COVID-19 contact tracing apps: a stress test for privacy, the GDPR, and data protection regimes. Issue 1 (28th May 2020)

• Record Type: Journal Article
• Authors: Bradford, Laura; Aboy, Mateo; Liddell, Kathleen
• Is Part Of: Journal of law and the biosciences. Volume 7:Issue 1(2020)
• Publication Date: 2020-05-28
• Subjects: COVID-19 -- tracking app -- GDPR -- HIPAA -- CCPA -- privacy and data protection -- OECD privacy principles; Life sciences -- Law and legislation -- Periodicals; Science and law -- Periodicals; Law and biology -- Periodicals; Biotechnology -- Law and legislation -- Periodicals; Bioethics -- Periodicals; 344.0957
• DOI: 10.1093/jlb/lsaa034
• Languages: English
• ISSNs: 2053-9711

Abstract

Abstract: Digital surveillance has played a key role in containing the COVID-19 outbreak in China, Singapore, Israel, and South Korea. Google and Apple recently announced the intention to build interfaces to allow Bluetooth contact tracking using Android and iPhone devices. In this article, we look at the compatibility of the proposed Apple/Google Bluetooth exposure notification system with Western privacy and data protection regimes and principles, including the General Data Protection Regulation (GDPR). Somewhat counter-intuitively, the GDPR's expansive scope is not a hindrance, but rather an advantage in conditions of uncertainty such as a pandemic. Its principle-based approach offers a functional blueprint for system design that is compatible with fundamental rights. By contrast, narrower, sector-specific rules such as the US Health Insurance Portability and Accountability Act (HIPAA), and even the new California Consumer Privacy Act (CCPA), leave gaps that may prove difficult to bridge in the middle of an emergency.