LSE - Small Logo
LSE - Small Logo

Fabrizio Scrollini

Javier Baliosian

Lorena Etcheverry

Guillermo Moncecchi

August 26th, 2020

Uruguay’s COVID-19 contact tracing app reveals the growing importance of data governance frameworks

0 comments | 21 shares

Estimated reading time: 6 minutes

Fabrizio Scrollini

Javier Baliosian

Lorena Etcheverry

Guillermo Moncecchi

August 26th, 2020

Uruguay’s COVID-19 contact tracing app reveals the growing importance of data governance frameworks

0 comments | 21 shares

Estimated reading time: 6 minutes

Uruguay’s pioneering adoption of Google and Apple’s contact tracing interface is understandable given the urgent need to halt the spread of COVID-19. But this move also puts serious issues of governance, health policy, and human rights in the hands of software developers who have neither the expertise nor the legitimacy required to properly address them. During today’s crisis just as in the future, governments must ask the right questions about data governance if they are to come up with the right policies, write Fabrizio Scrollini (ILDA), Javier Baliosian (Universidad de la República), Lorena Etcheverry (Universidad de la República), and Guillermo Moncecchi (Universidad de la República).

As COVID-19 has swept across Latin America, it has become painfully clear that deep inequalities, including in access to healthcare and social services, have left vulnerable groups bearing the brunt of the crisis. Individual governments have responded in different ways, with most implementing some form of restriction on movement, but today there is a growing interest in using new technologies to try to mitigate the spread and impact of the pandemic.

A great many COVID-19 apps have been deployed in Latin America, but Uruguay is the first country in the region to adopt the Google-Apple interface (Nelson Antoine/shutterstock.com)

To date, at least 28 different apps have been employed in the region to deal with various aspects of this complex situation. Some provide basic information and advice, whereas others are more complex, checking whether users have the right to be out and about in particular places or at particular times. As these apps have spread, so too have debates about the implications for privacy and the potential use of citizens’ information for political purposes.

In this context, the Uruguayan government announced the launch of a new version of its COVID-19 related application (CoronavirusUy) that will implement exposure-alert protocols developed by Apple and Google. Uruguay is the first country in Latin America to test this solution and one of the early adopters worldwide, along with Switzerland and Germany. But will this development help to contain the pandemic? If so, at what cost? And could other countries in the region follow Uruguay’s lead?

Google-Apple contact tracing

The Google-Apple solution has been widely documented and debated, but essentially the two companies will provide a degree of access to user-activity data in a decentralised way, allowing users to know if they have come into contact with a person that might be infected.

In order to do this, Google and Apple are developing an interface that will open up certain functions of their operating systems to apps developed by health agencies around the world. Google and Apple made certain assumptions and choices based on particular values when developing this interface. It seems largely inspired by the European model, which aims to preserve user privacy at the same time as helping authorities to monitor the spread of the pandemic. Governments themselves, however, had little say in how these choices were made. As such, governments have to make decisions of their own in creating their own applications, not least about the parameters of how the application should work.

Take, for example, the issue of duration of exposure: what constitutes a risky amount of time to be in close proximity to a carrier of the virus? To date there is no scientific consensus on the answer. Similarly, there is no self-evident choice on what happens if a user tests positive for the infection. Should it be mandatory for them to report it to authorities? And should the app do it automatically? What would happen if choose not to? And should a positive report lead to a free test?

These decisions are important, but they are about governance, health policy, and human rights rather than technology – they should not be taken by a software developer. Yet, how these policies are implemented is also shaped by the technological infrastructure. There is an interdependent relationship between policy and technology which affects the way that these applications can be used.

A user looks at Uruguay's COVID-19 app on a smartphone
A user logs in to the Uruguayan COVID-19 app CoronavirusUY (© Agencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento, 2020)

Uruguay’s COVID-19 app: CoronavirusUY

Uruguay’s CoronavirusUY app was originally designed to distribute information, to enable self-assessment and symptom reporting, and to arrange testing, with the potential also to move towards provision of telephone consultations. Rather than being open source, which would have allowed for full transparency on the app’s underlying code, the app was a joint, voluntary, private initiative of several local tech firms that wanted to help the government face down the pandemic.

The agency for E-Government provided a cloud-hosting service in Uruguay to enable data processing and the wider operation of the app, whereas the national privacy regulator issued an exemption to allow for handling of personal data in the fight against the pandemic while also safeguarding the principles enshrined in Uruguayan law. This approach, focusing on health services and telemedicine, was different from that of many other countries in the region, which tended to focus on restricting freedom of movement.

But the government’s haste in creating the app led local civil society organisations, concerned citizens, and academics to demand more information from the state about how data would be stored, processed, and analysed. These issues are particularly sensitive given the state’s central role: unlike tech companies, states exercise legitimate authority that can have drastic consequences for people’s lives. Even in such unusual times, this authority needs to be clearly regulated.

The right questions for the right policies

In developing these kinds of app, the governments face difficult trade-offs, and these should be considered as part of the broader strategies to deal with COVID-19.

Uruguay is a stable, open, strong democracy with a relatively sophisticated framework for protecting personal data. It also boasts relatively advanced technical capabilities in the private and academic sector. To date, Uruguay’s wider strategy appears to have been successful in controlling the pandemic.

However, there appears to be no comprehensive policy to deal with app development. As the complexity and intrusiveness of apps grows more intense, it is important that citizens ask the right questions about how exactly they will function. The key issues relate broadly to how the government manages app transparency and how it can evaluate evolution of an app over time:

  1. Utility:
    Is the app going to contribute to existing epidemiological surveillance mechanisms? If so, how exactly will this happen in each particular context?
  2. Compatibility with legal frameworks and principles:
    To what extent does the app protect or compromise human rights like privacy and freedom of movement? What kind of liability are governments, developers, and global firms assuming? Are these provisions compatible with the prevailing constitutional framework?
  3. Implementation and monitoring:
    What capacities do governments and local firms have in place or need to develop in order to effectively monitor how the app is being used?
  4. Ongoing evaluation:
    What institutional mechanisms and methodologies will be required to evaluate and govern the implementation of alert-exposure applications?

Over time, these questions should feed into the evolution of a governance framework, and Uruguay is relatively well-placed to test this kind of approach. Ultimately, however, we must remember that this technological solution should only complement an overall health-policy strategy rather than seeming to replace it. Linkages with the scientific community, and particularly scientific groups advising government, should also be strengthened for the same reason. At the end of the day, this kind of development is urgent and has great potential in halting the spread of COVID-19, but it still requires significant technical and social oversight.

Data governance in the longer term

The implications of recent experiments with contact tracing apps have yet to become clear. This is not the first pandemic that the world has faced, nor will it be the last. Using citizens’ data to improve understanding and management of these processes represents a new kind of interaction between governments and big corporations like Google and Apple whose access to data could potentially be used for the public good.

But states in Latin America have different capacities for tech development and governance than many countries in Europe and North America, and not all have frameworks in place to allow private data and technology to be used for public purposes. The COVID-19 pandemic is not only a moment of great need in this sense, it also offers the chance to think through and resolve a number of pending data-governance issues. And so despite the prevailing sense of urgency, broader concerns such as the effects of inequality and respect for human rights must remain at the forefront of our minds, as much today as in our shared digital future.

 

Notes:
• The views expressed here are of the authors rather than the Centre or the LSE
• This blog draws on the authors’ article “Aplicaciones de seguimiento de contactos en la emergencia sanitaria: aportes para el diseño y evaluación de política pública” (2020)
• Please read our Comments Policy before commenting

About the author

Profile photo of Fabrizio Scrollini

Fabrizio Scrollini

Fabrizio Scrollini is the executive director of the Open Data Latin American Initiative (ILDA) and a member of the Open Data Network for Development (OD4D). He was the chairman of DATA Uruguay, a civic association based in Uruguay that builds civic technology to promote human development, co-founder of Abrelatam and the Open Data Regional Conference for Latin America and the Caribbean, and is one the Lead Stewards of the International Charter of Open Data. He worked with governments, regulators, and civil society at international and regional level on transparency, access to public information, open data projects, and public sector reform. He holds a PhD in Government from the London School of Economics and Political Science (LSE).

Javier Baliosian

Javier Baliosian received his bachelor's degree in computer engineering from the University of the Republic (Uruguay) in 1998 and his PhD from Polytechnic University of Catalonia (Spain) in 2005. Since then, he has been involved in several research projects with different groups such as the Computer Laboratory of the University of Cambridge, the Laboratory of Communication Networks at KTH, and the Ericsson Ireland Research Centre, where he worked as a researcher and project coordinator until late 2007. Recently he has been a visiting researcher at Telecom SudParis and was research director at Polytechnic University of Catalonia from 2018 to 2020. He is currently at the Department of Computer Science, University of the Republic, Uruguay.

Lorena Etcheverry

Lorena Etcheverry received a BE in Computer Engineering (2003), an MSc in Computer Science (2010), and a PhD in Computer Science (2016) from Universidad de la Republica, Uruguay. During her PhD she worked at the Laboratory for Web and Information Technologies at Université Libre de Bruxelles (ULB) and also at Instituto Tecnológico de Buenos Aires. Since 2003, she has been with InCo, Universidad de la República, where she is currently an Associate Professor. Her research interests are in the field of data management, in particular big data management, graph databases, data anonymisation, and the semantic web.

Guillermo Moncecchi

Guillermo Moncecchi is a researcher in natural language processing and machine learning at Universidad de la República, Uruguay. Currently adjunct professor, he received his PhD in Computer Science from UdelaR and Université Paris Ouest in 2013. His research interests are machine-learning methods for NLP, extra propositional aspects of meaning, and causality. He has worked on data science, open government, and digital development policies. He formerly worked at the Ministry of Industry, Energy, and Mining in Uruguay.

Posted In: COVID19 | Society

Leave a Reply

Your email address will not be published. Required fields are marked *