The COVID-19 pandemic came as a shock to all of us, especially governments, which had to act quickly and efficiently to save lives. In short order, almost all European Union Member States decided to implement contact tracing apps to be able to monitor infection chains and give people more freedom back.

This technology held the potential to become the first tool of mass surveillance in a Europe where democratic rights are declining in many countries. While the worst-case scenario of mass surveillance did not occur, fundamental rights were impaired nevertheless.

In order to contribute to better future digital policies, Access Now and Liberties have now published a policy brief.

Where did governments fall short?

To begin with, there was no public debate about the app in many countries, which undermined trust and led to lower acceptance rates, which in turn decreased the efficacy of the app and thus trust in future government-implemented technologies.

Secondly, many countries did not consult independent experts on possible effects of the app. While this is understandable in emergency situations like a pandemic, the consultation also did not occur when things came to the new normal.

Thirdly, most governments were not transparent (enough) on what kinds of apps they wanted to develop/purchase and why. Furthermore, many didn't make sure that the source codes were published and the app can be scrutinized by independent experts. Some even dropped the project completely, making retrospective oversight practically impossible.

What lessons can we draw from this?

The implementation of the COVID-19 contact tracing apps was a case of techno-solutionism. Without estimating the real efficacy, or acceptance of this technology, governments trusted the apps to be vital in combating the pandemic. Since those hopes were not fulfilled, this has likely to have further impaired trust in democratic institutions and science in certain communities.

Highly concerning is also the immense power Big Tech - in this case Google and Apple - had over governments in the process. While they insisted on privacy standards and decentralised solutions, thus helping to prevent mass surveillance, democratically elected governments had no genuine alternative but to accept their technical solution.

In the rush of creating COVID-19 tracing apps, EU Member States failed to provide initial interoperability between the different national apps. Only after the Commission saw the fundamental right of free movement constrained, an interoperability gateway was developed.

Governments especially fell short on communication and building trust. In a time where low trust in democratic institutions is already a systematic problem, not upholding standards of transparency is dangerous.

Also, stakeholders and journalists must have access to information. Access Now and the Civil Liberties Union for Europe waited almost five months for an insufficient answer to a letter with questions about lacking privacy standards they sent to the Commission. Some other countries even stopped press communication altogether at the beginning of the pandemic, which is threatening free media.

What must be done differently in the future?

Governments now must build up trust again and uphold standards of building responsible technology, in order to be prepared for future emergencies. Transparency, oversight, and regulation of Big Tech, as well as being realistic about the efficacy of technological solutions, are the keys to that.

Download the policy brief here.