "exposure notification" system and app, with taxis, hospitals, elderly homes, government agencies and offices among the first venues encouraged to install it and to set up a "venue QR code". Members of the public download the app voluntarily and scan the QR code before entering a venue. The phone records the venue location by itself. When a user is confirmed as infected, they can review the locations in the app. After the case is reported to the Department of Health, the government sends a message through the system to users who were at the same place at the same time, urging them to get tested and stop the virus from spreading in the community.
The report did not detail how the app works, but going by New Zealand's example, its app is downloaded and used voluntarily by citizens, most control over providing personal data rests with the user, and data stored on the phone is deleted after 31 days.
Compared with GPS and Bluetooth tracking, venue QR codes record less information. This weakens the tracing function, but makes it harder to obtain a user's complete movements. Privacy concerns have long troubled other places; even where outbreaks were more severe than in Hong Kong, app downloads stayed below government expectations. Hong Kong society is highly politicised, and many people are wary of virus testing, so they are likely to be even more cautious about installing a phone app. Giving the public greater confidence in the design and technology should help raise usage.
Clear Explanation Is Especially Important
The higher the usage, the more evident the effect on epidemic prevention. New Zealand had its outbreak under control over the past few months, and usage of the app stayed low. As of 10 August, there were only just over 646,400 registered users, a little over 10% of the country's population of 5 million. Local cases reappeared in the following days, and only then did the app take off. On 14 August, users rose to 1.17 million, and daily scans increased to nearly 700,000. Unfortunately, the source of infection in that confirmed case was unknown, and the earlier low download numbers may have hindered tracing the source. Therefore, when the Hong Kong version goes live, the government should seize the opportunity to promote it while infections are low; pushing it hard only once a major outbreak occurs would mean losing the first chance to trace.
For the version Hong Kong plans to build, the government and contractors should pay attention to how many of the app's steps proceed only with the consent of confirmed cases, whether a privacy impact assessment will be provided, whether software developers will be encouraged to open-source the code so that peers can assess the app's security, whether conditions for ending use of the app will be set, and how the stored data will be handled.
When the epidemic struck, places responded with strict social distancing, but this approach is hard to sustain. For social and economic activity to coexist with infectious disease, regular health records and testing are becoming the world's new normal. For the public to be willing to lower their privacy walls, the government and technology companies need to be open and candid, and also do better at explaining policy, so as not to be led along by politicised public sentiment.
Original article: https://bit.ly/2DXhlb5