Dataset Information

Data Management and Privacy Policy of COVID-19 Contact-Tracing Apps: Systematic Review and Content Analysis.

ABSTRACT:

Background

COVID-19 digital contact-tracing apps were created to assist public health authorities in curbing the pandemic. These apps require users' permission to access specific functions on their mobile phones, such as geolocation, Bluetooth or Wi-Fi connections, or personal data, to work correctly. As these functions have privacy repercussions, it is essential to establish how contact-tracing apps respect users' privacy.

Objective

This study aimed to systematically map existing contact-tracing apps and evaluate the permissions required and their privacy policies. Specifically, we evaluated the type of permissions, the privacy policies' readability, and the information included in them.

Methods

We used custom Google searches and existing lists of contact-tracing apps to identify potentially eligible apps between May 2020 and November 2021. We included contact-tracing or exposure notification apps with a Google Play webpage from which we extracted app characteristics (eg, sponsor, number of installs, and ratings). We used Exodus Privacy to systematically extract the number of permissions and classify them as dangerous or normal. We computed a Permission Accumulated Risk Score representing the threat level to the user's privacy. We assessed the privacy policies' readability and evaluated their content using a 13-item checklist, which generated a Privacy Transparency Index. We explored the relationships between app characteristics, Permission Accumulated Risk Score, and Privacy Transparency Index using correlations, chi-square tests, or ANOVAs.

Results

We identified 180 contact-tracing apps across 152 countries, states, or territories. We included 85.6% (154/180) of apps with a working Google Play page, most of which (132/154, 85.7%) had a privacy policy document. Most apps were developed by governments (116/154, 75.3%) and totaled 264.5 million installs. The average rating on Google Play was 3.5 (SD 0.7). Across the 154 apps, we identified 94 unique permissions, 18% (17/94) of which were dangerous, and 30 trackers. The average Permission Accumulated Risk Score was 22.7 (SD 17.7; range 4-74, median 16) and the average Privacy Transparency Index was 55.8 (SD 21.7; range 5-95, median 55). Overall, the privacy documents were difficult to read (median grade level 12, range 7-23); 67% (88/132) of these mentioned that the apps collected personal identifiers. The Permission Accumulated Risk Score was negatively associated with the average App Store ratings (r=-0.20; P=.03; 120/154, 77.9%) and Privacy Transparency Index (r=-0.25; P<.001; 132/154, 85.7%), suggesting that the higher the risk to one's data, the lower the apps' ratings and transparency index.

Conclusions

Many contact-tracing apps were developed covering most of the planet but with a relatively low number of installs. Privacy-preserving apps scored high in transparency and App Store ratings, suggesting that some users appreciate these apps. Nevertheless, privacy policy documents were difficult to read for an average audience. Therefore, we recommend following privacy-preserving and transparency principles to improve contact-tracing uptake while making privacy documents more readable for a wider public.

SUBMITTER: Bardus M

PROVIDER: S-EPMC9278406 | biostudies-literature |

REPOSITORIES: biostudies-literature

ACCESS DATA

Similar Datasets

Project description:BackgroundMany countries across the globe have released their own COVID-19 contact tracing apps. This has resulted in the proliferation of several apps that used a variety of technologies. With the absence of a standardized approach used by the authorities, policy makers, and developers, many of these apps were unique. Therefore, they varied by function and the underlying technology used for contact tracing and infection reporting.ObjectiveThe goal of this study was to analyze most of the COVID-19 contact tracing apps in use today. Beyond investigating the privacy features, design, and implications of these apps, this research examined the underlying technologies used in contact tracing apps. It also attempted to provide some insights into their level of penetration and to gauge their public reception. This research also investigated the data collection, reporting, retention, and destruction procedures used by each of the apps under review.MethodsThis research study evaluated 13 apps corresponding to 10 countries based on the underlying technology used. The inclusion criteria ensured that most COVID-19-declared epicenters (ie, countries) were included in the sample, such as Italy. The evaluated apps also included countries that did relatively well in controlling the outbreak of COVID-19, such as Singapore. Informational and unofficial contact tracing apps were excluded from this study. A total of 30,000 reviews corresponding to the 13 apps were scraped from app store webpages and analyzed.ResultsThis study identified seven distinct technologies used by COVID-19 tracing apps and 13 distinct apps. The United States was reported to have released the most contact tracing apps, followed by Italy. Bluetooth was the most frequently used underlying technology, employed by seven apps, whereas three apps used GPS. The Norwegian, Singaporean, Georgian, and New Zealand apps were among those that collected the most personal information from users, whereas some apps, such as the Swiss app and the Italian (Immuni) app, did not collect any user information. The observed minimum amount of time implemented for most of the apps with regard to data destruction was 14 days, while the Georgian app retained records for 3 years. No significant battery drainage issue was reported for most of the apps. Interestingly, only about 2% of the reviewers expressed concerns about their privacy across all apps. The number and frequency of technical issues reported on the Apple App Store were significantly more than those reported on Google Play; the highest was with the New Zealand app, with 27% of the reviewers reporting technical difficulties (ie, 10% out of 27% scraped reviews reported that the app did not work). The Norwegian, Swiss, and US (PathCheck) apps had the least reported technical issues, sitting at just below 10%. In terms of usability, many apps, such as those from Singapore, Australia, and Switzerland, did not provide the users with an option to sign out from their apps.ConclusionsThis article highlighted the fact that COVID-19 contact tracing apps are still facing many obstacles toward their widespread and public acceptance. The main challenges are related to the technical, usability, and privacy issues or to the requirements reported by some users.

Project description:BackgroundWith the development of mobile health (mHealth), chronic disease management apps have brought not only the possibility of reducing the burden of chronic diseases but also huge privacy risks to patients' health data.ObjectiveThe purpose of the study was to analyze the extent to which chronic disease management apps in China comply with the Personal Information Security Specification (PI Specification).MethodsThe compliance of 45 popular chronic disease management apps was evaluated from the perspective of the information life cycle. To conduct a fine-grained evaluation, a scale based on the PI Specification was developed. Finally, 6 level 1 indicators, 22 level 2 indicators, and 61 level 3 indicators were defined.ResultsThere were 33/45 apps (73%) with a privacy policy, and the average score of these apps was 40.4 out of 100. Items of level 1 indicators with high scores included general characteristics (mean 51.9% [SD 28.1%]), information collection and use (mean 51.1% [SD 36.7%]), and information sharing and transfer (mean 50.3% [SD 33.5%]). Information storage and protection had the lowest compliance with PI Specification (mean 29.4% [SD 32.4%]). Few personal information (PI) controllers have stated how to handle security incidents, including security incident reporting (7/33, 21%), security incident notification (10/33, 30%), and commitment to bear corresponding legal responsibility for PI security incidents (1/33, 3%). The performance of apps in the stage of information destruction (mean 31.8% [SD 40.0%]) was poor, and only 21% (7/33) apps would notify third parties to promptly delete PI after individuals cancelled their accounts. Moreover, the scoring rate for rights of PI subjects is generally low (mean 31.2% [SD 35.5%]), especially for obtaining copies of PI (15%) and responding to requests (25%).ConclusionsAlthough most chronic disease management apps had a privacy policy, the total compliance rate of the policy content was low, especially in the stage of information storage and protection. Thus, the field has a long way to go with regard to compliance around personal privacy protection in China.

Project description:BackgroundContact tracing apps are potentially useful tools for supporting national COVID-19 containment strategies. Various national apps with different technical design features have been commissioned and issued by governments worldwide.ObjectiveOur goal was to develop and propose an item set that was suitable for describing and monitoring nationally issued COVID-19 contact tracing apps. This item set could provide a framework for describing the key technical features of such apps and monitoring their use based on widely available information.MethodsWe used an open-source intelligence approach (OSINT) to access a multitude of publicly available sources and collect data and information regarding the development and use of contact tracing apps in different countries over several months (from June 2020 to January 2021). The collected documents were then iteratively analyzed via content analysis methods. During this process, an initial set of subject areas were refined into categories for evaluation (ie, coherent topics), which were then examined for individual features. These features were paraphrased as items in the form of questions and applied to information materials from a sample of countries (ie, Brazil, China, Finland, France, Germany, Italy, Singapore, South Korea, Spain, and the United Kingdom [England and Wales]). This sample was purposefully selected; our intention was to include the apps of different countries from around the world and to propose a valid item set that can be relatively easily applied by using an OSINT approach.ResultsOur OSINT approach and subsequent analysis of the collected documents resulted in the definition of the following five main categories and associated subcategories: (1) background information (open-source code, public information, and collaborators); (2) purpose and workflow (secondary data use and warning process design); (3) technical information (protocol, tracing technology, exposure notification system, and interoperability); (4) privacy protection (the entity of trust and anonymity); and (5) availability and use (release date and the number of downloads). Based on this structure, a set of items that constituted the evaluation framework were specified. The application of these items to the 10 selected countries revealed differences, especially with regard to the centralization of the entity of trust and the overall transparency of the apps' technical makeup.ConclusionsWe provide a set of criteria for monitoring and evaluating COVID-19 tracing apps that can be easily applied to publicly issued information. The application of these criteria might help governments to identify design features that promote the successful, widespread adoption of COVID-19 tracing apps among target populations and across national boundaries.

Project description:With the COVID-19 vaccination widely implemented in most countries, propelled by the need to revive the tourism economy, there is a growing prospect for relieving the social distancing regulation and reopening borders in tourism-oriented countries and regions. This need incentivizes stakeholders to develop border control strategies that fully evaluate health risks if mandatory quarantines are lifted. In this study, we have employed a computational approach to investigate the contact tracing integrated policy in different border-reopening scenarios in Hong Kong, China. Explicitly, by reconstructing the COVID-19 transmission from historical data, specific scenarios with joint effects of digital contact tracing and other concurrent measures (i.e., controlling arrival population and community nonpharmacological interventions) are applied to forecast the future development of the pandemic. Built on a modified SEIR epidemic model with a 30% vaccination coverage, the results suggest that scenarios with digital contact tracing and quick isolation intervention can reduce the infectious population by 92.11% compared to those without contact tracing. By further restricting the inbound population with a 10,000 daily quota and applying moderate-to-strong community nonpharmacological interventions (NPIs), the average daily confirmed cases in the forecast period of 60 days can be well controlled at around 9 per day (95% CI: 7-12). Two main policy recommendations are drawn from the study. First, digital contact tracing would be an effective countermeasure for reducing local virus spread, especially when it is applied along with a moderate level of vaccination coverage. Second, implementing a daily quota on inbound travelers and restrictive community NPIs would further keep the local infection under control. This study offers scientific evidence and prospective guidance for developing and instituting plans to lift mandatory border control policies in preparing for the global economic recovery.

Project description:BackgroundGiven the magnitude and speed of SARS-CoV-2 transmission, achieving timely and effective manual contact tracing has been a challenging task. Early in the pandemic, contact tracing apps generated substantial enthusiasm due to their potential for automating tracing and reducing transmission rates while enabling targeted confinement strategies. However, although surveys demonstrate public interest in using such apps, their actual uptake remains limited. Their social acceptability is challenged by issues around privacy, fairness, and effectiveness, among other concerns.ObjectiveThis study aims to examine the extent to which design and implementation considerations for contact tracing apps are detailed in the available literature, focusing on aspects related to participatory and responsible eHealth innovation, and synthesize recommendations that support the development of successful COVID-19 contact tracing apps and related eHealth technologies.MethodsSearches were performed on five databases, and articles were selected based on eligibility criteria. Papers pertaining to the design, implementation, or acceptability of contact tracing apps were included. Articles published since 2019, written in English or French, and for which the full articles were available were considered eligible for analysis. To assess the scope of the knowledge found in the current literature, we used three complementary frameworks: (1) the Holistic Framework to Improve the Uptake and Impact of eHealth Technologies, (2) the Montreal model, and (3) the Responsible Innovation in Health Assessment Tool.ResultsA total of 63 articles qualified for the final analysis. Less than half of the selected articles cited the need for a participatory process (n=25, 40%), which nonetheless was the most frequently referenced item of the Framework to Improve the Uptake and Impact of eHealth Technologies. Regarding the Montreal model, stakeholder consultation was the most frequently described level of engagement in the development of contact tracing apps (n=24, 38%), while collaboration and partnership were cited the least (n=2, 3%). As for the Responsible Innovation in Health framework, all the articles (n=63, 100%) addressed population health, whereas only 2% (n=1) covered environmental considerations.ConclusionsMost studies lacked fundamental aspects of eHealth development and implementation. Our results demonstrate that stakeholders of COVID-19 contact tracing apps lack important information to be able to critically appraise this eHealth innovation. This may have contributed to the modest uptake of contact tracing apps worldwide. We make evidence-informed recommendations regarding data management, communication, stakeholder engagement, user experience, and implementation strategies for the successful and responsible development of contact tracing apps.

Project description:BackgroundThe main German-speaking countries (Germany, Austria, and Switzerland) have implemented digital contact tracing apps to assist the authorities with COVID-19 containment strategies. Low user rates for these apps can affect contact tracing and, thus, its usefulness in controlling the spread of the novel coronavirus.ObjectiveThis study aimed to assess the early perceptions of people living in the German-speaking countries and compare them with the frames portrayed in the newspapers during the first wave of the COVID-19 pandemic.MethodsWe conducted qualitative interviews with 159 participants of the SolPan project. Of those, 110 participants discussed contact tracing apps and were included in this study. We analyzed articles regarding contact tracing apps from 12 newspapers in the German-speaking countries.ResultsStudy participants perceived and newspaper coverage in all German-speaking countries framed contact tracing apps as governmental surveillance tools and embedded them in a broader context of technological surveillance. Participants identified trust in authorities, respect of individual privacy, voluntariness, and temporary use of contact tracing apps as prerequisites for democratic compatibility. Newspapers commonly referenced the use of such apps in Asian countries, emphasizing the differences in privacy regulation among these countries.ConclusionsThe uptake of digital contact tracing apps in German-speaking countries may be undermined due to privacy risks that are not compensated by potential benefits and are rooted in a deeper skepticism towards digital tools. When authorities plan to implement new digital tools and practices in the future, they should be very transparent and proactive in communicating their objectives and the role of the technology-and how it differs from other, possibly similar, tools. It is also important to publicly address ethical, legal, and social issues related to such technologies prior to their launch.