contact tracing and the law

1. What is contact tracing?
Legal issuers and discussion-
international perspective
Ikuo Takahashi
Komazawa Legal Chambers

2. Contact tracing
• Concept
• In public health, contact tracing is the process of identification of persons who may
have come into contact with an infected person (“contacts”) and subsequent
collection of further information about these contacts. By tracing the contacts of
infected individuals, testing them for infection, treating the infected and tracing their
contacts in turn, public health aims to reduce infections in the population.
(Wikipedia)
• Nuance of the Name
• Mass surveillance to Privacy advocate?
• Privacy Preserving -Proximity Tracing(PP-PT)
• Exposure Notification
• Behavior Modification Application
• Ikuo’s View
• Cluster Prevention Assisting Application

3. Exit strategy and Contact tracing
• Exit strategy
• EU “Joint European Roadmap towards lifting COVID-19
containment measures”
• Criteria
1. Epidemiological criteria
2. Sufficient health system capacity
3. Appropriate monitoring capacity
1. testing capacity
2. Contact tracing
3. possibilities to isolate people

4. Contact tracing around the world in 20 min.
• China
• Health Code
• Singapore
• Pauline
• Germany
• Dr.Akemi Yokota

5. Singapore
• GovTech Agency
• TraceTogether
• VigilantGantry
• Self-help Temperature Scanner
• Travel and Health Declaration System
• Ask Jamie chatbot

6. TraceTogether
１ exchange anonymous ID
２ Anonymised and stored only in device
３ contact tracer have the control
of positive user
４ registration of COVID-19 positive
5 Upload anonymous ID list
６ That’s it.

7. TraceTogether is based upon;
• GovTehAgency
• BlueTrace as protocol.
• Policy document
• Excellent white paper is published

8. Framework in EU
• Basic framework
• European Human Right Convention Article 8
• GDPR
• Principles
• Public health
• ePrivacy directive－national legislations

9. Timeline of contact tracing Apps in EU(1)
• European Union Agency for Fundamental Right Report（April 7）
• Till March 20th.
• Germany － short description
• EDPB
• “Statement by the EDPB Chair on the processing of personal data in the context of the
COVID-19 outbreak”（March 16）
• Statement on the processing of personal data in the context of the COVID-19 outbreak.
https://edpb.europa.eu/sites/edpb/files/files/news/edpb_statement_2020_processingp
ersonaldataandcovid-19_en.pdf） （March 19）

10. Timeline of contact tracing Apps in EU(2)
• European Commission
• “COMMISSION RECOMMENDATION of 8.4.2020 on a common Union toolbox for the
use of technology and data to combat and exit from the COVID-19 crisis, in particular
concerning mobile applications and the use of anonymised mobility data”（April 8）
• －＞Suggestion toolbox
• Google –Apple press release (April 10）
• “Joint European Roadmap towards lifting COVID-19 containment
measures”（April15）
• EU
• 「Mobile applications to support contact tracing in the EU’s fight against COVID-19
Common EU Toolbox for Member States 」（Toolbox）（April16）
• European Commission”Guidance on Apps supporting the fight against COVID 19
pandemic in relation to data protection”（April 16）

11. Requirements in the Toolbox
• Epidemiological framework
• Technical framework
• cross border framework
• cybersecurity
• safeguards
• Accessibility and inclusiveness

12. United Kingdom(1)
• ICO announce（March28）－aggregated data
• BBC（March31） Intro of Oxford university research
• NHSX original contact tracing plan（BBC－April12）
• “Effective Configurations of a Digital Contact Tracing App: A report to
NHSX”（April16）
• ICO” Information Commissioner’s Opinion:Apple and Google joint initiative
on COVID-19 contact tracing technology”（April17日）
• Matt Hancock’s comment’s on contact tracing apps.(07:20-) （April23）
• NHS CEO Gould’s blog ”Digital Contact tracing：protecting the NJS and
saving lives”（April24）

13. United Kingdom (2)
• ICO’s comment’ s on NHSX apps（April 24）
• BBC News “NHS rejects Apple-Google coronavirus app plan”（April
27）
• NHSX adopts centralsed approach.
• Commons Science,Technology Committee testomony（April28）
• Matthew Gould CMG MBE(Chief Executive Officer at NHSX)

14. United Kingdom (3)
• ICO “COVID-19 Contact tracing: data protection expectations on app
development”（April30）
• Expectations to developers and so on.
• Recommendation of DPIA
• Both Centralised and de-centralized need central server
• 10 principles （transparency,data minimization,control）
• Joint Committee on Human Rights“Human Rights and the Government’s
Response to Covid-19: Digital Contact Tracing”（May 6）
• Efficacy and proportionality
• Primary legislation
• Oversee
• Protection of child
• Review efficacy
• transparency

15. Australia COVIDSafe
• COVID Safe
• framework
• DTA（Digital Transformation Agency)
• Tele NO.
• Postal NO．
• PIA（Privacy Impact Assessment）
• THE COVIDSAFE APPLICATION
Privacy Impact Assessment

16. Seeking Research Fund
• Comparative study of law
• Cognitive Research of Privacy and
Public health)
• Publishing Plan (Kindle)
• Novel Corona virus vs. Privacy
• Review of “Data Protection religion”
• Arrangement of my blog

17. Challenges and future
Challenges as “Wrap up”

18. Principles and issues
－Four black letters and One Chaos－
• Under the responsibility of State
• Based on Epidemiological framework
• Respect for Privacy
• issues in details
• Cyber security principles
• Transparency principles

19. Respect for Privacy
Principle
• Tools should be designed to respect the privacy（Privacy by design)
• Maximum respect as long as balance with public health during the lifetime
of the data
Issues in details
• consent by free will
• Default NO vs Opt out may be OK
• volunteer character
• Disadvantage prohibited- How about incentives?
• distinction bw/ personal data and not personal data
• Does perception between personal data and not personal data differ fundamentally or
gradually?

20. Which do you prefer?
Card 1
data Tele No. Post code Stored in central sever
Lock down Till end of May
Card2
data No data at registration
Lock down Till June 7

21. Japan standing point
（Tech team May 8 references）
• Central server
processing v.
terminal processing
• Is this pic correct?
• Trade off issues v.
privacy as base line