Contact Tracing during COVID-19 - out with medical secrecy? (draft 1)

-- By YanisAliouche - 13 Oct 2023

Introduction

The COVID-19 pandemic represents the first time a wide exception to medical secrecy was implemented . Individual’s personal liberties and privacy were greatly hindered to mor efficiently combat the spread of the virus.

I'm not sure what work this sentence is supposed to do. It creates more objections in the reader's mind (all other existing mandatory public health reporting is different why? Medical privacy is a thing of yesterday and has been routinely violated everywhere since whenever. If this is about contact tracing, then why is it different than all traditional public health, more of which was disregarded during the epidemic than was followed?) than it provides a statement of your idea. Let's lede this right.

Notably, the World Health Organization endorsed contact tracing as a primary method in breaking “the chains of human-to-human transmission by identifying people exposed to confirmed cases, quarantining them, following up with them to ensure rapid isolation, and testing and treatment in case they develop symptoms” .

France adopted two different methods with regards to tracing: Manual Contact Tracing, consisting of interviewing infected persons to identify their contacts, and Digital Contact Tracing, implementing an app ‘TousAntiCovid’ which would send out alerts when a person encountered someone who had COVID.

This essay will explore how France, despite the recognition of the right to privacy as a fundamental right, created legal exceptions to this right during the COVID-19 pandemic. It will assess the effectiveness of the addressing privacy concerns and address ongoing privacy concerns.

Why France? You aren't there, you're here, where Gallic provincialism isn't charming.

The legal framework allowing impediment on the right to privacy

In France, the right to privacy enjoys constitutional and legal protection. It first finds such value in Article 2 of the 1789 Declaration of the Rights of Man and the Citizen, imbedded in the preamble of the Constitution . Legally, Article 9 of the Civil Code guarantees “everyone has the right to respect for his private life”, and article L1110-4 of the Public Health Code creates professional duty of health professionals, ensuring a patient’s right to secrecy with a list of exceptions, if the patient consents.

However, the arrival of the pandemic necessitated exceptions to these privacy protections. As member of the European Union, France adheres to the EU General Data Protection Regulation (GDPR). Article 9 of the GDPR prohibits the processing of personal data (including health data), but for some enumerated situations. Notably, article 9(2)(i), allows for exceptions when “processing is necessary for reasons of public interest in the area of public health…” . Thus, France passed the Law of May 11th, 2020, introduced “by derogation to article L.1110-4 of the Public Health Code” . The law allowed for the implementation of France’s contact tracing tools. What changes? Before, patients would have to give their consent for their data to be shared. Now, your personal data can be processed without your consent, marking a significant shift in the landscape of privacy protection.

For these contact tracing systems to be permissible, the law enabling them had to pass the Constitutional Council’s proportionality test, ensuring that measures infringing on privacy were proportionate to public health safety goals. Secondly, the effectiveness of these systems depends on the cooperation of the French population. For people to trust and actively participate in these systems, the government had to create an image of full confidentiality for the systems to succeed (authors speak of “perceived confidentiality”) .

Efforts to preserve the right privacy

During the Constitutional Council review of MCT system, they approved its limited use for specific purposes, finding that the limitation set for processed data was proportional to the goal of safeguarding public health. However, they objected to the inclusion of telephone numbers and email addresses for epidemiological surveillance and research, deeming it unnecessary. They also struck down part of article 11 of the Law of May 11th2020, which listed entities who would have access to personal data. Finally, time limits were established, allowing MCT systems only during the period strictly necessary to combat COVID-19, with a maximum duration of 6 months after the end of state of health emergency. Extending a state of emergency beyond a month require legal authorization.

MCT lacked in efficiency due to participants’ inability to identify people they encountered that they didn’t know, as well as significant consumption of time and resources. In response, the French governments introduced the StopCovid? app, later renamed TousAntiCovid? . It uses Bluetooth to record nearby app users’ pseudonyms of nearby app users when Bluetooth is enabled. Encounters are stored for 15 days, and if a user self-reports a COVID-19 diagnosis, nearby users potential exposure notifications within the past two weeks . The app pseudonymizes data through the ROBERT Protocol, ensuring it only collects data necessary for its purposes, excluding any data enabling the identification of mobile phones, owners, or users .

Privacy issues arising despite efforts

Despite efforts to protect personal information as much as possible through use of their contact tracking systems, multiple organisms reserve doubts as to the effectiveness of the protection.

Regarding MCT time constraints, France extended the use of its MCT systems beyond the original timeframe. The CNIL expressed concerns about the long-term use of these supposedly temporary systems, regretting that the government provided insufficient justification for maintaining these tools, despite the reduction of virus circulation . Data storage was also extended beyond the initial 3-month limit for research and epidemical purposes. The French Medical Council opposed, stating that its support of MCT systems had been based on the data period storage initially guaranteed. Additionally, while the Constitutional Council had partially reduced the list of stakeholders with access to personal data, it remained extensive.

In the case of DCT, pseudonymized data does not mean anonymized data. Centralized CT systems can lead to combining pseudonymized data with other data collected by a device, ultimately leading to the determination of one’s identity. TousAntiCovid? app uses the ROBERT system and a CLEA system, which generates QR codes for users to present as proof of vaccination when entering public places. It creates a timestamp and recognizes location information. Although independent from ROBERT, cross referencing information between the two systems allows for deduction of a person’s identity . Additionally, when someone is tested positive for COVID, CLEA’s processing of data stops as the person has no reason to enter public spaces – only ROBERT continues. Thus, when you see that CLEA has stopped processing data, it is safe to deduce that the person has contracted COVID.

In my view, the best way to improve the draft is to find the idea you want to convey to the reader, state it clearly, show how you came by it, deal with the relevant objections as you think necessary, and give the reader a way to carry the idea further for herself.

Whatever the organizing idea is, it is not "during a global health emergency involving the largely homogenized platform-based social communication and control system of the early 21st century, here are a bunch of acronyms related to the way one tiny unimportant self-deceiving bunch of incompetents did pretty much the same as everyone else but you need to read all the details about it because I am French."

I recognize that this sort of bullshit has been what Les Grands Personnages have defined as education since Napoleon, and that no Son of the Hexagon can be faulted for routinely delivering it whenever thinking is called for. But you have escaped. Lafayettes, nous sommes ici. In the New World we can have new ideas. Let's give it a spin: Find your inner Benjamin Franquelin.