Dataset Information

Data Management and Privacy Policy of COVID-19 Contact-Tracing Apps: Systematic Review and Content Analysis.

ABSTRACT:

Background

COVID-19 digital contact-tracing apps were created to assist public health authorities in curbing the pandemic. These apps require users' permission to access specific functions on their mobile phones, such as geolocation, Bluetooth or Wi-Fi connections, or personal data, to work correctly. As these functions have privacy repercussions, it is essential to establish how contact-tracing apps respect users' privacy.

Objective

This study aimed to systematically map existing contact-tracing apps and evaluate the permissions required and their privacy policies. Specifically, we evaluated the type of permissions, the privacy policies' readability, and the information included in them.

Methods

We used custom Google searches and existing lists of contact-tracing apps to identify potentially eligible apps between May 2020 and November 2021. We included contact-tracing or exposure notification apps with a Google Play webpage from which we extracted app characteristics (eg, sponsor, number of installs, and ratings). We used Exodus Privacy to systematically extract the number of permissions and classify them as dangerous or normal. We computed a Permission Accumulated Risk Score representing the threat level to the user's privacy. We assessed the privacy policies' readability and evaluated their content using a 13-item checklist, which generated a Privacy Transparency Index. We explored the relationships between app characteristics, Permission Accumulated Risk Score, and Privacy Transparency Index using correlations, chi-square tests, or ANOVAs.

Results

We identified 180 contact-tracing apps across 152 countries, states, or territories. We included 85.6% (154/180) of apps with a working Google Play page, most of which (132/154, 85.7%) had a privacy policy document. Most apps were developed by governments (116/154, 75.3%) and totaled 264.5 million installs. The average rating on Google Play was 3.5 (SD 0.7). Across the 154 apps, we identified 94 unique permissions, 18% (17/94) of which were dangerous, and 30 trackers. The average Permission Accumulated Risk Score was 22.7 (SD 17.7; range 4-74, median 16) and the average Privacy Transparency Index was 55.8 (SD 21.7; range 5-95, median 55). Overall, the privacy documents were difficult to read (median grade level 12, range 7-23); 67% (88/132) of these mentioned that the apps collected personal identifiers. The Permission Accumulated Risk Score was negatively associated with the average App Store ratings (r=-0.20; P=.03; 120/154, 77.9%) and Privacy Transparency Index (r=-0.25; P<.001; 132/154, 85.7%), suggesting that the higher the risk to one's data, the lower the apps' ratings and transparency index.

Conclusions

Many contact-tracing apps were developed covering most of the planet but with a relatively low number of installs. Privacy-preserving apps scored high in transparency and App Store ratings, suggesting that some users appreciate these apps. Nevertheless, privacy policy documents were difficult to read for an average audience. Therefore, we recommend following privacy-preserving and transparency principles to improve contact-tracing uptake while making privacy documents more readable for a wider public.

SUBMITTER: Bardus M

PROVIDER: S-EPMC9278406 | biostudies-literature |

REPOSITORIES: biostudies-literature

ACCESS DATA

Similar Datasets

Project description:BackgroundMany countries across the globe have released their own COVID-19 contact tracing apps. This has resulted in the proliferation of several apps that used a variety of technologies. With the absence of a standardized approach used by the authorities, policy makers, and developers, many of these apps were unique. Therefore, they varied by function and the underlying technology used for contact tracing and infection reporting.ObjectiveThe goal of this study was to analyze most of the COVID-19 contact tracing apps in use today. Beyond investigating the privacy features, design, and implications of these apps, this research examined the underlying technologies used in contact tracing apps. It also attempted to provide some insights into their level of penetration and to gauge their public reception. This research also investigated the data collection, reporting, retention, and destruction procedures used by each of the apps under review.MethodsThis research study evaluated 13 apps corresponding to 10 countries based on the underlying technology used. The inclusion criteria ensured that most COVID-19-declared epicenters (ie, countries) were included in the sample, such as Italy. The evaluated apps also included countries that did relatively well in controlling the outbreak of COVID-19, such as Singapore. Informational and unofficial contact tracing apps were excluded from this study. A total of 30,000 reviews corresponding to the 13 apps were scraped from app store webpages and analyzed.ResultsThis study identified seven distinct technologies used by COVID-19 tracing apps and 13 distinct apps. The United States was reported to have released the most contact tracing apps, followed by Italy. Bluetooth was the most frequently used underlying technology, employed by seven apps, whereas three apps used GPS. The Norwegian, Singaporean, Georgian, and New Zealand apps were among those that collected the most personal information from users, whereas some apps, such as the Swiss app and the Italian (Immuni) app, did not collect any user information. The observed minimum amount of time implemented for most of the apps with regard to data destruction was 14 days, while the Georgian app retained records for 3 years. No significant battery drainage issue was reported for most of the apps. Interestingly, only about 2% of the reviewers expressed concerns about their privacy across all apps. The number and frequency of technical issues reported on the Apple App Store were significantly more than those reported on Google Play; the highest was with the New Zealand app, with 27% of the reviewers reporting technical difficulties (ie, 10% out of 27% scraped reviews reported that the app did not work). The Norwegian, Swiss, and US (PathCheck) apps had the least reported technical issues, sitting at just below 10%. In terms of usability, many apps, such as those from Singapore, Australia, and Switzerland, did not provide the users with an option to sign out from their apps.ConclusionsThis article highlighted the fact that COVID-19 contact tracing apps are still facing many obstacles toward their widespread and public acceptance. The main challenges are related to the technical, usability, and privacy issues or to the requirements reported by some users.

Project description:BackgroundWith the development of mobile health (mHealth), chronic disease management apps have brought not only the possibility of reducing the burden of chronic diseases but also huge privacy risks to patients' health data.ObjectiveThe purpose of the study was to analyze the extent to which chronic disease management apps in China comply with the Personal Information Security Specification (PI Specification).MethodsThe compliance of 45 popular chronic disease management apps was evaluated from the perspective of the information life cycle. To conduct a fine-grained evaluation, a scale based on the PI Specification was developed. Finally, 6 level 1 indicators, 22 level 2 indicators, and 61 level 3 indicators were defined.ResultsThere were 33/45 apps (73%) with a privacy policy, and the average score of these apps was 40.4 out of 100. Items of level 1 indicators with high scores included general characteristics (mean 51.9% [SD 28.1%]), information collection and use (mean 51.1% [SD 36.7%]), and information sharing and transfer (mean 50.3% [SD 33.5%]). Information storage and protection had the lowest compliance with PI Specification (mean 29.4% [SD 32.4%]). Few personal information (PI) controllers have stated how to handle security incidents, including security incident reporting (7/33, 21%), security incident notification (10/33, 30%), and commitment to bear corresponding legal responsibility for PI security incidents (1/33, 3%). The performance of apps in the stage of information destruction (mean 31.8% [SD 40.0%]) was poor, and only 21% (7/33) apps would notify third parties to promptly delete PI after individuals cancelled their accounts. Moreover, the scoring rate for rights of PI subjects is generally low (mean 31.2% [SD 35.5%]), especially for obtaining copies of PI (15%) and responding to requests (25%).ConclusionsAlthough most chronic disease management apps had a privacy policy, the total compliance rate of the policy content was low, especially in the stage of information storage and protection. Thus, the field has a long way to go with regard to compliance around personal privacy protection in China.

Project description:BackgroundDuring the COVID-19 pandemic, contact tracing apps have received a lot of public attention. The ongoing debate highlights the challenges of the adoption of data-driven innovation. We reflect on how to ensure an appropriate level of protection of individual data and how to maximize public health benefits that can be derived from the collected data.ObjectiveThe aim of the study was to analyze available COVID-19 contact tracing apps and verify to what extent public health interests and data privacy standards can be fulfilled simultaneously in the process of the adoption of digital health technologies.MethodsA systematic review of PubMed and MEDLINE databases, as well as grey literature, was performed to identify available contact tracing apps. Two checklists were developed to evaluate (1) the apps' compliance with data privacy standards and (2) their fulfillment of public health interests. Based on both checklists, a scorecard with a selected set of minimum requirements was created with the goal of estimating whether the balance between the objective of data privacy and public health interests can be achieved in order to ensure the broad adoption of digital technologies.ResultsOverall, 21 contact tracing apps were reviewed. In total, 11 criteria were defined to assess the usefulness of each digital technology for public health interests. The most frequently installed features related to contact alerting and governmental accountability. The least frequently installed feature was the availability of a system of medical or organizational support. Only 1 app out of 21 (5%) provided a threshold for the population coverage needed for the digital solution to be effective. In total, 12 criteria were used to assess the compliance of contact tracing apps with data privacy regulations. Explicit user consent, voluntary use, and anonymization techniques were among the most frequently fulfilled criteria. The least often implemented criteria were provisions of information about personal data breaches and data gathered from children. The balance between standards of data protection and public health benefits was achieved best by the COVIDSafe app and worst by the Alipay Health Code app.ConclusionsContact tracing apps with high levels of compliance with standards of data privacy tend to fulfill public health interests to a limited extent. Simultaneously, digital technologies with a lower level of data privacy protection allow for the collection of more data. Overall, this review shows that a consistent number of apps appear to comply with standards of data privacy, while their usefulness from a public health perspective can still be maximized.

Project description:BackgroundThe COVID-19 pandemic accelerated the need to understand citizen acceptance of health surveillance technologies such as contact tracing (CT) apps. Indeed, the success of these apps required widespread public acceptance and the alleviation of concerns about privacy, surveillance, and trust.ObjectiveThis study aims to examine the factors that foster a sense of trust and a perception of privacy in CT apps. Our study also investigates how trust and perceived privacy influence citizens' willingness to adopt, disclose personal data, and continue to use these apps.MethodsDrawing on privacy calculus and procedural fairness theories, we developed a model of the antecedents and behavioral intentions related to trust and privacy perceptions. We used structural equation modeling to test our hypotheses on a data set collected at 2 time points (before and after the launch of a national CT app). The sample consisted of 405 Irish residents.ResultsTrust in CT apps was positively influenced by propensity to trust technology (β=.074; P=.006), perceived need for surveillance (β=.119; P<.001), and perceptions of government motives (β=.671; P<.001) and negatively influenced by perceived invasion (β=-.224; P<.001). Perceived privacy was positively influenced by trust (β=.466; P<.001) and perceived control (β=.451; P<.001) and negatively influenced by perceived invasion (β=-.165; P<.001). Prelaunch intentions toward adoption were influenced by trust (β=.590; P<.001) and perceived privacy (β=.247; P<.001). Prelaunch intentions to disclose personal data to the app were also influenced by trust (β=.215; P<.001) and perceived privacy (β=.208; P<.001) as well as adoption intentions before the launch (β=.550; P<.001). However, postlaunch intentions to use the app were directly influenced by prelaunch intentions (β=.530; P<.001), but trust and perceived privacy only had an indirect influence. Finally, with regard to intentions to disclose after the launch, use intentions after the launch (β=.665; P<.001) and trust (β=.215; P<.001) had a direct influence, but perceived privacy only had an indirect influence. The proposed model explained 74.4% of variance in trust, 91% of variance in perceived privacy, 66.6% of variance in prelaunch adoption intentions, 45.9% of variance in postlaunch use intentions, and 83.9% and 79.4% of variance in willingness to disclose before the launch and after the launch, respectively.ConclusionsPositive perceptions of trust and privacy can be fostered through clear communication regarding the need and motives for CT apps, the level of control citizens maintain, and measures to limit invasive data practice. By engendering these positive beliefs before launch and reinforcing them after launch, citizens may be more likely to accept and use CT apps. These insights are important for the launch of future apps and technologies that require mass acceptance and information disclosure.

Project description:BackgroundIn the post-COVID-19 pandemic era, many countries have launched apps to trace contacts of COVID-19 infections. Each contact-tracing app (CTA) faces a variety of issues owing to different national policies or technologies for tracing contacts.ObjectiveIn this study, we aimed to investigate all the CTAs used to trace contacts in various countries worldwide, including the technology used by each CTA, the availability of knowledge about the CTA from official websites, the interoperability of CTAs in various countries, and the infection detection rates and policies of the specific country that launched the CTA, and to summarize the current problems of the apps based on the information collected.MethodsWe investigated CTAs launched in all countries through Google, Google Scholar, and PubMed. We experimented with all apps that could be installed and compiled information about apps that could not be installed or used by consulting official websites and previous literature. We compared the information collected by us on CTAs with relevant previous literature to understand and analyze the data.ResultsAfter screening 166 COVID-19 apps developed in 197 countries worldwide, we selected 98 (59%) apps from 95 (48.2%) countries, of which 63 (66.3%) apps were usable. The methods of contact tracing are divided into 3 main categories: Bluetooth, geolocation, and QR codes. At the technical level, CTAs face 3 major problems. First, the distance and time for Bluetooth- and geolocation-based CTAs to record contact are generally set to 2 meters and 15 minutes; however, this distance should be lengthened, and the time should be shortened for more infectious variants. Second, Bluetooth- or geolocation-based CTAs also face the problem of lack of accuracy. For example, individuals in 2 adjacent vehicles during traffic jams may be at a distance of ≤2 meters to make the CTA trace contact, but the 2 users may actually be separated by car doors, which could prevent transmission and infection. In addition, we investigated infection detection rates in 33 countries, 16 (48.5%) of which had significantly low infection detection rates, wherein CTAs could have lacked effectiveness in reducing virus propagation. Regarding policy, CTAs in most countries can only be used in their own countries and lack interoperability among other countries. In addition, 7 countries have already discontinued CTAs, but we believe that it was too early to discontinue them. Regarding user acceptance, 28.6% (28/98) of CTAs had no official source of information that could reduce user acceptance.ConclusionsWe surveyed all CTAs worldwide, identified their technological policy and acceptance issues, and provided solutions for each of the issues we identified. This study aimed to provide useful guidance and suggestions for updating the existing CTAs and the subsequent development of new CTAs.

Project description:BackgroundContact tracing apps are potentially useful tools for supporting national COVID-19 containment strategies. Various national apps with different technical design features have been commissioned and issued by governments worldwide.ObjectiveOur goal was to develop and propose an item set that was suitable for describing and monitoring nationally issued COVID-19 contact tracing apps. This item set could provide a framework for describing the key technical features of such apps and monitoring their use based on widely available information.MethodsWe used an open-source intelligence approach (OSINT) to access a multitude of publicly available sources and collect data and information regarding the development and use of contact tracing apps in different countries over several months (from June 2020 to January 2021). The collected documents were then iteratively analyzed via content analysis methods. During this process, an initial set of subject areas were refined into categories for evaluation (ie, coherent topics), which were then examined for individual features. These features were paraphrased as items in the form of questions and applied to information materials from a sample of countries (ie, Brazil, China, Finland, France, Germany, Italy, Singapore, South Korea, Spain, and the United Kingdom [England and Wales]). This sample was purposefully selected; our intention was to include the apps of different countries from around the world and to propose a valid item set that can be relatively easily applied by using an OSINT approach.ResultsOur OSINT approach and subsequent analysis of the collected documents resulted in the definition of the following five main categories and associated subcategories: (1) background information (open-source code, public information, and collaborators); (2) purpose and workflow (secondary data use and warning process design); (3) technical information (protocol, tracing technology, exposure notification system, and interoperability); (4) privacy protection (the entity of trust and anonymity); and (5) availability and use (release date and the number of downloads). Based on this structure, a set of items that constituted the evaluation framework were specified. The application of these items to the 10 selected countries revealed differences, especially with regard to the centralization of the entity of trust and the overall transparency of the apps' technical makeup.ConclusionsWe provide a set of criteria for monitoring and evaluating COVID-19 tracing apps that can be easily applied to publicly issued information. The application of these criteria might help governments to identify design features that promote the successful, widespread adoption of COVID-19 tracing apps among target populations and across national boundaries.

Project description:ObjectiveTo systematically review evidence on effectiveness of contact tracing apps (CTAs) for SARS-CoV-2 on epidemiological and clinical outcomes.DesignRapid systematic review.Data sourcesEMBASE (OVID), MEDLINE (PubMed), BioRxiv and MedRxiv were searched up to 28 October 2020.Study selectionStudies, both empirical and model-based, assessing effect of CTAs for SARS-CoV-2 on reproduction number (R), total number of infections, hospitalisation rate, mortality rate, and other epidemiologically and clinically relevant outcomes, were eligible for inclusion.Data extractionEmpirical and model-based studies were critically appraised using separate checklists. Data on type of study (ie, empirical or model-based), sample size, (simulated) time horizon, study population, CTA type (and associated interventions), comparator and outcomes assessed, were extracted. The most important findings were extracted and narratively summarised. Specifically for model-based studies, characteristics and values of important model parameters were collected.Results2140 studies were identified, of which 17 studies (2 empirical, 15 model-based studies) were eligible and included in this review. Both empirical studies were observational (non-randomised) studies and at high risk of bias, most importantly due to risk of confounding. Risk of bias of model-based studies was considered low for 12 out of 15 studies. Most studies demonstrated beneficial effects of CTAs on R, total number of infections and mortality rate. No studies assessed effect on hospitalisation. Effect size was dependent on model parameters values used, but in general, a beneficial effect was observed at CTA adoption rates of 20% or higher.ConclusionsCTAs have the potential to be effective in reducing SARS-CoV-2 related epidemiological and clinical outcomes, though effect size depends on other model parameters (eg, proportion of asymptomatic individuals, or testing delays), and interventions after CTA notification. Methodologically sound comparative empirical studies on effectiveness of CTAs are required to confirm findings from model-based studies.

Project description:BackgroundGiven the magnitude and speed of SARS-CoV-2 transmission, achieving timely and effective manual contact tracing has been a challenging task. Early in the pandemic, contact tracing apps generated substantial enthusiasm due to their potential for automating tracing and reducing transmission rates while enabling targeted confinement strategies. However, although surveys demonstrate public interest in using such apps, their actual uptake remains limited. Their social acceptability is challenged by issues around privacy, fairness, and effectiveness, among other concerns.ObjectiveThis study aims to examine the extent to which design and implementation considerations for contact tracing apps are detailed in the available literature, focusing on aspects related to participatory and responsible eHealth innovation, and synthesize recommendations that support the development of successful COVID-19 contact tracing apps and related eHealth technologies.MethodsSearches were performed on five databases, and articles were selected based on eligibility criteria. Papers pertaining to the design, implementation, or acceptability of contact tracing apps were included. Articles published since 2019, written in English or French, and for which the full articles were available were considered eligible for analysis. To assess the scope of the knowledge found in the current literature, we used three complementary frameworks: (1) the Holistic Framework to Improve the Uptake and Impact of eHealth Technologies, (2) the Montreal model, and (3) the Responsible Innovation in Health Assessment Tool.ResultsA total of 63 articles qualified for the final analysis. Less than half of the selected articles cited the need for a participatory process (n=25, 40%), which nonetheless was the most frequently referenced item of the Framework to Improve the Uptake and Impact of eHealth Technologies. Regarding the Montreal model, stakeholder consultation was the most frequently described level of engagement in the development of contact tracing apps (n=24, 38%), while collaboration and partnership were cited the least (n=2, 3%). As for the Responsible Innovation in Health framework, all the articles (n=63, 100%) addressed population health, whereas only 2% (n=1) covered environmental considerations.ConclusionsMost studies lacked fundamental aspects of eHealth development and implementation. Our results demonstrate that stakeholders of COVID-19 contact tracing apps lack important information to be able to critically appraise this eHealth innovation. This may have contributed to the modest uptake of contact tracing apps worldwide. We make evidence-informed recommendations regarding data management, communication, stakeholder engagement, user experience, and implementation strategies for the successful and responsible development of contact tracing apps.