WHY THIS MATTERS IN BRIEF
New technologies and innovations are eroding people’s privacy like never before, for better and worse …
The current Coronavirus pandemic, COVID-19, has spurred people everywhere around the world to come up with amazing new innovations to help identify it and stop its spread, from new biosensors that can track it in the air around you, and new face masks that glow if they detect you’re infected, all the way through to new coronavirus telehealth solutions and contact tracing apps that try to warn you that you may have come into contact with another person. And while all these new innovations are welcome people everywhere now seem to be becoming more vocal about the privacy implications of all these systems – especially contact tracing apps which, until now, have largely been rolled out and managed by governments, but now companies it turns out are building their own and that’s just making privacy advocates everywhere even more nervous than they were before.
In the coming months, tens of thousands of workers in Anglo American mines in South Africa will be asked to use a new piece of equipment: it could be phone, watch-based, or built into existing personal protective equipment like hard hats. The company says it’s “too early to be specific” about how its system will work, but one thing is for sure: it will track their every move, and will be able to detect when and who they have come in contact with.
The FTSE 100-listed mining giant is part of a cohort of companies that aren’t holding their breath for governments, Apple or Google to deliver a workable contact tracing app. Instead, they have decided to develop their own.
Soter Analytics is a UK healthtech start-up that mainly made trackers for employee posture to avoid injuries until offices and factories closed due to Covid-19 and work disappeared – so it pivoted into contact tracing wearables. Alexey Pavlenko, Soter’s chief technical officer, says his company’s R&D punched holes in the UK government’s planned use of phone-based Bluetooth to track Covid-19 interactions. The government’s planned NHSX solution – which it switched last week to rely on the Google-Apple collaboration software – requires everyone to download an app to their phone and enable Bluetooth, so it logs anonymous distance data with any phones that are nearby.
“Our research indicated the Bluetooth range on mobile phones was inaccurate due to different models,” he says. “While we know our devices and Bluetooth antennas so can control their accuracy, if the government is using random mobile phones at random positions this cannot be controlled, and will be less accurate.”
Software business Cadline UK’s main line of work includes digital map making. But in the age of coronavirus that has become mapping the location of a company’s employees – whether they like it or not. Cadline’s iTWOsafe contact tracing system is a phone app which connects to a Bluetooth Low Energy device (BLE) worn as a wristband or attached to a uniform, that together track physical distance to other devices nearby.
The system is great for employers; if an employee catches coronavirus traceable contact history can identify which other workers need to quarantine without closing the entire business, and it can also pinpoint where contacts take place, so a company can put in place extra measures, like a one way system.
But for employees the line between safety and the sack could be about to get thinner. “Most importantly iTWOsafe can report on those people who repeatedly breach the two metre distance so HR can implement additional training for those individuals,” says Richard Robertson, business development director at Cadline. If breaching social distancing rules becomes an HR issue, the mass forcing of contact tracing apps on employees opens up new disciplinary risks for employees.
Demand is already high for the products. According to Robertson, the first orders of iTWOsafe ship at the end of June, and major global construction and engineering groups sent letters of intent weeks ahead of the product hitting UK shores. “There is also huge demand for iTWOsafe in the US and Australia, we’ve received enquiries for over 30,000 units since launch,” he says.
Several of the private contact tracing solutions being sold to employers ahead of a state-managed system in the UK focus on wearable tech as well as apps. Less than a quarter of IT professionals believed the planned NHSX contact tracing app would be effective in containing Covid-19, according to a survey in May. Just 24 per cent believed the app would contribute to curbing the virus, with 32 per cent feeling it would make no contribution, according to the survey by BCS, the Chartered Institute for IT.
Many workplaces, like industrial sites and warehouses, simply don’t allow employees to carry phones. So Soter used Bluetooth to develop a social distancing upgrade to its SoterSpine wearable device, a 2cm by 2cm and 20g black box. Clipped to a shirt or lanyard it alerts workers if they come within two metres of one another, to lessen the risk of contact. It also gathers data so at the end of the day it syncs detail of who has been in contact with who and for how long.
Employees pick up the device when they start their shift, wear it all day, then dock it at the end. “It is discreet so will not cause discomfort,” says Pavlenko.
The system sounds less Orwellian than Amazon’s social distancing tracking system, especially when you remember that Amazon is also using some rather questionable innovations to automatically track and fire people as and when the underperform. Powered by Artificial Intelligence (AI) and machine vision, it will tap into monitors in the office and warehouse and show workers on screens highlighted in green circles when they are at a safe distance from others. Workers that are too close together will appear in red circles.
The system, called Distance Assistant, also uses camera footage in Amazon’s buildings to also help identify high-traffic areas and it is testing a wearable device that lights up and makes an audio alert when workers are too close to each other, according to an internal memo seen by Reuters.
Privacy issues have been one of the biggest discomforts for the UK government’s overall contact tracing system. This process is being done via online reporting by those who test positive for coronavirus, and 25,000 human contact tracers who phone anyone who has been in contact with them. But this has led to fears scammers will make fake calls. The Track and Trace programme launched in June without the app after security experts raised separate concerns about the central database of anonymised records of those reporting symptoms and their contacts.
But companies don’t feel like these privacy issues necessarily apply to them. Soter says its wearable device bypasses privacy issues because it has no access to phone data as the hardware and software are standalone. “We do not collect GPS [location], just whether contact has been made and for how long,” says Pavlenko, “and it’s not necessary to upload colleague names or information as they can be registered as a code and code assignments stored elsewhere.”
However, employees may still be reticent about employer surveillance, and push back against being trackable at all times while at work. And they have the right to refuse to use tracking apps, according to David Naylor, partner at Wiggin law firm, which has been advising GMV’s not-for-profit global contact tracing platform CovClear on data protection. “The key question,” says Naylor, “is whether the employer could then penalise the employee or even terminate their contract.”
This is likely to come down to whether or not the employee was failing to comply with reasonable instructions, which will be specific to the circumstances including what is the continuing level of threat posed by Covid-19. “There’s never previously been a credible proposal for track and trace apps to monitor other, less dangerous communicable diseases, so one assumes the justification for such apps to track Covid-19 will fall away as it becomes less dangerous,” says Naylor.
Companies must have a lawful basis for processing personal information. With data about an individual’s health, the basis commonly used is consent. But there have been multiple cases around Europe where the courts and regulators have stated that, because of the nature of the employment relationship, it will be difficult in many circumstances to rely on consent from employees as really having been freely given.
Naylor says: “Companies will have to put careful thought into how they establish the legal grounds for using such apps.”
To keep staff onside, and to avoid hefty fines for breaching data rules such as the General Data Protection Regulation (GDPR), companies will be expected to keep their intrusion into employees personal lives to as little as possible. “They need to limit who has access to such data to a minimum and build in controls to prevent it being used or shared for other purposes,” says Robert Grosvenor, managing director at professional services firm Alvarez & Marsal.
“Each company needs to look at their specific risks and objectives to see if contact tracing is necessary and proportionate to deal with protecting the health of their workforce and maintaining business continuity.”