Some contrarian thoughts on the deployment of contact-tracing apps

Abstract

These thoughts have been prepared in response to the overwhelming reliance on the advice of a small number of data protection law and privacy experts regarding the deployment of contact-tracing apps. Much of the public debate has focused on the nature of centralised vs decentralised privacy-preserving technology. This article argues that the GDPR’s drafters envisaged public health emergencies would require alternative approaches to the processing of personal data and privacy. Accordingly, contact-tracing apps should be designed with the effectiveness of functionality in mind first, with strong measures to protect and safeguard the rights and freedoms of data subjects imposed by law. Accordingly, the focus should move away from privacy-preserving design at the expense of functionality, to using law to properly ensure privacy safeguards.