Privacy-friendly design promotes trust in contact tracing apps

Innovative applications are needed to address privacy concerns

In recent months, there's been a lot of debate about using phone apps to help control the COVID-19 pandemic. Recently, the Dutch contact tracing app's developers unveiled their first designs on GitHub. The big question people were asking beforehand – and a question that remains relevant where the new app's concerned – was how can you process data about millions of people without compromising their privacy? That same question has been occupying e-identity experts for a long time. After all, it's pertinent to many online applications, and one of the principal reasons why SIDN decided to support IRMA. What role can innovations like IRMA play in solving privacy issues?

Security is the key to privacy protection

Debate surrounding contact tracing apps is distracting attention from the underlying issues, however. The app is just the visible interface between the user and a more complex infrastructure. That infrastructure may be based on a central database maintained by the app provider, or on data retained locally on the user's phone. And the security of that data is the key to protecting the user's privacy.

Medical data is 'special personal data'

Security is even more important with a health-related app, such as a contact tracing app. That's because data about a person's health counts as 'special personal data': a category of personal data covered by extra legal requirements. However, the need to comply with the law isn't the only reason for protecting sensitive data. The success of a contact tracing app depends on widespread take-up, which won't happen unless people believe that their data's safe.

No central data storage

One way to prevent the misuse of personal information is not to store data centrally, but keep it on the user's phone instead. The app makes a list of all the other phones it's come close to. Then, if the user gets infected, the users of the phones on the list get notifications from their apps. No information about who's been where or with whom is stored in a central database, so there's no possibility of such info being abused. The drawback of not centralising is that detailed analysis isn't easy. Who has a carrier been in contact with? How can a contact be reached if they've lost their phone or something?

We share more information than we need to

Even a decentralised solution raises questions. After all, what data are you sharing? As things stand, when we identify ourselves, we're generally sharing a lot more information than we mean to. It's like showing your passport when a shopkeeper asks for proof that you're old enough to buy alcohol. All the shopkeeper needs to know is your age, but when you show your passport, you're sharing a lot of other info besides.

Sharing only necessary data

Various applications have therefore been developed that let you keep what you share to the absolute minimum. IRMA is a good example. It's an identification and authentication system where the user authenticates their data ahead of use and keeps it on their phone. The phone then shares only the info that's necessary in a particular situation. Asked whether the user is old enough to buy alcohol, the phone says simply 'yes' or 'no'. Numerous developers have therefore integrated their concept apps with IRMA.

The user decides

So it's possible to control what data is shared. But that begs the question: what data does a contact tracing system actually need? Should a tracing app simply share the fact that there's been contact with someone who has the virus? Or should it also report where, when and for how long? And what about when the user developed symptoms? With IRMA, the user decides what's shared and what isn't.

Control creates confidence

IRMA isn't a miracle cure. However, applications like IRMA can help in controlling COVID-19 by giving users the confidence that their data is going to be used responsibly. That's vital, because the more confidence people have in an app, the more likely they are to use it. And go on using it into the future. Want to give it a try? Download the IRMA app or visit our website for more information about IRMA.