One of the world’s most powerful advocates of digital privacy rights admits that people may need to yield some of those protections, at least for now, in order to keep the coronavirus at bay.
Cellphone apps to help trace contacts will become a way of life — but must be introduced carefully, says Margrethe Vestager, the European Commission’s Executive Vice President in charge of digital affairs and competition, in a video interview with TIME from her office in the almost deserted E.U. headquarters in Brussels. “The deal should not be, ‘you are open but under surveillance,’” she says. “The deal should be, ‘we will open, but we will track the virus.’”
The technology that would track coronavirus cases, which authorities across Europe and the U.S. plan to roll out over the coming weeks, is at the center of a debate over data privacy and transparency. The tracing apps will alert people when they have been in contact with someone who has tested positive for COVID-19 so they can self-quarantine or seek a test. If they work well, the apps would help governments reopen their battered economies without risking a resurgence of the pandemic, as people begin riding buses and trains in large numbers, and returning to offices, factories and schools. South Korea, which launched its own tracking app shortly after coronavirus numbers began rising, has managed to bring local infections down to zero without going into lockdown at all.
In one sense, this is an old idea. These apps are simply a tech-era version of the painstaking door-to-door tracking in previous pandemics, like the 1918 Spanish flu. But tech experts in Europe fear the apps could permit companies like Apple and Google—which have developed an operating technology for countries to use—and governments to collect and store vast amounts of data not just on citizens’ health but also their movements and whereabouts.
That criticism has erupted especially loudly in France, where the government has recruited some of the country’s biggest companies, like CapGemini and Dassault Systems, to develop a tracking app called StopCovid, which it plans to roll out after easing the lockdown next week. “It’s the mission of the state to protect the French,” France’s digital affairs minister Cedric O told a journalist in April. “It is a question of health and technological sovereignty.”
But unlike many of the apps being rolled out across Europe, the French app would store data on a centralized server—something privacy advocates fear could give the government the power to conduct mass surveillance. “All these apps carry very big risks with respect to private life and personal freedoms,” said a petition to the French government last week, signed by about 100 tech experts, in an effort to block the launch of the app. The U.K.’s tracking app is also designed to store data on centralized servers, so that health authorities can gain access to it.
On April 22, the E.U. Commission drafted guidelines for the 27 member countries, saying that tracing apps should be voluntary, preserve people’s privacy, and that they need to be disabled once the pandemic ends. Vestager says trust is also an essential component in the rollout of the apps. “It must be a voluntary choice for people to say, ‘I want on my phone this app that will tell me if I’ve been close to someone who turns out to be infected,’” she says. “Without that trust, there is a huge risk that people will say ‘no I don’t want it,’ and then, well, it does not work.”
Remarkably, given her years of battle against giant tech companies, Vestager believes the crisis might result in Silicon Valley winning over its skeptics. With the entire world focused on beating the virus, she says, global tech companies could seize this moment to redeem themselves in the eyes of millions of users, who have grown increasingly wary of apps sucking up their personal data. “I see that as an enormous opportunity for them to contribute and do something that is very, very useful,” Vestager says. “It is a very big chance for them to say, ‘we will in transparency enable a system that protects your privacy, and allow ourselves to be tracked to see if we’re doing as we say we’re doing.’”
For an official who has a reputation as an antagonist of Big Tech, it is a strikingly optimistic view—perhaps signaling how much the pandemic has forced officials everywhere to adapt to new measures, in the fact of deep economic and social pain.
Vestager, 52, helped oversee the rollout of the world’s toughest data-privacy law, which the E.U. passed two years ago. Called the General Data Privacy Regulation, or GDPR, it allows users to opt out of having private firms collect much of their data. While the rules were drafted before Vestager arrived in Brussels in 2014, she became closely identified with Europe’s drive to rein in Silicon Valley, as people increasingly grew uneasy about tech’s pervasive presence in their lives. Vestager has vigorously pursued antitrust cases against tech giants, and has also fined them for tax evasion as part of sweetheart deals with E.U. members like Ireland, the Netherlands, and Luxembourg.
That has earned Vestager—a mild-mannered Danish politician—global fame as a champion of individual rights versus the mammoth power of Silicon Valley. “She hates the U.S. perhaps worse than any person I’ve ever met,” President Donald Trump said of Vestager last year, when she issued a $1.7 billion antitrust fine against Google.
But now, with the pandemic, Vestager sees a chance for peace with Silicon Valley, whose biggest companies will be key to making Europe’s new tracking apps work on mobile phones across the Continent. Google and Apple announced on April 10 they would join forces to create an API, a sort of toolbox for developers, that would make it easier for countries’ COVID-19 tracking apps to work on mobile devices, whether they use Google’s Android system, or Apple’s iOS.
That would allow national tracking apps to work on millions of cellphone devices, without themselves tracking the pandemic—a task left to governments themselves, according to Google and Apple. While different apps would work in different countries, that is not a major hurdle for now, since travel is highly restricted globally under the lockdown measures.
But for the technology to work, millions of people will need to feel comfortable downloading the apps — and uploading personal data. Say, for example, you sit next to an infected person on a New York subway or a Paris bus, or at a dinner in Berlin. Using Bluetooth technology, your phone would alert you that you might be at risk of contracting the coronavirus—but only if you and the other person have both downloaded the tracking app.
Rolling out the apps among small groups of people, for example one workforce, seems easier to accomplish–and that is already underway. When the luxury automaker Ferrari reopened its factory recently in northern Italy—the epicenter of Europe’s outbreak—it began testing a COVID-19 tracking app created by the Milan startup Bending Spoons, which it had its workers install on their mobile phones; it also tested hundreds of workers for the coronavirus before it reopened. The company has not revealed how many people it has alerted through the tracking app.
“We need a very, very high penetration of these apps for them to matter, and every decision that users make will drop that significantly,” Tomas Pueyo, an app developer who has authored a series of widely-read examinations of the pandemic, wrote this week on Medium. “But if we achieve it, the prize is amazing.”
That amazing prize—beating the virus—is one reason Vestager remains optimistic that tech companies will be responsible in how they collect data. “We have a unique situation to enable people to trust in technology,” she says. “It is really about trust, making sure that we do not unleash a completely new era of surveillance, instead of tracking the virus.”
The operating technology designed by Apple and Google does not allow for centralized data collection, to the dismay of the French government among others. But E.U. officials remain on their guard about the Silicon Valley giants. In a video call in April, the bloc’s industry chief Thierry Breton pushed Apple CEO Tim Cook for assurances that people using the technology would remain anonymous, and that the system would be removed from mobile phones once the pandemic is over. “Deconfinement apps must respect our privacy,” he tweeted. Two days after Breton’s call, Apple and Google announced they were building in stricter privacy, by generating random number sequences that would prevent people from being identified, and encrypting the data that is transmitted.
“We need collaboration between the private companies, governments, and app developers,” Vestager says. “And first and foremost, we need transparency.” For once, the tech industry might agree with her.
