Understanding resistance to contact tracing: data being used for purposes other than those for which they were initially collected, and governments’ use of the data

I came across a paper reporting on a series of surveys of attitudes towards contact tracing, for the purpose of containing the spread of Covid-19, and how it related to concerns over privacy. The paper is entitled “COVID-19 Contact Tracing and Privacy: Studying Opinion and Preferences”, and it was co-authored by Lucy Simko, Ryan Calo, Franziska Roesner and Tadayoshi Kohno.

The paper is not ground-breaking in terms of the insight provided regarding attitudes to downloading an app designed to monitor the spread of Covid-19. Indeed, it could be described as yet another study confirming that people are reticent to have their movements tracked, and to share their personal information with government:

Moreover, to be fair, the paper has various limitations. For a start, the surveys were conducted in April 2020, which is a very long time in a rapidly evolving situation like the current pandemic: we knew even less about the pandemic than we know now; there was some talk of contact tracing by various governments but not many specific initiatives; and many countries were in lockdown (formally or informally). Then, the sample is very broad, meaning that the responses may be shaped by numerous factors other than the one explicitly considered in the paper (i.e., privacy concerns): 26% of respondents reported being based in the UK, 16% in the US, 46.5% from other European countries, and 11.5% from elsewhere in the World. The sample is also very biased in age terms, with nearly half of them being less than 25 years old. Another limitation is that people tend to report more privacy concerns than reflected in their actual behaviour – a phenomenon called the privacy paradox.

However, in my view the paper offers very interesting insight into the survey respondents’ view of contact tracing, because it considers various mechanisms for identifying and alerting those that might have been in contact with someone with Covid-19. Specifically, the survey considered the following options:

• Contact tracing via a new, purpose-built app
• Contact tracing via an existing app which already collects location data
• Contact tracing via mobile phone data
• Contact tracing via credit card data
• Contract tracing via surveillance (CCTV) cameras

One might think that, since many services and entities are already collecting data that reveals where people have been, and with whom, it would make sense to use data that exists already, rather than spend resources developing a new mechanism for collecting such data. Moreover, if large numbers of people are already using such services (mobile phones, credit cards and apps such as Fitbit), it is possible that the users of those services would prefer the convenience of using the already existing data for an additional purpose, rather than downloading a new app and giving their location data to yet another entity.

Yet, the researchers found that respondents were significantly more positive about contact tracing via an app, than via the other sources mentioned in the survey: mobile phone data, credit card data, or surveillance (CCTV) cameras. They were particularly uncomfortable with monitoring via credit card and surveillance cameras.

The qualitative responses help us understand why this is the case: participants are very uncomfortable with their data being used for purposes other than those for which the data were initially collected. When asked who they would trust the most to run a new app that would monitor their location, respondents showed strong preference for a University Research Group because “(universities) have little to gain by having my data other than to use it for its intended reasons” (page 13).

In particular, respondents were concerned that the government would end up using the data collected via such an app in ways that would hurt them or their community:

The responses also show that, if the app were to be offered by a company (as opposed to the government, a university, etc…), participants would prefer “a company that they already trust with respect to security and privacy and that they perceive to have the resources and domain knowledge to add location tracking and analysis. To some, it is important that location tracking is already the primary purpose of the app, if added to an existing app. Many expressed a more positive view of specific companies (e.g., Google) or apps (e.g., Google Maps), even before Google and Apple announced their efforts.” (page 2).

In summary, as far as privacy is concerned, people are likely to resist contact tracing because of fears that data may be used for purposes other than those for which they were initially collected, and, in particular, concerns over how governments will use the data.