Tracker apps have been identified as a key part of the Dutch government’s strategy to lift the coronavirus restrictions after April 28, but the prospect of people’s medical details being collected and shared has raised concerns about the implications for privacy.

Prime minister Mark Rutte said on Tuesday the government was studying two possible types of app – one to alert people if they had been in contact with someone who was later diagnosed with Covid-19, and another to keep potential patients in touch with doctors.

Rutte and health minister Hugo de Jonge stressed that guaranteeing privacy was a precondition of any technological approach to tackling the virus and people’s consent would be sought. However, the government has not ruled out making use of the apps compulsory.

Aleid Wolfsen, head of the national privacy watchdog Autoriteit Persoonsgegevens, said the technology carried a real risk of intruding into people’s personal lives. ‘What we are seeing now is exceptional and historic. I admire the way people have adapted surprisingly quickly to the new situation. Measures have been widely adopted and that’s fantastic,’ he told AD.

‘At the same time, it makes sense for us to think abut the consequences, such as tracking people. The real art is to maintain the balance between privacy standards and the changing circumstances.’

Bluetooth

Wolfsen said sharing details about people’s whereabouts using technology such as Bluetooth, which can track if people’s mobile phones have been in close proximity, was potentially ‘very intrusive’.

‘Data can only be shared if you have given permission or it’s anonymised. A measure like that has to be clear, proportionate to its aim and include sufficient safeguards. We will be checking these points carefully if any such law is proposed.’

Feike Sijbesma, chairman of the managing board of chemicals company DSM, who is one of the government’s special envoys on coronavirus, said the Netherlands was already studying apps used in other countries that allowed data to be shared anonymously.

‘In those countries where it’s being used people are pleased that they know when they’ve been in contact with a patient,’ he told Het Parool.

‘The details aren’t shared on the basis of your name. It just says: somebody was in your vicinity. Not the name Pietje Puk.’

Anonymous codes

Technology expert Ronald Prins, who set up cybersecurity company Fox IT, told AD that privacy could be protected using anonymous codes. Users of the app would be traced via a number that was kept separate from their personal details and their location details would not be stored – only information about who they had been in contact with.

Prins said a tracker app could be an effective means of containing the virus even if not everybody used it. ‘Even if only 70 or 80% install the app, it will be a huge help to those fighting the virus. I think there will be plenty of support for it.’

Prins’s main concern was that the speed at which the app would need to be rolled out could leave it vulnerable to hackers or security breaches. ‘

‘Apps like these can be made with good intentions, but mistakes can be made in the course of programming. Normally you would spend months testing them and let hackers try to break in to them, but there isn’t much time for that here.’

Legal issues

Legal expert Christiaan Alberdingk Thijm said the government could run into difficulties if it tried to make the use of tracker apps compulsory, even if it used the justification of protecting public health.

‘The basic principle is that medical details can only be distributed with somebody’s permission. It is possible to share information without permission in the interests of public health. But it would have to be absolutely necessary to use such an app.

‘They would have to prove that there is no other way to protect public health. I seriously question whether the government would be able to do that.’

Aleid Wolfsen said people’s need for safety should not blind them to the risks of the government or employers encroaching on their private lives. He told AD he had fielded calls from employers asking if they were entitled to check their workers’ temperatures at the office.

Privacy at work

‘Employers cannot play doctor,’ he said. ‘People decide for themselves what they share about their illness and that hasn’t changed. Employers do have a duty to create a safe environment for their employees and can give instructions such as keep your distance and stay home if you’re ill.’

‘At times like this we need to be extra alert,’ Wolfsen said. ‘Once the crisis is behind us, you can say to your employer: “I shared this with you under these circumstances, but I don’t want that information to be stored or used.”

‘It’s like the right to be forgotten on Google. I’d advise everyone to look back later and see if they didn’t share too much information. The essence of it is: you’re the boss.’