France urges Apple and Google to ease privacy rules on contact tracing
France has become the first country to call publicly for Apple and Google to weaken privacy protections around digital contact tracing, after its government admitted that its current plans would not work without changes to smartphone operating systems.
The criticism comes two weeks after a landmark collaboration between the two companies to build technology enabling digital contact tracing apps, which would track contacts between users in an attempt to help slow the spread of Covid-19.
The collaboration enables phones from both companies to work together, but also sets strict limits on what data can be sent back to public health authorities. It is those limits that France wants lifted, France’s digital minister, Cédric O, said in an interview with Bloomberg News.
“We’re asking Apple to lift the technical hurdle to allow us to develop a sovereign European health solution that will be tied our health system,” O said.
Contact tracing apps that do not conform to the new privacy requirements can still be built, but they face strict limits, particularly on Apple phones. They don’t work when “backgrounded”, as when another app or game is in use on the phone, nor when the screen is locked entirely.
Some countries have forged ahead despite the limitations, such as Singapore’s TraceTogether contact tracing app. Others, including the UK, have privately expressed concern, while maintaining amicable relations with the two tech firms publicly.
The French intervention could encourage others to bring their disputes into the open, however. At the heart of the criticism is the question of who has the power to decide the best balance between user privacy and contact tracing efficacy: technology companies or public health bodies.
France wants to deploy its app by 11 May, without using the special measures Apple and Google have put in place, which are targeted for release in mid-May. That means the country will be forced to use the more limited features already built into iOS, unless Apple changes its policies and allows for far more invasive use of the Bluetooth radio at the heart of its devices.
For the two technology companies, there is a second set of tradeoffs: any tools they offer to one government must be offered to every government. That is why they seek to maintain a high level of privacy across the board and not offer opt-outs.
As well as preventing excess data from being sent back to public health authorities, the forthcoming tools will have other constraints. Apple and Google say they will maintain the ability to disable them on a regional basis once the current crisis is over, and they will refuse to authorise any government which seeks to make installing the apps compulsory.
Their approach was supported on Monday by a letter from nearly 300 privacy experts, who warned that contact tracing apps “can otherwise be repurposed to enable unwarranted discrimination and surveillance”.
“We urge all countries to rely only on systems that are subject to public scrutiny and that are privacy preserving by design (instead of there being an expectation that they will be managed by a trustworthy party), as a means to ensure that the citizen’s data protection rights are upheld,” the letter said.