Tracking COVID-19 with Italy's "Immuni" app: data gathering, privacy protection and public health
Elena Falletti – Università Carlo Cattaneo, LIUC
Efforts to trace contacts made by persons who are COVID-19 positive in order to contain contagion has been recently overshadowed in the media by news of vaccines. Actually, containing the COVID-19 outbreak requires both the administration of vaccines and contact tracing, so restrictions on social and economic activity can be managed as effectively as possible to keep the rate of infection under control. That’s why, at the Second Machine Lawyering Conference, I focused my paper on the functioning of “Immuni”, the Covid-19 contact tracking app used in Italy (the paper is attached below).
Policy on the protection of personal data of tracked persons offers two approaches. On one hand, there is the centralised model, in which the anonymised data gathered is uploaded to a single national remote server where data matches are made with other contacts if a person develops Covid-19 symptoms. This choice allows outbreak control and data collection, storage and treatment to be maintained at national level, placing the protection of privacy in the background, even if personal data are anonymised. On the other hand, the decentralised model keeps personal information on the users’ device. In this case, data matches are then made with people who are found to be infected.
From this perspective, the massive collection of personal data related to COVID-19 could present an opportunity to evaluate the use of predictive models following an open discussion involving experts and public opinion about the effectiveness of the enforcement of AI models. In Italy, the main challenge was to persuade people to download and use the app, showing trust in public policies and strategies planned by the Italian Government against the COVID-19 outbreak. According to the Italian government, privacy protection, individual consent, and local data management were considered preferable to mandatory traceability and centralised management of the same data.
In order to collect massive personal data under constitutional and legal provisions, the Italian Government issued Law-decree No. 28/2020 regarding urgent measures for the introduction of a national Covid-19 alert system, “Immuni”. This decree regulates the collection and management of big data through a black box. Regarding privacy protection, this law establishes some guarantees for users, and for this purpose any person, on a voluntary basis, can download a special software application, respecting the transparency principle and providing the information required by the legal framework for data collection.
Two alternatives should be kept in mind when evaluating worthiness. On one hand, turning to an assumed rescue by technology may be questioned, since technology might “bypass” and autonomously resolve constitutional issues, also through the authoritative power of the government. On the other hand, we should examine whether the traditional hierarchy of legal sources, starting from the constitutional source of protection of inviolable rights, should be our preferred starting point.
In any case, the juridical form of the tracking app used to tackle the outbreak is important, and legitimates the legal framework that, for reasons of protection of public health, imposes very invasive restrictive measures on personal freedoms of each person.
As is very well-known, technology is not neutral even if it is blind, but its blindness can lead to serious discrimination in its use, since it can make discriminatory distinctions between equal cases or treat different cases equally. From this perspective, it is necessary to assess the adequacy of the technology applied to personal tracking by asking detailed questions about the actual use of the collected and stored personal data. The sensitive issue regards the fact that these data do not concern only the protection of health, but also other fundamental personal liberties and rights involved in such data processing, such as personal freedom or the right of movement and assembly.
As of 17 February 2021, Immuni had been downloaded 10,317,607 times, with a strong increase during January, sending 88,711 notifications and reporting 11.554 positive users (source: https://www.immuni.italia.it/dashboard.html). This seems to show an imbalance in contact tracing numbers. Indeed, it reveals a problem concerning the ability to trace, and thus isolate, the contacts of positive persons. This is an essential step for the containment of the pandemic, which at the moment is a crucial point in Italy.