Responses to the COVID-19 pandemic have varied significantly around the world, particularly in the way they have incorporated data and technology. China has mandated the use of facial recognition and body temperature scanning technology to identify infected people, and issuing colour codes to its citizens based on their risk. Taiwan is using location based technology to track compliance with quarantine orders, while other countries including Germany, the UK and Australia are leaning more on Bluetooth technology and manual contact tracing. A range of technologies have been deployed - but how do we effectively combat COVID-19 while still protecting our privacy?

The following whitepaper focuses on stopping the spread of COVID-19 using data innovation to enhance our ability to trace and contain the spread of the disease, while keeping privacy at the forefront.

Infection data shows that Australians have done an excellent job so far of arresting the spread of the virus, as social distancing measures have seen the number of active cases peak at a much lower figure than first anticipated, and then begin to drop.

Easing restrictions comes with an increased risk of reigniting the pandemic if not done properly and with appropriate mitigation strategies in place.  The virus still has the potential to be in our society for a long time, as very few people are immune to it (it is still not known to what extent COVID-19 imparts immunity from the coronavirus), and no vaccine is predicted to be available for at least several more months.

These model outputs* illustrate hypothetical rates of infection following a 90-day lockdown if we a) rush back into normal life with no restrictions whatsoever; b) put some measures in place, but they are reactive instead of preemptive, and are ultimately insufficient to control the virus; or c) put smart, proactive measures in place which are sufficient to curb the potential pandemic ahead of us.

Here, we can see that both a rush back to our old way of life, or a partial return with insufficient management strategies, will likely reignite the spread of the virus - and potentially to a level far beyond what we have recently experienced.

This capability will require the handling of some detailed data to be truly effective.

Conversations regarding the use of data to effectively eliminate community spread of COVID-19 have rightly centred on concerns regarding data privacy and government overreach.

To achieve this, the following governance foundations will need to underpin an advanced tracing and containment capability:

Some measures are already in place that allow contact tracing of infected cases.

When a person tests positive for COVID-19, they are interviewed in order to learn where they’ve been, with whom they’ve interacted and for how long. This allows officials to contact people who are at risk of infection, and advise them on what to do next (be tested, self-isolate for a period of time, monitor symptoms etc.), potentially stopping new clusters from emerging.

The COVIDSafe app was released by the Australian Federal Government on 26th  April 2020 and, as at 4th May 2020, has seen nearly 4.5 million downloads.  It works using similar technology (leveraging some of the same source code) to Singapore’s TraceTogether app; that is, detecting who has been in close proximity to an infected person on the basis of exchanged Bluetooth signals (or ‘handshakes’) between their mobile phones.

These measures will continue to help greatly in the containment effort of COVID-19. However, we should be aware that they are not a panacea for the challenge of contact tracing and containment:

Due to these limitations, there is a need to capture more information to better trace and contain the virus.

Adding selected (consent-driven) personal data points and aggregated data can help fill some of these gaps and allow for a more complete and detailed view of the virus’ spread, prior to the emergence of new infections.

Personal data from consenting patients can be used to provide more detail as to their whereabouts while they’ve been infectious. This may reveal other potential infected contacts and at-risk areas not identified during manual tracing interviews or from the Bluetooth app. This can include data from a range of sources - such as public transport travel, rideshare trips and credit/debit card tap locations.

Aggregated movement data will help complete the geospatial picture of the virus’ spread based on where movement and congregation has been seen throughout cities. This would allow identification of potential high-risk areas prior to them recording new infections. Aggregated and anonymised public transport, private transport and Telco data, amongst other data assets, have the capacity to drive this enhanced predictive capability.

Personally identifiable information will only be collected from COVID-19 patients and will be done with explicit and informed consent at all times.

New COVID-19 patients are asked for consent to unlock a small selection of relevant transaction and movement data that can further help to understand where they’ve been, and where the highest risks of subsequent infections are. This can include device movement data collected from cell phone and in-building cells, public transport trip data, geo-tagged credit card transactions, rideshare trips, etc. from their infectious period.

The physical patterns of infection are driven by peoples’ movement throughout our cities.  Having a data-driven picture of movement will help to:

This analysis will potentially allow for allocation of testing and treatment resources to be done dynamically and ahead of time- rather than in response to virus outbreaks. This information would be constantly updated in accordance with the data, allowing us to stay on the front foot in containing the virus (through the placement of targeted movement restrictions and wide scale testing / treatment provisions in relevant areas).

With a comprehensive data-driven tracing and containment strategy in place, it should be possible to substantially reopen large parts of society while still controlling the prevalence of COVID-19 and preventing a future pandemic outbreak.

Deploying governance foundations within the contact tracing and containment capability will ensure it effectively protects the privacy of the public.

Per new regulations associated with CovidSafe, data is only to be used by health officials for the purposes of contact tracing (or related activities necessary for the functioning and integrity of the capability), with detailed data only being visible to health staff who have direct involvement in a patient case. Data cannot be shared with law enforcement or any other government departments, and cannot be used as a tool to enforce individual compliance to social distancing rules. Personal data is deleted after 21 days and the collection of personal data is ceased once the COVID-19 pandemic has concluded. Only high-level learnings, infrastructure and aggregate data are retained to be used in the event of a future outbreak of COVID-19 or another pandemic.

Personal data collected to understand patient movement is only done with explicit and fully-informed consent freely given by each patient. Consent may not be obtained through coercion- per COVIDSafe regulations, it would be a criminal offence to use non-consent as a basis for any adverse action or discrimination against another person. Consent is given on a dataset-by-dataset basis (meaning a patient can choose which datasets they allow health authorities access to) and can be revoked at any time, prompting the immediate deletion of any personal data from the capability

Eradicating COVID-19 is not a service that will simply be provided by government, but a partnership between government, industry, academia and the public. As such, the public need to be treated as full partners in the tracing and containment process...

This partnership will be demonstrated by showing new levels of transparency - both to the public at large (explaining in simple and clear terms how expanded tracing and containment measures will work) and to participating patients who share their data (who will be notified via a secure messaging service of exactly which data points have been used in analysis and how)

The health department analysts using the data will be accountable to specially appointed supervisors who monitor data use (including automated logging) - ensuring all analysts comply with strict usage and privacy requirements. Purpose-built regulation will mandate severe repercussions, such as jail terms (as is already the case for those working with COVIDSafe data) for non-compliance.

Smash Delta Managing Director - Ben Morley-John appeared in the CEDA livestream alongside Google’s Director of Government Affairs & Public Policy and the Chief Data Scientist for NSW to discuss this approach. Watch a recording of the livestream here.

This work was also featured in the Australian Financial Review. Read the full article here.