As COVID-19 spread, contact tracing apps were developed for providing information on whether the user has been in close contact with someone infected with virus. In fact, if 60% of the whole population use contact tracing apps, the pandemic could be stopped and even the lower usage will also have a positive outcome.
At the same time, researchers have argued that contact tracing apps are not a solution to the COVID-19 crisis and false reporting can even cause chaos, one that could be attributed to technological limitations and privacy regulations. These apps have been criticised, leading to the European Data Protection Board issuing specific guidelines. The lower number of users presents a serious issue of privacy because if fewer downloads can compromise their identity. Examples are how Norway had to scrap its app over low download rates that put health sensitive data of users on risk and Lithuania’s app being suspended for breaching the EU rules. India’s app, downloaded by more than 100 million people, has been at the centre of privacy concerns (such as storage of location data, potential data breaches, and the app’s terms of service exempting the government from any liability). How long the data will be held and how it would be processed after the pandemic are some of the questions raised by privacy experts.
The usefulness and surveillance aspects of these apps are tightropes for app-developing organizations. Voluntary use, depersonalization of data and easy opt-out features of these apps might not fully help contain COVID-19, but are essential for the long-term because the absence of these would result in negative reputation and new lawsuits. Furthermore, there is a social contract between organziations and consumers, such that consumers can trust organizations and expect them to follow ethical practices. However, when such trust is lost, it could be devastating for both organizations and consumers. For example, according to the Centrify study, 70% of people whose personal data was breached lost trust and 33% discontinued their relationship with the organizations those could not protect their data. Thus, complying with data protection standards not only brings value, but also saves organizations from potential lawsuits for data breaches.
Though there are multiple stakeholders in developing contact tracing apps, such as governments, universities and technology companies, Apple and Google, being the big players, are setting the rules of the game and that brings the focus on the role of organizations.
While the popularity of contact tracing apps makes users less concerned about privacy, app-developing organizations need to work on how to effectively formulate and convey the value of the app (a cost-benefit analysis) and convince users to download these apps and providing personal data. Organizations that can succeed in providing clear privacy information can assist users in choosing their apps, alleviate privacy concerns and can retain users for a longer time. It is difficult to identity the optimal level of privacy-related information that organizations can share but ethical practices can bring more business not only through the positive word of the mouth offline, but also by positive ‘word of mouse’ on digital platforms.
If organizations collect personal data, it is their responsibility to protect it. They need to develop clear privacy consent mechanisms, provide easy ways to opt-in and opt-out that even a layperson can understand, and provide mechanisms for users to report their privacy concerns. Organizations need to keep tight control over the data vault and monitor the external agencies and vendors with whom they share personal data of users. Organizations need to become ethical stewards and affirm publicly their commitment to privacy concerns. They need to foster a culture of privacy within the organization and educate their employees about privacy policies and data security.
Response to such apps, not only from organizations, but also from civil society to policymakers, is critical for organizations and society because effective responses to privacy concerns would pave the way for future data protection regulations. If organizations that are developing contact tracing apps can successfully manage and address the privacy concerns, they will not only have a first-mover advantage, but also can gain a competitive advantage.