When COVID-19 disrupted our lives in the beginning of 2020, governments had to find effective ways to combat the pandemic. One important measure was tracing back the chains of infections. Soon, more and more states started implementing contact tracing apps. While human contact tracers were already in place, the apps were thought to be an extremely efficient addendum -- they were presumed to be faster and able to trace potential infection chains human contact tracers would never find.

Governments hoped for a quick fix to return to normal life, but human rights organizations and academic institutions warned Member States their dream might not become reality. Concerns arose about the efficacy of the apps, as well as violations of human rights and possible mass surveillance. While, to the best of our knowledge, the latter fortunately did not occur, it does not mean that the continued operation of the apps, at least in many of the Member States, is unproblematic.

New report by 10 human rights organizations

A new report by the Civil Liberties Union for Europe (Liberties) and nine partner organizations has now been published. It focuses on how the apps were introduced in ten different Member States, and to what extent governments conducted research on the impact of these apps on fighting the pandemic, as well as the impacts on the economy and vulnerable groups.

In addition to desk research, the partners also submitted freedom of information requests asking eight questions about the uptake of the apps, how many positive cases were detected, if there was any research done, and when the app would be revoked again.

The following partner organizations contributed to this report: Bulgarian Helsinki Committee (Bulgaria), Estonian Human Rights Centre (Estonia), Hungarian Civil Liberties Union (Hungary), Irish Council For Civil Liberties (Ireland), CILD - Italian Coalition for Civil Liberties and Rights (Italy), ePaństwo Foundation (Poland), D3 - Defesa dos Direitos Digitais (Portugal), Peace Institute (Slovenia), Rights International Spain (Spain)

Impact study is a missing link?

Almost none of the Member States scrutinized has conducted research on the efficacy and the social impacts of their apps, which diminishes opportunities for public scrutiny. This is problematic, since there is reason to believe that tracing apps’ impact on combating the pandemic in most countries was negligible to none. It also makes people wary of the technology, which can doom it from the start: in order to be effective in tracing contacts, a certain threshold of downloads has to be reached. It is unsurprising that Member States who did not communicate transparently had a significantly lower uptake of their app than those who did.

Furthermore, when asked about the missing impact assessments, governments frequently used privacy protection as a scapegoat. While it is indeed more difficult to conduct such research with less available data, this is a flimsy excuse. Germany was one of the few countries which did build on transparency, public debate, and impact assessments. Thus, it was rewarded with one of the highest download rates in Europe - leading to more leverage in battling COVID-19.

Lastly, while it would be recommendable to implement changes or drop contact tracing apps if they are found to be useless, most Member States plan to keep the apps running until an undefined “end of the pandemic''. Holding on to the status quo is problematic, as the state-operated apps ask people based on the calculations of their algorithm to stay home, isolate from their loved ones, get tested and so on -- in other words, to shoulder significant burdens based on calculations that may or may not be good enough to justify such measures.

Some governments failed at good governance

Liberties` new study found that most scrutinized Member States failed to observe the principles of good governance -- efficiency and effectiveness, accountability, openness and transparency -- when introducing and operating the contact tracing apps. While they didn’t make sure the apps were efficient enough to be justified to operate, they also made public oversight difficult. Thus, problems with the contact tracing apps are difficult to identify and they may not get fixed.

Some countries specifically failed to comply with their duties:

• In Hungary, the authority that is supposed to be the controller of the app according to the app’s website claims not to be the controller.
• In Bulgaria, the research partner Bulgarian Helsinki Committee had to litigate to get the app’s data protection impact assessment.
• In Spain, the published data protection impact assessment did not correspond to the app, thus making oversight of changes to the app very difficult.

Recommendations for the future

While the deployment of contact tracing apps in Europe could have gone worse, there is definitely need for improvement. Based on our findings, we have the following recommendations:

• In order to give the public a chance to object to new technologies, Member States should always test these before deploying them.
• Governments have to realize that technologies can't be used as a panacea for all complex social emergencies.
• Member States should start conducting research and impact assessments regularly for all deployed technologies.

Download the full report here.