Privacy risk in contact tracing systems

For over a century, contact tracing has been an integral public health strategy for infectious disease control when there is no pharmaceutical treatment. Contact tracing for the coronavirus disease COVID-19 introduced a variety of automated methods deployed across several countries. The present paper examines privacy risk to infected persons and their physical contacts in contact tracing systems. Automated contact tracing systems implemented during the early months of COVID-19 are compared to conventional manual methods. Solove’s taxonomy of privacy is applied to examine privacy risks in both conventional and automated contact tracing systems. As a method of epidemiological surveillance, all contact tracing systems inherently incur privacy risk. However, compared to conventional methods, automated contact tracing systems amplify privacy risk with pre-emptive data collection on all app users, regardless of exposure to an infectious disease; continuous, granular data collection on all users’ location and proximity contacts; insecurities in proximity app technologies and interconnectivity; and in many cases, the use of centralised systems. Reducing these risk factors can reduce privacy harms, such as identification, distortion, secondary use, stigma, and social control.