On Saturday 18 and Sunday 19 April 2020 I participated in the ‘Appathon’ of the Ministry of Public Health, Welfare and Sport. As my colleague Joost Linnemann and I have recently advocated, we as experts should take responsibility wherever possible and contribute to solutions in the fight against the coronavirus. This is more rewarding than shouting from the sidelines that something is not going well.
The ministry has opted for a daring approach by searching from an intelligent lockdown for innovative ways to loosen the reins in a controlled way. Controlled in order not to unnecessarily endanger human lives and to keep the pressure on health care manageable.
A positive aspect is that the ministry is seeking support for the use of smart technologies: it has involved experts and the public in exploring the possibilities and (further) development of apps.
That does not alter the fact that the process has been criticized (and rightly so). The time pressure was too great and the organization from the ministry could have been better. Inevitably, this is detrimental to the quality. I share the criticism of a number of experts in the media and after the first expert session on Thursday I have seriously doubted to withdraw as well.
A brief look back. On Thursday, 65 experts, divided into ten teams, were presented with a total of around 70 proposals. They were only disclosed on the day itself. We had ten minutes to familiarize ourselves with each proposal and then a quarter of an hour to exchange ideas with other experts. In my experience, it was no more than a coarse sieve to help the ministry to separate a number of promising proposals from roughly 700. Many experts withdrew after the announcement that seven proposals had been selected ‘after a stern selection process by experts’. This communication did absolutely no justice to the process. I also felt uncomfortable with the way the outcome of the day was presented. It is true that the Appathon that followed offered an opportunity to come to a deeper level, but the preparation time was again very limited. Meanwhile, the public summary of a privacy analysis of the proposals by the State Advocate is available, as well as a security analysis by KPMG. The Dutch DPA will make its findings public today.
My conclusion is that there will inevitably still have to be a very thorough further analysis of the proposals. It will then be crucial that experts (epidemiologists, technicians, data security experts, behavioural scientists, privacy experts) in an actual co-creation session define how a smart technology can contribute in a responsible manner to the reduction of the pandemic.
Based on my expertise, I believe that it is possible to design corona apps in a privacy-friendly way. The GDPR requires this: the so-called requirement of privacy by design. Crucial elements are pseudonymization, data minimization, voluntariness, the ‘data subject in control’, strict purpose limitation and a sunset regime.
It is essential that the introduction is accompanied and framed by legislation, in order to ‘harden’ the principles mentioned and to be able to enforce compliance. It is therefore a 'supporting policy' that prevents purpose limitation being diluted, people being socially forced to use the apps and/or share data (with employers) or to be allowed to make use of facilities such as public transport; restaurants, etc.
Our offer to the Minister that a team of renowned privacy experts is willing to advise pro bono is of course still standing. We are ready to think along!
