European officials push for apps that use no location data, but there is debate over how they should work

The Wall Street Journal

European officials have a plan to use smartphone apps to stem the Covid-19 pandemic without trampling on the bloc’s strict privacy rules: track individuals’ exposure to the virus without tracking their locations.

The European Commission-the EU’s executive arm-called on member states to build an interoperable system of voluntary apps that use short-range radio waves to measure users’ proximity to one another, rather than tracking their phones’ physical locations, such as with the Global Positioning System (GPS).

The announcement puts the bloc, with 446 million residents, alongside other countries around the world that have proposed or rolled out contact-tracing apps. Last week, Apple Inc. and Alphabet Inc.’s Google said they would build the backbone of a similar, voluntary proximity-based system.

Public health officials say such apps, if widely adopted, could be important in helping quickly contain outbreaks once people start returning to work.
Although countries such as South Korea and Israel have monitored individuals’ locations, EU officials say that is unnecessarily invasive and a potential turnoff for users who must install the apps for them to work.

“Strong privacy safeguards are a prerequisite for the uptake of these apps, and therefore their usefulness,” Thierry Breton, the EU’s commissioner for the internal market, said Thursday.

Smartphones running the type of apps the EU is endorsing use Bluetooth technology-typically used in wireless headphones and keyboards-to track when users spend an extended period near another phone running the app. If the user of one phone later tests positive for Covid-19, the other will be alerted.

There is debate about how the apps should work behind the scenes. It boils down to how much data the apps should send to central databases that will likely be run by health authorities in countries around the world.

One one side are France and Germany, part of a consortium of European institutions and companies that are building Bluetooth contact-tracing apps that would, at least in some cases, use central servers to track which phones were in contact with an infected person, and then send out alerts.

On the other side are Apple and Google, whose system announced last week is similar to the one proposed by the EU, except that it would be largely decentralized, with less information shared centrally.

Apple and Google didn’t respond to requests for comment.
Some privacy advocates say a centralized system is riskier because the government could end up with sensitive information about individuals’ contact with one other. But advocates of a centralized system say it could provide more data to epidemiologists.

By Sam Schechner