State of the art in adoption of contact tracing apps and recommendations regarding privacy protection and public health: systematic review

Background: During the outbreak of the COVID-19 pandemic, contact tracing mobile applications have received a lot of public attention. The ongoing debate highlights the challenges with the adoption of data-driven innovation: how to ensure an appropriate level of protection of individual data and maximize public health benefits derivable from the collected data. Objective: The aim of the study was to analyse available COVID-19 contact tracing applications and verify to what extent public health interests and data privacy standards can be fulfilled simultaneously in the process of the adoption of digital health technologies. Methods: A systematic review of Pubmed, Medbase, and grey literature was performed to identify available contact tracing applications. Two checklists were developed to evaluate (1) the compliance with the data privacy standards (2) fulfillment of public health interests. Based on both checklists, a scorecard with a selected set of minimum requirements was established as well. It was to estimate whether the balance between the objective of data privacy and public health interests can be achieved to ensure the broad adaptation of digital technologies. Results: Overall, 21 contact tracing applications were reviewed. In total, 11 criteria were defined to assess the usefulness of each digital technology for public health interests. The most frequently installed features related to the contact alerting and governmental accountability. The least frequent was the availability of the system of medical or organizational support. Only one app provided the threshold for the population coverage needed for the digital solution to be effective. In total, 12 criteria were used to assess the compliance of contact tracing application with data privacy regulations. The explicit user consent, voluntary basis, and the adoption of anonymization techniques were among most frequently fulffiled criteria. The information regarding the personal data breach and data gathered from children was mostly lacking. The balance between standards of data protection and public health benefits were achieved most and least with COVIDSafe, and Alipay Health Code respectively. Conclusions: The contact tracing application with a high level of compliance with standards of data privacy tend to fulfill public health interests to a limited extend. Simultaneously, the digital technologies with a lower level of data privacy protection used to allow for more data collection. Overall the review indicated that consistent number of applications appeared to be compliant with the standards of data privacy, while their usefulness from the public health perspective can still be maximized