Data has become a crucial battleground in the war against coronavirus, as many countries have used sophisticated methods for gathering and analysing information on individuals’ behaviour to monitor and manage the pandemic.
This could lead to a lasting shift in how we think about data and its governance. Here I set out what a new social contract around data might consist of—and how might move beyond the frustrating vagueness that has characterised much of the debate so far.
The binary debate of the 2010s
For the past decade the public discourse around data has been squeezed into a binary framework. On one side were big organisations—governments and large companies—harvesting data on an unprecedented scale. They provided little transparency or consideration for privacy—but demonstrated benefits in valuable products and services. Against them grew activists who argued for new rights and restrictions to put data under the control of citizens.
Covid-19 has now shown the limits of both data hubris and data restriction. Smart use of data from multiple sources can undoubtedly be in the public interest. But it’s clearer than ever that strong rules will be needed to prevent the abuse of power.
We may be headed towards a new social contract around data that combines three distinct elements: first, new norms of data minimisation and privacy by design; second, strong laws to punish abuses; and third, a new generation of regulators and institutions charged with maximising the public value derived from data. If we can get this right, we’ll see radically more data sharing where there is a public interest in doing so, and less where there isn’t. But the details will be all-important.
Innovations in the crisis
The prompt is the extraordinary innovation fuelled by the crisis. China moved first, using mobile phone data to track the millions who left Wuhan in the hours before the city was cut off. Alipay and WeChat’s HealthCode (which also drew on self-reporting and medical records) were then used to give people red, yellow or green status to determine their freedom of movement depending on whether they had been near infected individuals. Taiwan also used mobile phone data to track people who had been infected and manage their quarantines.
Singapore relied on a combination of its TraceTogether app and teams performing investigations and interviews to determine who needed to be tested. South Korea used smartphone data, credit card payments and other sources to trace contact between individuals (and sparked controversy when transparency about people’s travel patterns uncovered illicit affairs).
Covid-19 has shown the limits of both data hubris and data restriction. Smart use of data from multiple sources can undoubtedly be in the public interest, but it’s clearer than ever that strong rules will be needed to prevent the abuse of power.
Each approach was slightly different. But all of these countries were aggressive in pulling data together to contain the crisis. Nothing comparable has been implemented by Western countries, but many are now trying to copy them. In the UK, for example, much effort is going into an NHS app that asks people to report their symptoms (or lack thereof) on a regular basis. It’s hoped that a majority of the population will engage with the scheme to accelerate the end of lockdown.
New apps aren’t technically needed since smartphones automatically know where they are. Intelligence agencies and phone companies can easily track the proximity of individuals (and in Israel the intelligence agency Shin Bet has been active in using location data to track infections).
Design dilemmas
Despite these existing capabilities, the crisis is introducing important design and technical choices. Tracing can be done using either Bluetooth or phone network geolocation. Bluetooth is, in principle, more decentralised and leaves more control in the hands of citizens, though it creates its own problems if it’s always on—a challenge Google and Apple are working on.
Another choice is whether to anonymise the data that’s collected. Europe’s DP-3T (Decentralised Privacy-Preserving Proximity Tracing) project is attempting to shield the identities of those affected by covid-19 using randomisation and Bluetooth technology. The initiative aims to allow those with the virus to anonymously alert others of exposure risk while keeping their own identity hidden from the authorities. This is appealing—but at a certain point there is no avoiding the need to identify people and ensure that they are showing up for tests.
Here we come up against the unavoidable tension between individual rights and the collective interest, and the need for governance mechanisms to judge how that trade-off should be made in different conditions. There will be even harder judgments to make about using data to manage certification of immunity.
As these experiments unfold in front of our eyes the crisis is bringing to the surface all the big questions that will need to be answered if we’re to make the most of data and AI over the next decade. It has already prompted some hand-wringing by prominent thinkers such as Yuval Harari and Shoshana Zuboff, though it’s striking that they have very little to say about possible solutions. So what could a more permanent settlement around data look like?
A new social contract around data
I expect that it will combine three apparently very different, but complementary, elements. First, we will need new approaches to technology design that build in data minimisation. We have become used to digital tools that gather and share data on an extraordinary scale, but mainly for the benefit of a handful of big commercial platforms. Google really does know more about you than you do. But this is not inevitable; it is the result of choices. The alternative route promotes data minimisation and says that companies and governments should only gather what they need. Some of the projects in the EU’s DECODE programme have been experimenting with ways of doing this—for example, allowing that if you book a hotel room there is no need for the hotel to know all of your passport or banking details. My guess is that data minimisation and privacy by design will increasingly become the norm, but with clear provisions of greater data gathering where there is clear-cut public interest.
Second, we will continue to need laws that are strong enough to penalise abuses and flexible enough to adapt to changing pressures and technologies. The EU's General Data Protection Regulation (GDPR), implemented in 2018, has become a de facto standard and, contrary to the complaints of Silicon Valley, has turned out to be quite flexible. It allows, for example, employers to gather data on which employees need to be self-isolating because of symptoms but with strict rules as to what they can do with it. The European Data Protection Board acknowledged that an emergency like this is a "legal condition which may legitimise restrictions of freedoms provided these restrictions are proportionate and limited to the emergency period" and Article 9 allows the processing of personal information without consent if it’s necessary to protect “against serious cross-border threats to health”. It’s clearer than ever that every country will need laws of this kind, and there is now little chance of the UK, post-Brexit, moving far away from GDPR.
Third, we will need new institutions, design to protect trust and make judgments about trade-offs. The crisis has confirmed the glaring lack of institutions with the skills and authority to be trusted guardians of data and data linking, including the kinds of data that are being gathered for covid-19 responses. Currently this is an empty space. Although some countries have information commissioners, they hardly ever appear on the evening news discussing big events or privacy trade-offs in this space. Consider revelations like the Cambridge Analytica scandal which have all been driven by whistleblowers and the media not by public regulators.
The crisis has confirmed the lack of institutions with the skills and authority to be trusted guardians of data.
Yet history tells us that when powerful new technologies arise we cannot rely solely on law or design, which on their own cannot help us make judgments about trade-offs. Instead it’s the combination of law, design and accountable institutions that gives us confidence our interests are being protected.
We take the role of institutions for granted in relation to now-quotidian technologies like the car, and in finance—where complex ecosystems of regulation and law manage the subtleties of pensions, insurance, equities, savings and banking. I expect that we will see a comparable complexity in data to provide visible institutions to work out, in the public interest, the balance of issues around options like an NHS app.
The solutions will have to be complex because the issues are. Some data we can control, such as choosing whether to have an app that for the public benefit tracks our human contact. But other data we can’t control, including the traces our phones leave automatically. There is a similar complexity in the latent value of data. Some of it is only valuable to me, like most of what’s on a Fitbit health and activity tracker. But other data has huge public value, including tracing the behavioural patterns of the virus to help us be better prepared next time.
Into this space I expect we will see the creation of an array of different kinds of data trust, including trusts responsible for the myriad decisions needing to be made concerning health data. During crises it is public data trusts that become all the more important, requiring visible and accountable bodies in positions of management.
This is a debate that has hardly started, as the still vague comments from many leading opinion-formers confirms. Hopefully covid-19 will force the pace to a more sophisticated public debate and towards a more durable social contract that gives us the benefits of smart technologies as well as reliable protections against misuse.
Geoff Mulgan CBE is professor of collective intelligence, public policy and social innovation at the University College London department of science, technology, engineering and public policy, and the former chief executive of Nesta, the UK's innovation foundation.
The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the views of The Economist Group or any of its affiliates. The Economist Group cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.
