B. Disease Tracking and Contact Tracing: Past and Current Practice and Law

In order to frame the ensuing debate, the following subsections offer an overview of the established practice on disease tracking and contact tracing in the field of public health. By now, these are well-established procedures for facing communicable disease outbreaks and pandemics.^{Footnote 11} In addition to the technical elements involved in these procedures, a subsequent subsection tackles the relatively thin international law currently in force on the subject matter.

C. Digitalizing Disease Tracking and Contact Tracing in Times of COVID-19: Deepening Structural Developments in Global Health

The COVID-19 pandemic saw a repeat, writ large, of past tensions between the protection of public health, on the one hand, and the right to privacy, on the other hand. Owing to the state of technological development, novel digital tools for disease surveillance proliferated throughout the crisis. The main justification was based on a public health rationale: in general, “manual” disease tracking through individualized detective work was unsustainable in a pandemic of such a widespread magnitude like COVID-19.^{Footnote 35} At the same time, contact tracing has been deemed to be essential for mounting an effective public health response to the spread of the SARS-CoV-2 virus causing COVID-19.^{Footnote 36} Therefore, when the WHO Director-General declared the spread of the disease to be a public health emergency of international concern on January 30, 2020,^{Footnote 37} he issued a number of temporary recommendations^{Footnote 38} advocating the use of specific measures to face the then-novel disease.^{Footnote 39}

The COVID-19 pandemic was not the first known use of digital tools for conducting disease tracking or contact tracing procedures. For example, a more rudimentary software for tracking the spread of influenza based on the active upload of disease-related data by its users had been developed across multiple countries as early as in 2006.^{Footnote 40} Later, during the spread of the Ebola virus in the Democratic Republic of the Congo in 2018, similar software was employed to conduct disease tracking amongst known cases.^{Footnote 41} But none of these efforts came close to matching the scope of similar software during the COVID-19 pandemic. Furthermore, perhaps owing to the different means of disease transmission,^{Footnote 42} there is so far, no universal health surveillance software capable of tracking and tracing any and all risks of communicable disease contagion and risk thereof. Nevertheless, some of these tools may be portable between diseases.^{Footnote 43}

Across the national responses to COVID-19, digital tools based on the use of tracking software emerged as a feasible alternative to the “classic” manual surveillance.^{Footnote 44} An assortment of options came to the fore. Smartphone apps, for instance, offered the advantage of a constant identification of proximity with infected persons through the continuous monitoring of users’ location.^{Footnote 45} Legal considerations due to the protection of privacy are at stake, particularly as data collected through these apps may contain individually identifiable health information,^{Footnote 46} and transparency on the storage and use of the data by authorities may be absent.^{Footnote 47}

The start of COVID-19 community transmission in Germany, for instance, displays the rationale behind resorting to digital disease surveillance. In January, 2020, the first imported cases of infection with the new SARS-CoV-2 virus in Europe were reported in France.^{Footnote 48} In Germany, a first infection cluster of the virus was detected in the district of Starnberg in the federal state of Bavaria, particularly within the premises of company after one of its employees had returned from Wuhan.^{Footnote 49} After local authorities were privy to the information, they managed to conduct a prompt and effective contact-tracing.^{Footnote 50} Persons who had been in contact with known infections were subjected to mandatory quarantines. The company´s activities were temporarily shut down. These procedures resulted in the initial containment of the disease.

The successful surveillance and response operations in Bavaria bought German authorities precious time to enhance pandemic preparedness. But ultimately, this did not prevent the disease from eventually acquiring community transmission. The key shift occurred at the end of February 2020. At a press conference, the Health Minister of the federal state of North Rhine - Westphalia informed the public of the spread of the virus.^{Footnote 51} In his words, it was no longer possible to “reconstruct” the chain of transmission for every case through contact tracing. This prompted the then-Federal Minister of Health of Germany to declare that a national epidemic was inevitable.^{Footnote 52} What followed was the countrywide spread of the virus.

The beginning of community spread of COVID-19 in Germany showcased the technical justification for the digitalization of disease surveillance through contact tracing. When a communicable disease acquires generalized community transmission, public authorities may lack the resources to effectively locate the contacts of infected persons.^{Footnote 53} “Classic” surveillance through interviews to reconstruct the chain of transmission was overrun by COVID-19. No health agency personnel in the planet can cope with conducting detective work to manually reconstruct the chains of transmission in the face of waves of infection.

Facing this scenario, two novel developments related to contact tracing during the COVID-19 pandemic can be identified. First, the mandatory use of these digital tools was entirely unprecedented.^{Footnote 54} Exceptionally, some countries, like South Korea, had enacted legislation following past outbreaks to set the scene of an app mandate.^{Footnote 55} But their society-wide deployment did not become a reality until the COVID-19 pandemic. A global divide unfolded in terms of the chosen models. The choice was directly dependent on questions of public law. Whether the use of disease tracking and contact tracing apps was mandatory or not became a decisive factor both in the uptake rates of their use—a key condition for their effectiveness^{Footnote 56}—as well as in the degree of infringement of human rights.

So far, there is no record available of national court decisions revoking the deployment of digital COVID-19 disease tracking and/or contact tracing tools as such, by deeming their use as essentially unconstitutional or illegal. Instead, known domestic court cases have focused on the means through which digital disease surveillance has been implemented. Thus, when examining the constitutionality of a digitalized contact tracing mechanism, the Supreme Court of Israel considered that it violated the right to privacy not because of the nature of the public health measure itself, but rather due to the “chosen means.”^{Footnote 57} The latter consisted concretely of the collection of by the Israel Security Agency,^{Footnote 58} with little to no safeguards for transparency and accountability.^{Footnote 59} Recognizing the importance of contact tracing for facing a pandemic like COVID-19, the Supreme Court of Israel held the government should undertake efforts to find less restrictive alternatives.^{Footnote 60} Similarly, the High Court of Kerala at Ernakulam in India issued an injunction mandating the government of Kerala to ensure, first, that COVID-19 surveillance data collected through a software developed by the company Sprinklr was properly anonymized; and second, that there is prior consent given by persons from whom such data is extracted.^{Footnote 61} In its order, the Court highlighted the technical necessity of the disease surveillance software used against the COVID-19 pandemic in the state of Kerala, thus refraining from extending the injunction’s effects to the use of these public health tools more generally.^{Footnote 62}

Second, a salient new feature in the digitalization of disease surveillance through disease tracking and contact tracing after COVID-19 is the increasingly hybrid public-private nature of these procedures. In the past, these procedures were conducted exclusively by public authorities. The delegation of surveillance functions to private bodies is also grounded on an argument of necessity, and raises multiple normative questions of its own.^{Footnote 63} The increased degree of participation of private actors in the creation and implementation of digital disease tracking and contact tracing tools echoes debates on the participation of private for-profit actors in the performance of activities deemed to be public in nature.^{Footnote 64} Before the COVID-19 pandemic, the field of global health had already experienced a rising “private turn” through the proliferation of all sorts of actors with their own resources and interests.^{Footnote 65} While numerous healthcare systems had a mix of public-private elements previous to the pandemic,^{Footnote 66} the field of surveillance through disease tracking and contact tracing had been mostly limited to the public sphere. Thus, public health authorities were the only ones authorized to conduct active disease tracking and contact tracing, which could then lead to the imposition of mandatory isolations and quarantines. The shift towards an increased involvement by private actors in disease surveillance for pandemic response warrants closer examination and legal scrutiny in countries where it has occurred.

Besides the WHO’s guidelines on the matter, a number of policy studies have aimed to identify best practices in the use of digital tools for disease tracking and contact tracing.^{Footnote 67} Arguably, the use of these tools allows for a more efficient use of resources and yields more accurate results on contagion with a disease, and the risk thereof. The hindrances of “classic” manual disease surveillance were visible even before COVID-19. Furthermore, allocating higher numbers of contact tracing personnel in “ordinary” periods in preparation for a devastating pandemic was deemed to be economically unsustainable.^{Footnote 68} But ultimately, the use of digital tools for health surveillance is not technically infallible either. Disease tracking software and contact tracing apps may lead to a flawed collection of data, particularly as the algorithms used to configure them can reflect programmers’ biases.^{Footnote 69} Relying upon heightened accuracy as a normative argument can only go so far, especially if and when there is a legal mandate imposed on the inhabitants of a country.

It remains to be seen whether disease surveillance through digital tools will be normalized in pandemic preparedness and response.^{Footnote 70} There does not seem to be a full-blown displacement of traditional methods of disease tracking and contact tracing. To the contrary, several countries saw digital disease-tracking tools coexist with “classic” disease surveillance based on detective work. The latter was taken, for example, through mandatory written forms when entering certain businesses, who were then obliged to transmit the information to authorities in case an infection in a venue was reported at a particular time.^{Footnote 71} Simultaneously, there were digital equivalents to written forms when visiting particular places. Devoted software allowed persons to log in whenever s/he is present at a determinate venue. Persons could then log off after they left the venue.^{Footnote 72} This variation reduced the intensity of tracing by limiting it to instances where persons where present in particular places, although at the expense of a reduced effectiveness because it focused tracing to those spaces only.

Recent events point towards a sporadic resurgence of manual disease surveillance. In the multi-country spread of mpox (formerly known as monkeypox), active at the moment of writing, the “classic” means of disease tracking and contact tracing were deployed.^{Footnote 73} As explained previously, no devoted software for this disease was available at the onset of its multinational spread. On July 23, 2022, the WHO Director-General determined the spread of mpox to be a public health emergency of international concern.^{Footnote 74} Among the recommendations issued under the IHR (2005), both “case detection”—disease tracking—as well as contact tracing were fostered as part of an effective response.^{Footnote 75} This development confirms the viability of these public health tools even beyond COVID-19 and in the absence of digital alternatives.

D. International Health Law and the Future of Digitalized Disease Surveillance

Whereas the public health necessity of digital tools for disease surveillance has been described in the preceding section, a number of normative concerns on the use of these tools remain unsettled. In particular, the role of private actors gives way to questions of how far they should be involved in matters of public health previously within the exclusive remit of authorities. Perhaps it is understandable: Private companies do not represent any constituency and are generally not accountable to the public at large. Nevertheless, the status quo across the world is that a considerable extent of public health services, even those that are publicly funded, are directly provided by private or hybrid public-private actors.^{Footnote 76} This fact partly explains why leading health policy studies do not consider private actor involvement in disease surveillance as problematic per se.^{Footnote 77} The problem lies in the possible absence of proper safeguards to ensure that the implementation of digital disease surveillance procedures by private actors is made in conformity with transparency and accountability requirements.^{Footnote 78}

Societal contexts make all the difference in the legality of digital disease surveillance. There are stark contrasts worldwide on how healthcare and legal systems incorporate them. Technical guidance issued by the WHO on public health measures adopted at a community level to face COVID-19^{Footnote 79} emphasized how, in specific aspects of pandemic response, there is simply no “one size fits all”.^{Footnote 80} Measures that are, first, feasible and, second, acceptable in one community may not be so in another one. By extrapolating such insights to the use of digital tools in disease tracking and contact tracing, we can classify these two considerations of feasibility and acceptability as consisting of two global divides: a digital and a normative one. In terms of the global digital divide, the digitalization of disease tracing across the population is directly dependent on the technological infrastructure of the country at hand.^{Footnote 81} It is unreasonable to expect countries where there is a low capacity for digital technology to fully deploy these tools when facing pandemics.^{Footnote 82} Furthermore, there is still no visible consensus on whether disease tracking and contact tracing through digital tools are a necessary component of pandemic responses. Unlike efforts to tackle the more general global digital divide, it remains unclear whether the international community should proactively ensure that digital tools for disease surveillance are made available in countries with a lower-income population.

As for the global normative divide regarding which public health measures are acceptable, different societal values may entail the need to tailor measures to diverging contexts. Whether contact tracing procedures are adopted in a constitutional regime based on a model of liberal democracy or in more authoritarian settings can and should also affect which measures are employed during pandemics, and how.^{Footnote 83} This is both a matter of public health rationale, as well as a recognition of the current status quo under international law. The multilateral community of states welcomes not just liberal democracies, but also regimes with varying levels of authoritarianism.^{Footnote 84} In the burgeoning research on the subject, no strong causal relation has been identified between how public health measures are adjusted to either more liberal or more authoritarian legal systems, on the one hand, and their effectiveness in mitigating the spread of a disease, on the other hand.^{Footnote 85}

The growing role played by private actors in digital disease surveillance activities sheds light upon prevailing structural features of healthcare systems. It is the outcome of a decades-long trend regarding shifting sources of funding for the provision of medical and public health services and products.^{Footnote 86} The limited public financing of health care systems all across the world renders building a fully public digital disease surveillance system illusory in the short term.^{Footnote 87} Yet, beyond this justification, the shift from the public to the private sector for conducting disease tracking carries its own set of normative pitfalls.^{Footnote 88} Concerns abound regarding the extent to which private actors use the data collected through disease surveillance exclusively for the originally intended purposes, a matter made worse by how oversight gaps are reported in multiple jurisdictions^{Footnote 89}—the latter also being at stake in the case of both public and private actors, as scrutinized in the judgment of the Supreme Court of Israel presented above.^{Footnote 90}

The booming literature after COVID-19 on the digitalization of disease surveillance has underscored some of the abovementioned normative pitfalls.^{Footnote 91} Nevertheless, a look back into “classic” modes of disease surveillance sheds light upon recurring debates which are not exclusive to the digitalization process. Several normative concerns were present already in manual disease tracking and contact tracing procedures, particularly when they were implemented through an exercise of police powers by public health authorities.^{Footnote 92} Consequently, during the COVID-19 pandemic, contact tracing conducted without the use of digital tools raised similar normative questions discussed herein.

In any case, in comparison to “classic” disease surveillance, digitalization brought about a change in the degree of intrusiveness in persons’ lives. Through manual detective work, public authorities had access mostly to information strictly related to the spread of a communicable disease. Persons interviewed or questioned about their whereabouts usually reported information only to the extent they considered it relevant for detecting contacts with infected persons. By contrast, digital tools may consist of constant processes of tracing the movement of persons, while registering activities not strictly speaking related to the spread of the disease in question. Thus, the use of digital tools may lead to a deeper and unwarranted look into a person’s privacy. A problematic aspect of this development is how data may be used for purposes other than public health. When information on the location and activities of persons is used in contexts different than those for which it was collected, there may be instances of abuse of authority. These, however, have not pointed so far towards any conclusive argument on whether such digital tools ought to be used or not, let alone to any regulation at the international level.^{Footnote 93} Additionally, from a technical perspective, the degree of intrusiveness of digital tools for disease surveillance can be adjusted. According to some commentators, technologies like “blockchain” can help improve privacy considerations.^{Footnote 94} But these claims require further research before being accepted.

Then, there is the question of the public’s trust in how public authorities, let alone private data service providers, will use information gathered through disease surveillance. The assumptions of individuals living in liberal constitutional democracies is that their relationships with authorities will be based on the respect for human rights and fundamental freedoms, privacy being amongst them. An example from Germany, once again, underscores some of the normative pitfalls of particular concern for liberal democracies. In early 2022, police officials used information gathered through the contact registration app to try to solve a criminal case.^{Footnote 95} It was later clarified that the procedure was irregular and it would be halted immediately.^{Footnote 96} But the damage to public trust in the system on the basis of liberal-democratic principles was done. Furthermore, in the case of data being stored by private providers, the need for ensuring its proper handling becomes even more pressing as the means to foster transparency and accountability may not be as immediate. The need for private companies to guarantee proper use and storage of personal data stemming from COVID-19 surveillance was the background of the injunction issued by the High Court in Kerala, India, as explained in a preceding section.^{Footnote 97}

The normative pitfalls explained above are not necessarily insurmountable. The problem seems to lie not in the use of digital tools to improve public health procedures, but rather in the features of their implementation.^{Footnote 98} There are some means to mitigate the misuse of data. Thus, for instance, legislative bodies can hold authorities from the executiveaccountable —in the particular case, whatever Ministry, Department or Secretariat is tasked with collecting data or monitoring such a process.^{Footnote 99} Likewise, it is an understatement to affirm that the misuse of data by public authorities is far from being a phenomenon limited to disease surveillance.^{Footnote 100} As advocated elsewhere, there is a need for enhanced public deliberation and scrutiny of the normative pitfalls in the use of digital tools for disease tracking and contact tracing.^{Footnote 101} The open question is whether these matters can be tackled at all at the international level.

Last, but certainly not least, if the argument of public health necessity is explored further, a global divide is emerging between those countries that can afford digital tools for disease surveillance and those that cannot. Countries where prevailing healthcare infrastructure and individual purchasing power does not allow for society-wide usage of digital disease surveillance tools risk being left behind. Lopsided capacities make the prospects of international norms in the field wishful thinking. At most, there may be “coalitions of the willing”,^{Footnote 102} where groupings of like-minded governments may reach agreements on common frameworks for regulating the use of digital technologies in disease tracking and contact tracing procedures, whilst leaving other countries out of the framework. Bilateral or regional agreements will remain necessary when these public health procedures involve a cross-border dimension. A notable instance is the European Union, where common rules on data protection and their balancing with individual liberties has led to an increasingly sophisticated regulatory space.^{Footnote 103} But, beyond these regional exceptions, there is no equivalent at the multilateral level. Instead, during the COVID-19 pandemic, it was up to every country or region to develop its own contact tracing software and the criteria that should apply to their use.

E. Conclusions: Keeping Digitalized Disease Surveillance on the Margins of International Law

The COVID-19 pandemic was by no means the first event where authorities exercised their police powers for conducting disease tracking and contact tracing. It was not the first known use of digital tools for those public health procedures either. Yet, in view of the combination of both, COVID-19 did mark a breaking point with the past. Novel normative questions on how police powers are exercised in the area of mass disease surveillance emerged. The extent of responses to these questions will define the range of policy options to come.

Digital tools for disease surveillance are only as effective as the national context allows them to be. While technological progress enables gathering data through digital means, what happens with that data afterwards remains crucial for settling questions of legality. It is unclear how such questions could be addressed internationally instead of domestically. Given the stark contrast in societal values related to restrictions on privacy,^{Footnote 104} only domestic or regional bodies have the political standing to weigh what their societies are willing to withstand.

As the COVID-19 pandemic gradually recedes, authorities across multiple countries have begun phasing out the use of digital tools for disease surveillance. Fears about a more permanent individualized disease tracking and contact tracing have, so far, proven to be exaggerated. Yet the after-effects of using digital tools may not be fully visible for the time being. This raises the question of to what extent the pervasive use of digital tools in disease surveillance will be a one-off situation. Experience gathered during the COVID-19 pandemic may be a catalyst for future normative debates on the specific subject at the international level, independently of whether new binding rules on the subject are enacted.

In the wake of COVID-19, the international community is at a legal juncture on how to set rules for facing future health threats of that kind. The possibility to devise new international norms in the field opens the possibility of holding normative debates on the use of health surveillance tools across countries. Recent developments, however, point towards the opposite direction. Thus, at the moment of writing, both a new convention on pandemic prevention, preparedness and response—a “pandemic treaty”—and amendments to the IHR (2005), are being considered at the WHO. Whether the possible norms resulting from these processes will address multiple normative considerations related to disease tracking and contact tracing remains to be seen— even if there are some indications of where things might be headed.

An Intergovernmental Negotiating Body at the WHO has produced a zero draft on the basis of input by governmental representatives, civil society and experts.^{Footnote 105} Of note is how the text of the zero draft enshrines the sovereign right of states to determine which public health measures will be adopted in response to a pandemic.^{Footnote 106} The provisions, as they currently stand, seem to confirm the aforementioned premise that there is no “one size fits all” approach towards public health measures against pandemics. If all, of even some of the wording on sovereignty in the current draft text of a pandemic treaty at the WHO is enshrined as a legally binding instrument,^{Footnote 107} states would maintain their leeway to adopt the specific measures they deem most appropriate for their contexts. This would clearly encompass the distinct modalities of digital disease surveillance described in this article.

Moreover, in the ongoing process for amending the IHR (2005), the European Union has put forward a proposal to allow the WHO—namely, its World Health Assembly—to develop binding standards on the international use of digital health documents.Footnote ¹⁰⁸ These standards would determine how the interoperability of digital certificates of vaccination or prophylaxis for specific diseases could work, rendering them usable across multiple technological platforms. In theory, this could allow the World Health Assembly to, among other things, enshrine data protection requirements as a condition for accepting digital health certificates when entering a country.Footnote ¹⁰⁹ Nevertheless, even if this amendment were to be approved, the international regulation of digital health certificates under the IHR (2005) would, first, be for the purposes of demonstrating vaccination and prophylaxis, and not surveillance more generally; and, second, be focused on international travel, and not on strictly-speaking domestic settings. And ultimately, the European Union’s proposal addresses neither the digital nor the normative divide, as it overlooks diverging capacities and societal viewpoints between countries on the use of digital health certificates.

In sum, the global normative divide on privacy issues related to digital disease surveillance is not envisaged to be settled within the so-far limited scope of both a future pandemic treaty and potential amendments to the IHR (2005). Instead, there might be avenues for settling that divide at the national or regional levels namely in judicial and quasi-judicial human rights bodies. It would perhaps be a more sensible development, considering the prevailing diversity of societal views on what degree of intrusion in privacy by public health authorities ought to be legally allowed. Nevertheless, that would lead to a fragmented global regulatory landscape where wildly diverging standards on the subject will prevail. Yet, for multiple reasons, a global “one size fits all” regulatory approach towards the digitalization of disease tracking and contact tracing is likely to remain a chimera in the near future.