Open Letter to the Swiss Minister of Health and Reply regarding Proximity Tracing (Swiss PT App)

On 24 April 2020 ICT4Peace wrote an open letter to the  Swiss Federal Councillor and Minister of Health Alain Berset regarding the possible deployment of a “Decentralised Privacy-Preserving Proximity Tracing Protocol (DP3T)”. The letter in German can be found here, and a google translation in English here.  Along with the letter, ICT4Peace submitted the Report by Beatriz Botero Alcira of ICT4Peace on “A Human Rights Centric Framework to Evaluate the Security Risks Raised by Contact-Tracing Applications“.

In the letter, ICT4Peace invited the Minister to consider applying the following privacy policies, when introducing this new app.:

1. Deletion and Data Minimization: As little information as is needed should be collected. Back-end operators should have no access to any personal information, and collected information should be automatically deleted once it is no longer needed, meaning that information should only be stored during the incubation time of the virus, about 2 weeks.
2. Restricted use: The information collected and/or shared to with trusted authorities should only be used for reasons directly related to addressing the public health crisis. It must be explicitly kept out of reach of criminal law enforcement authorities, intelligence agencies, and immigration authorities. Furthermore, the commercialization of this information must be forbidden.
3. Transparency: Individuals must at all times have a means to know, easily and in a clear manner, how their information is being used when governments or other trusted authorities have had access to it (i.e. because they have authorized a message signaling potential contagion).
4. Consent: Whenever possible, a person testing positive must consent to any data sharing by the app. The decision to use a tracking app should be voluntary and uncoerced. Installation, use, or reporting must not be a precondition for returning to work or school, for example.
5. Roll-out strategies: Publicly and privately sponsored strategies must include from the beginning parameters regarding when an application will be discontinued in different places as well as when it is closed down completely. This could be, for example, when the WHO declares that the pandemic is over, when certain areas are declared Covid19 free, when universal testing is made available or when a vaccine is developed. At the moment, exactly what this threshold is is absent both in the Apple and Google and the DP3T protocols.
6. Anti-discrimination and voluntariness: Vulnerable groups are often disparately burdened by surveillance technology. They are also often “frontline workers” who are the most exposed. They may also often lack access to the Internet or smartphones. Participating in contact-tracing networks like the ones analyzed here should never be required to enjoy other fundamental rights, such as the right to work, education or participating in a social program. An exception could be made if those programs or activities provide a viable and dignified alternative (such as work from home, education from home, and paid sick-or quarantine leave). For the same reason, governments should also never condition the enjoyment of a fundamental right to opting in to any of these applications.

On 8 May 2020 the Ministry of Health replied with this letter in German  (a Google translation into English can be found here):