Night view of Oslo city showing the suspension of Norway’s contact tracing app after being ranked among the world’s most privacy-invasive apps

After Being Ranked Among the World’s Most Privacy-Invasive, Norway Suspends Use of Contact Tracing App

As countries all over the world make efforts to roll out contact tracing app programs, the main debate is the use of centralized government servers vs. more anonymous Bluetooth-based contact logging systems. Proponents of the former argue that the privacy-focused Bluetooth systems, such as the one that Google and Apple have developed together, are too limited in application to stop the spread of Covid-19.

That was the path that Norway chose with its “Smittestopp” app, which made use of near-real-time GPS tracking to keep constant tabs on the locations of users and identified them individually via a registered phone number. That landed it near the top of a recent list of privacy-invasive contact tracing apps published by Amnesty International, putting it in the company of Middle Eastern monarchies such as Bahrain and Qatar.

The report, and subsequent action by the country’s Data Protection Agency (DPA), seems to have convinced Norway to change course. The country has announced that it is suspending the operation of its contact tracing app and will re-evaluate its function before re-activating it.

Where Norway’s contact tracing app went wrong

The country’s DPA had ordered the contact tracing app to be suspended by June 23 due to concerns about potential GDPR personal data collection violations, but the Norwegian Institute of Public Health (NIPH) opted to shut it down over a week early after the Amnesty International report was released.

Norway’s health authorities have been asked to delete all user data and personal information that has been collected since the app launched in late April, essentially setting the effort back to square one. The DPA cited then-current low infection rates and a low rate of public adoption (600,000 active users, or only about 10% of Norway’s population) as reasons that the contact tracing app was no longer a proportionate response. NIPH director Camilla Stoltenberg disagreed with the decision: “The pandemic is not over. We have no immunity in the population, no vaccine, and no effective treatment. Without the Smittestopp app, we will be less equipped to prevent new outbreaks that may occur locally or nationally.”

The app was initially approved by the country’s DPA as the GDPR has provisions for otherwise unacceptable centralized collection of personal data in the event of a public health emergency such as this. European Data Protection Board guidelines suggest that contact tracing apps should not use GPS data to track the location of users, but do not outright forbid it.

The NIPH had previously claimed that GPS location data was anonymized and used to observe general trends, rather than tracking individuals. However, the app requires users to verify with a valid phone number and does not give them the option to opt out of the use of data for unrelated research purposes.

This is not necessarily the end of the contact tracing app, as it is simply being disabled rather than being removed from public access. However, it is very unlikely to come back with GPS location data intact. The app has the ability to trace Bluetooth contacts, a system that is easier to anonymize and is in use by Google and Apple. EU members such as Germany and the United Kingdom have opted to base their contact tracing apps on this standard. Smittestopp might return in a form similar to France’s StopCovid app, which uses Bluetooth to track contacts but also funnels this information through a centralized government-run server. The health authority has advised Norwegian citizens to leave the app on their phones for the time being.

There is an outside possibility that the app may stay retired, however, as Norway has been experiencing a relatively low rate of new Covid-19 cases. The country had almost no new cases as of May, but logged a small uptick in June as social distancing and travel measures were relaxed. It is still far below the country’s March peak, however, after which it implemented some of the stronger lockdown and testing measures in Europe. With about 250 recorded deaths to date, Norway is among the least impacted of the world’s developed countries.

The usefulness barrier

Focus on the use of GPS data is something of a case of burying the lede, at least from the perspective of contact tracing efficiency. A bigger issue is that only about 10% of Norway’s population opted to use the contact tracing app after nearly two months of it being available. At that rate of adoption, it’s virtually useless as a measure; epidemiologists have been consistent in naming 60% to 80% adoption as the minimum rate for contact tracing apps to be more useful than simply doing manual contact tracing by phone.

Norway’s contact tracing app was ranked among the most #privacy-invasive as it uses GPS tracking and identifies users via registered phone numbers. #respectdataClick to Tweet

One might assume that the low adoption rate is due to the privacy invasion, but this mirrors a general trend in other countries that use the more privacy-focused Bluetooth apps that store contact data locally. For example, Singapore recently had to rethink its contact tracing effort as only about 20% of the population had voluntarily adopted its Bluetooth-based app. And though it is still early days for France’s StopCovid app, the first three weeks saw only about 2.8% of the population download the app and only 68 people voluntarily report a positive Covid-19 diagnosis.